At Hotel Aran La Abuela, we are committed to protecting the privacy and personal data of our clients and users. We therefore process personal information in accordance with the applicable data protection legislation and the principles of transparency, confidentiality and security.
This Privacy Policy explains how personal data provided through our website is collected, used and protected, as well as the rights users may exercise.
1. Data controller
In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), the controller of the personal data is:
Company name: HOTEL ARAN LA ABUELA S.L.
Trade name: Hotel Aran La Abuela
Spanish tax identification number (NIF): B25601220
Address: Avenida Castiero, 5, 25530 Vielha, Lleida, Spain
Telephone: +34 973 64 00 50
Email: hotelaran@hotelaran.net
Website: https://www.hotelaran.net
For any queries relating to the protection of personal data, you can contact us at the email address indicated above.
2. Personal data we process
Hotel Aran La Abuela may collect and process different categories of personal data, depending on the services requested and the relationship established with the user:
- Identification data: first name, surname and identification details needed to manage bookings and comply with applicable legal obligations.
- Contact details: email address, telephone number, postal address and country of residence, where applicable.
- Booking and stay data: check-in and check-out dates, number of guests, room type and other information needed to manage the services booked.
- Financial and billing data: information relating to payments, invoices and financial transactions connected with hotel services.
- Information provided through forms: information submitted through contact forms or newsletter subscription forms.
- Browsing data: IP address, technical information about the device and data obtained through cookies and similar technologies, in accordance with the user’s settings.
The data processed will be adequate, relevant and limited to what is necessary for the relevant purposes.
3. Purposes and legal bases for processing
Personal data will be processed for the following purposes, on the legal basis applicable to each purpose.
3.1. Handling enquiries and requests
To respond to enquiries received through contact forms, email, telephone or other communication channels, and to provide the requested information about the hotel and its services.
Legal basis: taking steps at the request of the data subject before entering into a contract when the enquiry relates to a potential booking, or the controller’s legitimate interest in responding to general enquiries, where applicable and following the relevant balancing assessment.
3.2. Managing bookings and stays
To process bookings, confirm room availability, manage payments, changes or cancellations, provide the services booked and maintain the communications necessary during the contractual relationship.
Legal basis: performance of a contract or taking steps at the request of the data subject before entering into a contract, under Article 6(1)(b) of the GDPR.
3.3. Compliance with legal obligations
To manage the data needed to comply with the legal obligations applicable to hotel establishments, particularly those relating to guest registration, billing, accounting and responding to requests from the competent authorities.
Legal basis: compliance with a legal obligation, under Article 6(1)(c) of the GDPR.
3.4. Sending commercial communications
To send newsletters, news, promotions and offers relating to Hotel Aran La Abuela to users who have given their consent to receive them.
Legal basis: the data subject’s consent, under Article 6(1)(a) of the GDPR.
Users may withdraw their consent at any time by using the unsubscribe link included in commercial communications or by writing to hotelaran@hotelaran.net. This will not affect the lawfulness of processing carried out before consent was withdrawn.
3.5. Website security and operation
To ensure the website operates properly, prevent fraudulent use, detect technical issues and protect computer systems.
Legal basis: the controller’s legitimate interest in maintaining the security and integrity of its systems, under Article 6(1)(f) of the GDPR, where applicable.
3.6. Browsing analysis
To obtain statistical information about how the website is used and improve its operation through analytics tools, when these are enabled.
Legal basis: the user’s consent, where required under applicable law.
For more information about these technologies, you can consult our Cookie Policy.
4. Retention of personal data
Personal data will be retained for as long as necessary to fulfil the purposes for which it was collected and, afterwards, for the legally required periods to meet the relevant obligations and liabilities.
In particular:
- Enquiries and requests: for as long as necessary to respond to them and, where applicable, manage any potential liabilities.
- Bookings and stays: for the duration of the contractual relationship and, afterwards, for the retention periods established by tax, accounting, contractual and other applicable rules.
- Guest registration: for the period required under the regulations in force on the documentary registration of accommodation establishments.
- Commercial communications: until the user withdraws their consent or requests the deletion of their data, without prejudice to retaining the information needed to demonstrate compliance with legal obligations.
- Browsing data: for the periods specified in the Cookie Policy and in accordance with the user’s preferences.
- Security-related data: for as long as necessary to prevent, detect or manage incidents and address any resulting liabilities.
