"BookCheckin", "we", "us", or "our" refers to BookCheckin (bookcheckin.com), operated by Serlet Servicios Auxiliares (CIF B42527879), Calle Baladre 20, 03700 Denia, Alicante, Spain.
"Service" means the BookCheckin web platform, APIs, and related software.
"Customer" or "you" means any person or legal entity that registers for and uses the Service.
"Guest" means a traveller whose data is processed through the Service on behalf of a Customer.
You must be at least 18 years old and have legal authority to enter into this agreement on behalf of yourself or your organisation. By accepting these terms, you represent that you meet these requirements.
BookCheckin provides:
You must provide accurate, complete, and current information when creating an account. You are responsible for maintaining the confidentiality of your credentials and for all activity that occurs under your account. Notify us immediately at legal@bookcheckin.com of any unauthorised use.
The Service is billed monthly per property. Pricing tiers and any applicable discounts are detailed on our pricing page. Minimum subscription covers 3 properties.
Payments are processed securely through Stripe. By providing payment details, you authorise us to charge the applicable fees on a recurring monthly basis. All prices are in Euros (EUR) and exclude applicable taxes (e.g. Spanish IVA).
New accounts may be eligible for a promotional free-trial period as advertised at the time of sign-up. No payment is required during the trial. We will notify you before any trial converts to a paid subscription.
You may cancel your subscription at any time from your account settings. Your access will continue until the end of the current billing period. We do not offer refunds for partial months, except where required by applicable law.
You agree not to:
BookCheckin acts as a Data Processor when handling Guest personal data on your behalf; you are the Data Controller. Our Privacy Policy describes how we process personal data.
This section 7 is the written contract required by Article 28(3) GDPR between you as Controller and BookCheckin as Processor. There is no separate document to request or sign: by accepting these Terms you accept this section, and it binds both of us for as long as we process Guest personal data on your behalf. It applies from the date you accept these Terms; for existing Customers it takes effect as described in section 16. Where our Privacy Policy refers to "our Data Processing Agreement", it means this section.
We may later offer a standalone Data Processing Agreement, for example where your own compliance policy requires a separately signed document. If we do, it will supplement or replace this section by written agreement between us. Until then this section governs, and no other data-processing contract exists between us.
Subject matter and purpose: processing Guest personal data so that you can meet your legal traveller-registration obligation under Royal Decree 933/2021 (Spain) and, where the accommodation has enabled Italian filing, under Italian public-security law (Italy), and so that you can operate guest check-in. Nature of the processing: collection through guest-facing check-in forms; transient AI-assisted extraction of the required fields from identity documents; storage, structuring and display in your dashboard; transmission to Spain's Ministry of Interior (SES Hospedajes) and, where the accommodation has enabled Italian filing, to the Alloggiati Web service of Italy's Polizia di Stato; preparation of the registration file for the Mossos d'Esquadra or the Ertzaintza, which you upload yourself; export at your request; and erasure. Duration: for as long as your subscription is in force, and after that only as described in section 7.10.
Types of personal data: those itemised in section 2.2 of the Privacy Policy — identity data, identity-document data, residence address, electronic signature, contact details and stay data. Identity document images are processed transiently to extract those fields and are not stored on our servers. Categories of data subject: Guests staying at your properties, including accompanying minors, and the booker of a reservation where that is a different person.
We do not process special categories of personal data (Article 9 GDPR) on your behalf: the check-in flow requests no selfie and performs no facial recognition or biometric comparison.
We process Guest personal data only on your documented instructions, including as regards transfers to a third country. Your documented instructions are these Terms, the configuration you choose in the platform (which properties are active, and which integrations, notifications, smart locks and address search you enable), and any further written instruction we accept. We do not process Guest personal data for our own purposes, we do not sell it, and neither we nor our document-extraction sub-processor use it to train AI models.
Where Union or Spanish law requires us to process Guest personal data other than on your instructions, we will tell you about that requirement before processing, unless the law forbids it. We will also tell you if, in our opinion, an instruction of yours infringes the GDPR or other applicable data protection law.
Every person we authorise to process Guest personal data is bound by an obligation of confidentiality that continues after their engagement ends, and access to Guest personal data is limited to those who need it to operate or support the Service.
We implement the technical and organisational measures set out in section 8 of the Privacy Policy, which is incorporated into this section by reference and is our Article 32 commitment to you — among them encryption in transit (TLS 1.2+), httpOnly SameSite session cookies and CSRF tokens, HTTP security headers, removal of EXIF metadata from uploaded images, rate limiting on authentication and document-scanning endpoints, two-factor authentication available on every account, need-to-know staff access, and EU-hosted servers and database. We may change these measures over time, provided the overall level of protection is not reduced.
