Hotel Enoturismo Mainetes logo
book now
book now

Privacy Policy

1. Data Controller

  • Identity: Bodegas y Viñedos Mainetes S.L.
  • Tax ID (NIF/CIF): B02365898
  • Address: C/ Concepción, 11, 5º Izqda., 02002 Albacete, Spain
  • Contact email for privacy matters: hotel@enoturismomainetes.com
  • Data Protection Officer (DPO): not applicable (not mandatory for this type of establishment)

2. What data do we process and for what purpose?

Accommodation bookings (Redforts booking engine)

  • Data processed: first name, last name, email, phone number, dates and details of your stay, special requests and payment data (processed by the booking engine’s payment gateway, not stored by us).
  • Purpose: to manage your booking, payment and stay, and to communicate with you before and during your visit.
  • Legal basis: performance of a contract (Art. 6.1.b GDPR).

Guest registration (Spanish Royal Decree 933/2021)

  • Data processed: first name and surnames, sex, type and number of identity document, nationality, date of birth, home address, phone number, email, arrival and departure dates, number of guests, family relationship in the case of minors, and payment method used.
  • Purpose: to comply with the legal obligation to register guests and report their details to the Spanish Ministry of the Interior through the SES.Hospedajes platform. This reporting is carried out through the Redforts booking engine.
  • Legal basis: compliance with a legal obligation (Art. 6.1.c GDPR), under Royal Decree 933/2021 and Organic Law 4/2015 on the protection of public safety.

Purchase of experiences and gift vouchers (Fluent Forms + Stripe)

  • Data processed: name, email, phone number, billing details, details of the gift recipient (if provided) and payment data (processed directly by Stripe, not stored by us).
  • Purpose: to manage the purchase, issue the voucher and send it by email.
  • Legal basis: performance of a contract (Art. 6.1.b GDPR).

Online wine shop (WooCommerce + Redsys)

  • Data processed: first name, last name, email, phone number, billing and shipping address, order contents, declaration of legal age and payment data (processed directly by the bank’s Redsys payment gateway, not stored by us).
  • Purpose: to manage the order, payment, invoicing and delivery, and to ensure that alcoholic beverages are only sold to people aged 18 or over.
  • Legal basis: performance of a contract (Art. 6.1.b GDPR) and compliance with tax and alcohol-sale legal obligations (Art. 6.1.c GDPR).

Contact forms (events, weddings and enquiries)

  • Data processed: name, email, phone number and details of your enquiry or event.
  • Purpose: to respond to your request for information and, where applicable, prepare a quote.
  • Legal basis: pre-contractual measures taken at your request (Art. 6.1.b GDPR) and your consent when submitting the form (Art. 6.1.a GDPR).

Contact via WhatsApp

  • Data processed: phone number, profile name and the content of the messages you send us.
  • Purpose: to answer your enquiries. The website’s FAQ assistant does not store any personal data; it only redirects you to WhatsApp if you choose to message us.
  • Legal basis: consent, given when you start the conversation (Art. 6.1.a GDPR).

Browsing and cookies (Google Analytics 4, Google Tag Manager)

  • Data processed: browsing data, device identifiers and behaviour on the website.
  • Purpose: to analyse website usage and improve the user experience.
  • Legal basis: user consent, managed through the cookie banner (Art. 6.1.a GDPR). More information in our Cookie Policy.

Google Search Console

  • Data processed: aggregated search performance data (does not identify individual users).
  • Purpose: to measure and improve the website’s search ranking.
  • Legal basis: legitimate interest (Art. 6.1.f GDPR).

Special categories of personal data (health, political opinions, etc.) are not processed, except for information voluntarily provided by the user in the comments field of a booking or order (e.g. food allergies or intolerances), which is processed solely to provide the requested service properly.

3. How long do we keep your data?

  • Booking, order and billing data: for the period required by commercial and tax regulations (generally 6 years from the last transaction, in accordance with the Spanish Commercial Code).
  • Guest registration data: 3 years from the end of the stay, as required by Royal Decree 933/2021.
  • Contact form and WhatsApp data: until the enquiry is resolved and, at most, 12 months if no booking or purchase is made.
  • Browsing data and analytics cookies: according to Google Analytics retention settings, up to a maximum of 14 months.

4. Who do we share your data with?

Disclosures required by law: guest registration data is reported to the Spanish Ministry of the Interior (SES.Hospedajes) and, where applicable, to the State Security Forces. Billing data is reported to the Spanish Tax Agency when required by law.

Data processors: in order to provide our services, some data is shared with the following providers, all of whom operate under the guarantees required by the GDPR:

  • Raiola Networks (website hosting).
  • Hostinger (server used to send the website’s emails).
  • Redforts (booking engine, booking payments and reporting of guest registration to SES.Hospedajes).
  • Stripe (payment for experiences and gift vouchers).
  • Redsys and the hotel’s bank (card payments in the online wine shop).
  • Courier company delivering online shop orders (delivery name, address and phone number only).
  • Meta Platforms (WhatsApp), if you choose to contact us via WhatsApp.
  • Google (Google Analytics 4, Google Tag Manager, Google Search Console).

Some of these services (Google, Stripe, Meta) may involve international data transfers to the USA, covered by the EU-US Data Privacy Framework and the European Commission’s Standard Contractual Clauses.

Data is not shared with third parties for commercial purposes, and no automated profiling with legal effects on users is carried out.

5. