Privacy policy

This Privacy Policy governs the processing of personal data collected through the website https://www.basquestay.com/.

Controller: LAZKANO IRIONDO ZERBITZUAK, S.L.

Tax ID: B75118570

Address: Calle Bartolomé 19, ground floor, 20007, Donostia (Gipuzkoa)

Telephone: 688604507

Email: ilazkano@basquestay.com

Purpose: Why do we process your data?

We process the information you provide for the following purposes:

Manage your reservation and stay in the apartments.

Comply with the legal obligation to register travelers established by Royal Decree 933/2021, of October 26, which requires identity verification and the communication of certain data to the competent authorities.

Facilitate the online check-in process using the Avantio tool, which allows your identity to be securely verified through a temporary automatic reading (OCR) of the ID document.

Respond to any questions or communications related to your reservation.

Data is collected only for legitimate, necessary, and proportional purposes.

OCR processing: how does it work?

For the online check-in process, Basquestay uses a tool provided by Avantio (https://www.avantio.com/es/).

Avantio uses OCR (Optical Character Recognition) technology to read the MRZ zone of the ID document.

During this process:

The document image is used only temporarily to extract the data required by Royal Decree 933/2021 (name, surname, document number and type, nationality, date of birth, and habitual residence).

This image is not retained or stored at any time and is automatically deleted once verification is complete.

Only the text data necessary to comply with the legal registration obligation is saved.

In this way, we guarantee the principle of minimization, processing only essential data for the time strictly necessary.

Legitimacy: What is the legal basis for processing?

The processing of your data is based on:

Compliance with a legal obligation, pursuant to Article 6.1.c) of the GDPR and Royal Decree 933/2021.

The execution of the accommodation contract, pursuant to Article 6.1.b) of the GDPR.

If applicable, your consent for other legitimate purposes, such as sending commercial communications (opt-in).

Recipients: To whom do we share your data?

The following will be shared:

To state law enforcement agencies, in compliance with the traveler registration obligation.

To technology providers such as Avantio, acting as data processors, under a contract pursuant to Article 28 of the GDPR.
Under no circumstances will data be transferred or assigned for commercial purposes without your consent.

Retention: How long do we keep your data?

The data required for traveler registration will be kept for three years, as required by Royal Decree 933/2021.

Data collected through forms or communications will be kept only for the time necessary to process your request.

ID document images processed by OCR are not retained and are automatically deleted after verification.

Rights: What are your rights?

You may exercise your rights of access, rectification, erasure, restriction of processing, portability, and objection at any time by contacting C/ San Bartolomé 19, ground floor, 20007, Donostia (Gipuzkoa) or by emailing ilazkano@basquestay.com.

If you believe your request has not been properly addressed, you may file a complaint with the Spanish Data Protection Agency (www.aepd.es).

Data security and accuracy: how do we protect your information?

Your data is treated confidentially and is protected by:

Communications encryption (HTTPS/TLS).

Restricted and controlled access to the system.

Automatic deletion of images after verification.

The user is responsible for the accuracy of the data provided and undertakes to keep it updated.