You give us general written authorisation to engage sub-processors. Those we engage, with their purpose and safeguards, are listed in section 5 of the Privacy Policy. At the date of these Terms they are:
We impose on each sub-processor data protection obligations no less protective than those in this section, and we remain liable to you for their performance of those obligations, subject to section 12.
Transfers outside the EEA. Anthropic and Resend are established in the United States, so processing by them is a transfer outside the EEA. Both transfers are governed by the European Commission's Standard Contractual Clauses, incorporated into those providers' data processing agreements. Our own servers and database are located in the EU.
The Ministry and the other authorities are not sub-processors. Transmitting traveller data to Spain's Ministry of Interior (SES Hospedajes) is a legal obligation under Royal Decree 933/2021 and, where the accommodation has enabled Italian filing, transmitting it to the Alloggiati Web service of Italy's Polizia di Stato is a legal obligation under Italian law. The Ministry and the Polizia di Stato each receive that data as a controller in its own right, not on your instructions or ours. The same is true of the Mossos d'Esquadra (Catalonia) and the Ertzaintza (Basque Country), which receive the registration file from you and not from us. Section 7.12 explains who transmits to which authority.
Changes to the list. We will notify you by email, at the address on your account, at least 30 days before we add or replace a sub-processor that processes Guest personal data — or as soon as we reasonably can where an urgent change is needed to keep the Service secure or available. You may object on reasonable data protection grounds within that period; if we cannot offer you an alternative, you may terminate your subscription on written notice with immediate effect and nothing further will fall due.
Taking into account the nature of the processing, we assist you in fulfilling your obligation to respond to Guests exercising their rights under Chapter III GDPR. The platform gives you the tools to do that yourself: you can export a single Guest's record (Article 20) or your whole traveller register as CSV, XLSX or PDF, and you can erase a single Guest's record (Article 17) from the dashboard. Those tools remain available even if your subscription lapses, because your duty to answer a Guest does not lapse with your billing.
If a Guest contacts us directly, we will not answer the substance of their request: we will point them to you and tell you without undue delay. We also assist you, taking into account the information available to us, with your obligations under Articles 32 to 36 GDPR — security, breach notification, data protection impact assessments and prior consultation.
We will notify you without undue delay after becoming aware of a personal data breach affecting Guest personal data we process on your behalf, and will give you the information we hold about it: its nature, the categories and approximate number of Guests and records concerned, the likely consequences, and the measures we have taken or propose to take. Notifying the Spanish Data Protection Agency (AEPD) within 72 hours where required, and informing affected Guests, is your responsibility as Controller; we will assist you with it. Where BookCheckin is itself the controller — for example for your own Customer account data — we make that notification in our own name, as described in section 8 of the Privacy Policy.
We will make available to you all information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by you or by an auditor you mandate. Audits require at least 30 days' written notice, take place during normal business hours, are subject to confidentiality, and must not disrupt the Service or the security and confidentiality of other Customers' data. We may first provide up-to-date documentation of our measures; if that does not reasonably answer your questions, the audit goes ahead. For more than one audit in any 12-month period we may charge our reasonable costs, unless the further audit follows a personal data breach or is required by a supervisory authority.
When we stop providing the Service to you, we will, at your choice, delete or return the Guest personal data we process on your behalf and delete existing copies — except where Union or Spanish law requires us to keep it. Article 28(3)(g) GDPR provides for that exception, and here it is not theoretical.
Statutory retention carve-out (Spain). Article 5.3 of Royal Decree 933/2021 requires the traveller register to be kept for three years counted from the end of the contracted service — in practice, from the Guest's checkout. Where a traveller record is still inside that three-year window when your subscription ends, we do not delete it: we keep it for the remainder of the window, solely to satisfy that statutory requirement and for no other purpose, and delete it once the window closes. Records already outside the window are deleted or returned as you choose. A promise to delete everything on termination would conflict with that obligation, so we do not make one.
Italy. Where the accommodation has enabled Italian filing, the carve-out above does not apply to the Guest personal data of an Italian stay, because Italian law requires the opposite. D.M. 7 January 2013, art. 4-bis §2 (inserted by D.M. 16 September 2021), requires the accommodation provider to delete the transmitted digital data as soon as the receipt (ricevuta) confirming the communication has been generated, and to keep that receipt for five years. As your processor we therefore delete the Guest personal data of a transmitted stay once its receipt has been generated, after a short technical grace period, and we keep the receipt for five years. After that deletion, the Guest PDF and data export for that stay can no longer be regenerated.
Taking your register with you. You can export your traveller register at any time as CSV, XLSX or PDF, without asking us and whatever your billing status. For a stay transmitted to Alloggiati Web, the export is available only until that stay's data is deleted as described above.
