BookCheckin (bookcheckin.com) is a Software-as-a-Service platform providing automated guest check-in and regulatory reporting services for accommodation providers in Spain and, where the accommodation has enabled Italian filing, in Italy, operated by Serlet Servicios Auxiliares (CIF B42527879), Calle Baladre 20, 03700 Denia, Alicante, Spain.
Data Controller: The accommodation provider (hotel, hostel, apartment, etc.) that uses BookCheckin to collect Guest data.
Data Processor: Serlet Servicios Auxiliares (BookCheckin), acting on the instructions of the Data Controller.
For questions about this policy: privacy@bookcheckin.com
| Data | Purpose | Legal Basis |
|---|---|---|
| Name, email address, username | Account creation and authentication | Contract performance (Art. 6(1)(b) GDPR) |
| Google / Apple profile (name, email) | Optional sign-in via Google or Apple, where you choose social login | Contract performance (Art. 6(1)(b)) |
| Billing details (via Stripe) | Payment processing | Contract performance |
| Authority credentials — the Ministry web-service username and password for SES Hospedajes and, where the accommodation has enabled Italian filing, the Alloggiati Web Utente, Password and WS Key | Signing in to the authority's service on your behalf to make your own declarations for your properties. Stored encrypted and used for nothing else; deleted when you ask us to or when the property is deleted (see section 7.12 of the Terms of Service). BookCheckin holds no credentials for the Mossos d'Esquadra or the Ertzaintza. | Contract performance (Art. 6(1)(b)) |
| Login timestamps, IP addresses, device/user-agent | Security, session management and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Profile photo (optional) | Displayed to you and your team members within the platform, to personalise your account. You choose whether to upload one and can remove it at any time in Settings; it is deleted immediately on removal or account deletion. | Consent (Art. 6(1)(a)) |
| Data Category | Examples | Legal Basis |
|---|---|---|
| Identity | Full name, date of birth, nationality, sex | Legal obligation (Art. 6(1)(c)) — RD 933/2021 (Spain); art. 109 TULPS (Italy, where the accommodation has enabled Italian filing) |
| Identity document | Document type, number, support number. The document scan image is processed transiently to extract these fields and is not stored on our servers (see section 4). | Legal obligation (Art. 6(1)(c)) |
| Residence | Address, city, postal code, country | Legal obligation (Art. 6(1)(c)) |
| Signature | Electronic signature / declaration captured at check-in (adult guests) | Legal obligation (Art. 6(1)(c)) |
| Minors' data | For children under 14: name, date of birth, nationality, and relationship to the accompanying adult. No identity document or signature is required for under-14s. | Legal obligation (Art. 6(1)(c)) |
| Contact | Phone, email (guest-provided; may also be imported from the booking) | Legitimate interests of the Customer |
| Stay data | Check-in/check-out dates, reservation number | Legal obligation + Contract performance |
When guests upload identity document images, those images are sent to Anthropic's Claude API (a third-party AI service based in the United States) to extract the document fields required for traveller registration (name, document number, nationality, date of birth, expiry). All images are transmitted over encrypted connections. In accordance with Anthropic's commercial API terms, Anthropic does not use API-submitted data to train its models. Once the required fields have been extracted, the document image is discarded and is not persisted on our servers.
Storage of document images. Identity document images are not stored or retained on our servers. They are transmitted to Anthropic's Claude API (with EXIF metadata removed, over an encrypted connection) solely to extract the fields required for traveller registration, and are then discarded. Only the extracted text fields are stored in our database, for the retention period described in section 7, and those text fields are securely deleted when an erasure request is fulfilled. This data is not used for any purpose other than those described in this policy.
For Anthropic's data practices, see anthropic.com/privacy.
We share personal data only in the following circumstances, and only as needed to deliver the service on the Customer's instructions:
| Recipient | Purpose | Safeguards |
|---|---|---|
| Spain Ministry of Interior (SES Hospedajes) | Mandatory traveller registration (RD 933/2021) for accommodation that files through SES Hospedajes. BookCheckin transmits the data on the accommodation provider's behalf, using the provider's own Ministry web-service credentials. | Statutory requirement — no transfer safeguard needed |
| Polizia di Stato (Italy) — Alloggiati Web | Mandatory declaration of lodged persons for accommodation located in Italy. Where the accommodation has enabled Italian filing, BookCheckin transmits the traveller data to the Alloggiati Web service of the Polizia di Stato on the accommodation provider's behalf, using the provider's own Alloggiati Web credentials, which BookCheckin stores in encrypted form. A declaration, once transmitted, cannot be withdrawn or amended through BookCheckin. | Legal basis: statutory requirement (art. 109 of the Testo Unico delle Leggi di Pubblica Sicurezza (TULPS), R.D. 773/1931; art. 5 D.L. 53/2019; D.M. 7 January 2013 as amended by D.M. 16 September 2021). Safeguards: no transfer safeguard needed (Italy is in the EEA); the Polizia di Stato receives the data as a controller in its own right; the credentials are used only to authenticate that provider's own declarations. |
| Mossos d'Esquadra (Catalonia) — regional police guest register | Mandatory traveller registration for accommodation in Catalonia that uses BookCheckin's Mossos d'Esquadra filing. BookCheckin does not transmit anything to the Mossos d'Esquadra: it prepares the registration file in their official format, and the accommodation provider uploads it to the Mossos portal itself. BookCheckin holds no credentials for that portal and never signs in to it. | Legal basis: statutory requirement (RD 933/2021); registration of establishments in Catalonia is made with the Mossos d'Esquadra, as set out in the Generalitat de Catalunya's communiqué of 7 August 2024. Safeguards: BookCheckin makes no transfer to the Mossos d'Esquadra, which receive the file from the accommodation provider as a controller in its own right. |
| Ertzaintza (Basque Country) — Registro Hostelero | Mandatory traveller registration for accommodation in the Basque Country that uses BookCheckin's Ertzaintza filing. BookCheckin does not transmit anything to the Ertzaintza: it prepares the registration file in the format its Registro Hostelero accepts, and the accommodation provider uploads it itself. BookCheckin holds no credentials for that portal and never signs in to it. | Legal basis: statutory requirement (RD 933/2021); registration of establishments in the Basque Country is made in the files of the Basque Government's Department of Security (Registro Hostelero), as set out in the Ertzaintza information note of 24 September 2024. Safeguards: BookCheckin makes no transfer to the Ertzaintza, which receives the file from the accommodation provider as a controller in its own right. |
| Anthropic (Claude API) | AI document field extraction (OCR) | Data Processing Agreement; Standard Contractual Clauses for international (US) transfers |
| Address autocomplete (HERE Technologies; CartoCiudad / IGN-CNIG for Spanish addresses) | Where a guest uses the optional address search box, converting the residence address they type into structured suggestions so they can enter an accurate address. Only the typed address text is sent — no name, document, email or other data — and the request is made server-side by BookCheckin, so the provider does not receive the guest's IP address or browser information. | Data Processing Agreement; Standard Contractual Clauses for any processing outside the EEA. Used only where the accommodation enables the address search; guests may type their address manually instead. |
| Stripe | Payment processing (Customer billing only) | SCCs; PCI-DSS compliant |
| Property Management Systems / channel managers (e.g., Amenitiz) | Importing reservation and booker details for connected accounts; and, only where the Customer switches it on, writing a check-in status (status, time, number of guests, link to the record — no identity document data) to the Customer's own reservation in that system | At the Customer's instruction; Data Processing Agreement. The receiving system is the Customer's own account. |
| Messaging provider (WhatsApp) | Delivering check-in links and notifications to guests, where configured | Data Processing Agreement; limited to the contact data needed to send the message |
| Email delivery provider | Transactional and support emails | Data Processing Agreement |
| Google / Apple | Optional social sign-in for Customer accounts | Only where the Customer chooses to sign in with Google/Apple |
| Google Analytics (Google Ireland Limited) | Aggregate website usage statistics — which pages are visited, and how visitors reach the site | Data Processing Agreement (Google Ads Data Processing Terms, which govern Google Analytics); EU-US Data Privacy Framework, with Standard Contractual Clauses where it does not apply (see section 6). Whether analytics cookies and identifiers are used depends on your choice in the cookie banner (see section 11). |
| Smart-lock providers (e.g., Nuki, igloohome, TTLock) | Issuing access codes for self check-in, where the Customer enables it | Data Processing Agreement; only the data needed to grant access |
| Cloud infrastructure (DigitalOcean) | Server hosting and database | Data Processing Agreement; servers located in the EU (Frankfurt, Germany) |
We do not sell, rent, or share personal data with advertisers or data brokers.
Anthropic is based in the United States. Where guest document images are sent to Anthropic's API to extract the required fields, this constitutes a transfer outside the EEA. This transfer is governed by Standard Contractual Clauses (SCCs) as adopted by the European Commission. Our servers and database are hosted within the EU (Frankfurt, Germany).
Where a guest uses the optional address search, the address text they type may be processed by HERE Technologies (owned by a European consortium). To the extent any such processing occurs outside the EEA, it is governed by Standard Contractual Clauses under HERE's Data Processing Agreement. Address search for Spanish addresses uses CartoCiudad, a service of Spain's National Geographic Institute (IGN-CNIG), processed within the EU.