Once the relevant periods have expired, the data will be deleted or, where legally required, blocked for the applicable retention periods.
5. Recipients of personal data
Hotel Aran La Abuela does not sell users’ personal data.
Data may be disclosed to third parties when necessary to provide the services booked or comply with the relevant legal obligations.
Potential recipients include:
- Public administrations and competent authorities, where disclosure is required by law.
- Financial institutions and payment service providers, where necessary to manage financial transactions.
- Other legally authorised recipients, where disclosure is necessary and supported by a valid legal basis.
In addition, certain providers of web hosting, IT maintenance, booking management and electronic communications may access personal data on behalf of the hotel when necessary to provide their services.
Where these providers act as processors, their access to the data will be subject to the obligations and safeguards set out in Article 28 of the GDPR.
6. International data transfers
If international transfers of personal data outside the European Economic Area are made to provide certain services, they will be carried out in accordance with the General Data Protection Regulation (GDPR).
Where applicable, the legally established mechanisms and safeguards will be used, such as European Commission adequacy decisions or the standard contractual clauses approved by the Commission.
Users may request further information about international transfers of their personal data and the applicable safeguards by emailing hotelaran@hotelaran.net.
7. Users’ rights
Under the data protection legislation in force, users may exercise the following rights:
- Access: to find out whether their personal data is being processed and obtain information about that processing.
- Rectification: to request the correction of inaccurate or incomplete data.
- Erasure: to request the deletion of personal data when the legally established requirements are met.
- Objection: to object to certain processing of their personal data.
- Restriction of processing: to request that the processing of their data be restricted in the cases provided for by law.
- Data portability: to receive their personal data in a structured, commonly used and machine-readable format and transmit it to another controller where legally applicable.
- Withdrawal of consent: to withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
- Automated individual decision-making: not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject, except in cases permitted by law and subject to the relevant safeguards.
How can you exercise these rights?
You can send your request to:
HOTEL ARAN LA ABUELA S.L.
Avenida Castiero, 5, 25530 Vielha, Lleida, Spain
Email: hotelaran@hotelaran.net
The request must specify the right you wish to exercise and provide the information needed to identify you. If there are reasonable doubts about your identity, additional information may be requested to verify it.
Requests will generally be handled within one month of receipt. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. You will be informed of the extension in accordance with the regulations.
Exercising these rights is free of charge, except in the cases provided for by law.
If you believe that the processing of your personal data does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) through its official website: https://www.aepd.es.
8. Mandatory nature of the data
Data requested in the website forms will be mandatory only when necessary to handle the request or provide the relevant service.
Failure to complete mandatory fields may prevent us from responding to an enquiry, processing a booking or providing a particular service.
Newsletter subscription is voluntary and is not required to browse the website or make bookings.
9. Accuracy and updating of data
Users are responsible for providing truthful, accurate and up-to-date personal data and for notifying us of any changes that may affect its proper use.
Hotel Aran La Abuela may request that certain data be updated where necessary to manage a booking, comply with legal obligations or properly provide the services booked.
10. Security and confidentiality
HOTEL ARAN LA ABUELA S.L. adopts appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss, disclosure or improper processing, taking into account the nature of the information and the associated risks.
Access to personal data will be limited to the people and providers who need to process it to perform their duties and who are subject to the relevant confidentiality obligations.
11. Protection of children’s data
The processing of children’s personal data will comply with the legislation in force and take into account the special protection afforded to children.
Where it is necessary to collect children’s data to manage bookings or provide accommodation services, only the information needed for those purposes will be requested.
For processing that requires consent, the applicable legal requirements will be observed according to the child’s age and the nature of the processing.
12. Cookies and similar technologies
The Hotel Aran La Abuela website may use cookies and similar technologies to ensure its operation and, where applicable, analyse browsing activity or provide additional features.
Cookies that require consent will only be used after the user has given the relevant authorisation.
To find out about the categories of cookies used, their purposes and duration, and the available settings, consult our Cookie Policy.
13. Changes to the Privacy Policy
HOTEL ARAN LA ABUELA S.L. may amend this Privacy Policy to reflect changes in the law, updates to data processing activities or new website features.
Changes will be published on this page. Where legally required, data subjects will be informed or their consent will be requested again.
Last updated: 16 October 2026.