If you delete your account instead. Deleting an owner account in the platform is an immediate erasure instruction from you as Controller, and we act on it at once: we erase the identifying fields of every Guest record held under that account, delete any stored files, and — where a submission has already been made to SES Hospedajes — request its cancellation at the Ministry, leaving only a non-identifying audit record. A declaration already transmitted to Alloggiati Web cannot be cancelled: Alloggiati Web has no cancellation operation. That is not the same as the carve-out above. Keeping the statutory register for the three-year period is your obligation as Controller, so export it before you delete your account.
You are responsible for:
Who transmits. The authorities are not all handled the same way, and the difference is deliberate. For accommodation in Catalonia and the Basque Country, BookCheckin performs no transmission at all: it prepares the registration file, and you, as Controller, upload it to the Mossos d'Esquadra or the Ertzaintza yourself. For Spain (SES Hospedajes) and, where the accommodation has enabled Italian filing, Italy (Alloggiati Web), BookCheckin performs the transmission on your behalf.
Credentials. To transmit on your behalf, BookCheckin stores the credentials you supply and signs in to the authority's service as you: for SES Hospedajes, the Ministry web-service username and password you enter for each property; and, where the accommodation has enabled Italian filing, your Alloggiati Web Utente, Password and WS Key. We store them encrypted and use them solely to authenticate to that authority's service in order to make your own declarations for your properties; we use them for nothing else. Your Alloggiati Web credentials are never returned to any page, API response or log. Your Ministry password is left out of ordinary page and API responses and is revealed only on request, to members of your account with manager access. We delete a property's stored credentials when you ask us to and when the property is deleted; switching a property to a different filing authority does not by itself delete the credentials stored for the previous one (so that you can switch back), so ask us if you want them deleted. BookCheckin holds no credentials for the Mossos d'Esquadra or Ertzaintza registers and never signs in to either portal.
Italian declarations cannot be withdrawn through BookCheckin. Alloggiati Web has no cancellation or correction operation. Once a declaration has been transmitted it cannot be withdrawn or amended through BookCheckin; only your Questura can act on it. The registration obligation and the credentials remain yours, and your establishment must already be registered for Alloggiati Web with your Questura: BookCheckin can check that the credentials authenticate, but not that your registration is in order.
BookCheckin facilitates Guest data submission to the competent authority as required by law. For Spain (SES Hospedajes) and, where the accommodation has enabled Italian filing, Italy (Alloggiati Web), BookCheckin transmits the data on your behalf; for Catalonia and the Basque Country it prepares a file that you must upload yourself (see section 7.12). The registration obligation, including its deadline, remains yours in every case; in Italy the deadline is 24 hours from arrival, or six hours for a stay of 24 hours or less. You remain legally responsible for ensuring all traveller data you submit is accurate and complete. BookCheckin is not liable for regulatory penalties arising from inaccurate data provided by you or your Guests.
All rights, title, and interest in the Service (including software, trademarks, and content) remain with BookCheckin. We grant you a limited, non-exclusive, non-transferable licence to use the Service during the subscription period solely for your internal business purposes.
We aim for high availability but do not guarantee uninterrupted access. We may perform maintenance, updates, or modifications to the Service with or without notice. We may discontinue features with at least 30 days' notice where reasonably practicable.
The Service is provided "as is" and "as available" without warranties of any kind, express or implied. We do not warrant that the Service will be error-free or that document recognition results will be 100% accurate. You are responsible for verifying the accuracy of data before submission to any authority.
To the maximum extent permitted by applicable law, BookCheckin's total liability arising out of or in connection with these Terms shall not exceed the total fees paid by you in the 12 months preceding the claim. We are not liable for indirect, incidental, special, consequential, or punitive damages.
You agree to indemnify and hold BookCheckin harmless from any claims, losses, or damages (including reasonable legal fees) arising from your breach of these Terms, your violation of any law, or your misuse of the Service.
Either party may terminate these Terms at any time. We may suspend or terminate your account immediately if you breach these Terms or if we are required to do so by law. Upon termination, your right to access the Service ceases and we will delete or anonymise your data in accordance with our data retention policy (see Privacy Policy).
These Terms are governed by the laws of Spain. Any disputes shall be subject to the exclusive jurisdiction of the courts of Spain. If you are a consumer in the EU, you also have the right to use the EU Online Dispute Resolution platform at ec.europa.eu/consumers/odr.
We may update these Terms from time to time. We will notify you by email or via the platform at least 14 days before material changes take effect. Continued use of the Service after that date constitutes acceptance of the updated Terms.
For questions about these Terms, contact us at:
Serlet Servicios Auxiliares — BookCheckin
CIF: B42527879
Address: Calle Baladre 20, 03700 Denia, Alicante, Spain
Email: legal@bookcheckin.com
Website: bookcheckin.com