Our website uses Google Analytics, supplied by Google Ireland Limited (Dublin, Ireland) under the Google Ads Data Processing Terms. The usage data it collects may be processed by Google outside the EEA, including in the United States. For those transfers Google relies on the EU-US Data Privacy Framework — the subject of a European Commission adequacy decision of 10 July 2023, and a framework under which Google LLC is certified — and on Standard Contractual Clauses where the Framework does not apply. Your choice in the cookie banner determines whether analytics cookies and identifiers are used (see section 11); the Google Analytics tag itself loads on every page, so Google is a recipient either way. What it receives is page and device information — such as the page address, the referring page, the browser and the screen size — not the identity documents or the check-in details a guest submits.
| Data Type | Retention Period | Reason |
|---|---|---|
| Guest identity records — accommodation in Spain (including Catalonia and the Basque Country) | 3 years from date of stay | Spanish regulatory requirement (RD 933/2021, art. 5.3; Ley Orgánica 4/2015) |
| Guest identity records — accommodation in Italy where the accommodation has enabled Italian filing | Deleted once the receipt (ricevuta) for the transmitted stay has been generated, after a short technical grace period. After deletion, the guest PDF and data export for that stay can no longer be regenerated. | Italian regulatory requirement (D.M. 7 January 2013, art. 4-bis §2, inserted by D.M. 16 September 2021): the accommodation provider must delete the transmitted data once the receipt is generated. The three-year Spanish period does not apply to these records. |
| Alloggiati Web receipt (ricevuta) | 5 years | Italian regulatory requirement (D.M. 7 January 2013, art. 4-bis §2): the receipt is kept as the accommodation provider's proof that the declaration was made. |
| Authority credentials (SES Hospedajes; Alloggiati Web) | Until you ask us to delete them or the property is deleted | Needed to transmit on your behalf; not kept for any other purpose (see section 7.12 of the Terms of Service) |
| Identity document images | Not retained — processed transiently to extract the required fields, then discarded (see section 4) | Images are not stored on our servers |
| Customer account data | Duration of contract + 2 years | Legal obligation and dispute resolution |
| Billing records | 5 years | Tax and accounting obligations (Spanish law) |
| Security logs (IP, timestamps) | Up to 12 months | Security and fraud detection |
| Free-trial fraud-prevention identifier (an opaque payment-card hash provided by Stripe — not a card number, and not reversible into one) | Up to 24 months after account deletion | Preventing repeat free trials. This single identifier is retained after an erasure request, with your email address removed from it, so that deleting an account cannot be used to reset the free trial (legitimate interests, Art. 6(1)(f)). It is then deleted automatically. |
We implement appropriate technical and organisational measures to protect personal data, including:
In the event of a data breach affecting your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.
If you are in the EU/EEA, you have the following rights:
To exercise these rights, contact privacy@bookcheckin.com. We will respond within 30 days.
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD): aepd.es.
Guests whose data is processed through BookCheckin should contact the accommodation provider (the Data Controller) to exercise their GDPR rights. The accommodation provider is responsible for responding to such requests. BookCheckin will assist the accommodation provider in fulfilling these requests as required by our Data Processing Agreement.
BookCheckin uses the following cookies:
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
| access_token | Authentication session | httpOnly, SameSite=Lax (not accessible to JS) | Session / configurable |
| csrf_token | CSRF protection | SameSite=Lax (readable by JS) | Session / configurable |
| _ga, _ga_* | Aggregate usage statistics via Google Analytics 4 — which pages are visited, and how visitors reach the site | Third-party (Google) — set only if you accept analytics cookies in the cookie banner | 2 years (Google's default) |
Analytics cookies are set only with your consent. Google Analytics loads with storage denied by default, so no _ga cookie is written and no analytics identifier is kept on your device unless you accept analytics cookies, either with "Accept all" or by turning on "Analytics" under "Customise". If you choose "Reject all", close the banner, or make no choice at all, analytics storage stays denied. Your choice is stored in your browser. You can change it or withdraw your consent at any time, as easily as you gave it, from the "Cookie settings" link at the bottom of our website's pages; if you withdraw consent, we delete the Google Analytics cookies from your browser.
We do not use advertising cookies, and we do not track you across other websites for advertising purposes: advertising storage, ad personalisation and advertising-related data sharing are denied at all times and are not enabled by accepting the banner. We use no other third-party tracking cookies.
We may update this Privacy Policy from time to time. We will notify Customers via email or in-app notification at least 14 days before material changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
Serlet Servicios Auxiliares — BookCheckin Privacy Team
CIF: B42527879
Address: Calle Baladre 20, 03700 Denia, Alicante, Spain
Email: privacy@bookcheckin.com
Website: bookcheckin.com