Skip to content
Cal Nenot
ES CA EN

Privacy policy

Last updated: 28 August 2026

At Cal Nenot we handle your data on a simple principle: we collect only what we need to answer your enquiry and look after your stay, and we never sell it or pass it on for advertising. This page explains exactly what we process, why, for how long, and what you can do about it.

1. Who is responsible

  • Owner: Cal Nenot
  • Address: C/ Lleida 17, 25633 Puigcercós (Lleida), Spain
  • Email: calnenot@gmail.com
  • Phone: +34 662 266 620
  • Catalan tourism register: HUTL-001231

2. What we collect

If you request a booking or a quote. Your name, email address and phone number; the number of adults, children and pets; the dates you ask for; any message you write to us, and the language you are browsing in.

If you write through the contact form. Your name, email address, phone number if you give one, the subject and the content of your message.

If you go on to stay with us. All of the above, plus your booking details: arrival and departure dates, amount, reference, and any notes needed to organise your stay.

Technical data. With every form you submit we store your IP address and the browser you used, along with the exact date and time you accepted this policy. We do this for security and so that we can demonstrate your consent if we ever need to.

Reviews. The site displays public reviews written by other people on our Google listing, showing the name and profile picture each author has made public on Google. That information comes from Google, not from us.

We do not collect any special category data (health, beliefs, religion and so on), and we ask that you do not include any in the message field.

3. Why we use it, and on what legal basis

  • To answer your booking request, send you a quote and manage your stay. Legal basis: performance of a contract and the pre-contractual steps you have asked for (Art. 6(1)(b) GDPR).
  • To reply to contact-form enquiries. Legal basis: your consent, given by ticking the box on the form (Art. 6(1)(a)).
  • To send you the emails that belong to your booking, such as the confirmation or the reminder before you arrive. Legal basis: performance of a contract (Art. 6(1)(b)).
  • To write to you once after your stay to thank you and, if you feel like it, invite you to leave a review. Legal basis: our legitimate interest in hearing what you thought (Art. 6(1)(f)). You can object at any time and we will stop.
  • To keep the IP address and browser recorded with each submission. Legal basis: our legitimate interest in site security and in being able to prove the consent given (Art. 6(1)(f)).
  • To meet our accounting and tax obligations. Legal basis: legal obligation (Art. 6(1)(c)).
  • To report guest details to the competent authorities, as required of tourist accommodation in Spain (Royal Decree 933/2021). Legal basis: legal obligation (Art. 6(1)(c)).

We do not carry out automated decision-making or profiling.

4. How long we keep it

  • Completed bookings and their invoicing: 6 years from the end of the stay, the period Article 30 of the Spanish Commercial Code sets for accounting records.
  • Enquiries and requests that do not become a booking: 1 year from our last contact, in case you write again about the same thing.
  • Reviews: for as long as their author keeps them published on Google.

After those periods the data is deleted. If you exercise your right to erasure sooner, we will delete it except where we are legally required to keep it.

5. Who we share it with

We do not sell or trade your data. It is only accessible to the providers we need in order to run the website and the bookings, and only so they can provide us that service:

  • OVH SAS (OVHcloud) — hosting for the server running this website and its database. The servers are in Strasbourg, France, within the European Union.
  • Resend, Inc. (United States) — delivery of the emails relating to your booking or enquiry.
  • Cloudflare, Inc. (United States) — storage of the site's images and of the daily database backups, which include booking data.
  • Public authorities and law enforcement, where we are legally obliged to provide it.

6. International transfers

Resend and Cloudflare are US companies, so part of the processing takes place outside the European Economic Area. Those transfers are covered by the Standard Contractual Clauses approved by the European Commission and, where applicable, by the EU–US Data Privacy Framework. The main hosting, by contrast, always stays within the European Union.

7. Cookies and analytics

This site uses no advertising, tracking or third-party cookies, which is why you will not see a cookie banner asking for your consent.

Only two first-party cookies are set, both strictly necessary for the site to work securely:

  • cal_nenot_session — keeps your session while you browse. Expires after 2 hours.
  • XSRF-TOKEN — protects the forms against cross-site request forgery. Expires after 2 hours.

Both are strictly necessary technical cookies and are exempt from the consent requirement under Article 22.2 of the Spanish LSSI. You can block them in your browser, but the contact and booking forms will then stop working.

To see how many visits the site gets we use Umami, an analytics tool we host on our own server: it sets no cookies, does not track visitors across websites and shares nothing with third parties. The statistics we get are aggregated and cannot identify you.

8. Your rights

You may at any time exercise your rights of access, rectification, erasure, restriction of processing, portability and objection, and withdraw your consent where consent is the basis for the processing, without affecting the lawfulness of processing carried out beforehand.

To do so, write to calnenot@gmail.com telling us which right you wish to exercise. We may ask you to confirm your identity. We will reply within one month at the latest.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).

9. Security

The whole site is served encrypted over HTTPS. Database backups are generated daily and stored in a private, non-public location. Access to booking data is limited to the people who run the house.

10. Children

This website is not aimed at children. Bookings must be made by an adult, who is the person who tells us how many children are coming; we do not collect their names or any other identifying details about them.

11. Changes to this policy

If we change how we handle your data we will update this page and change the date shown at the top. We suggest checking back from time to time.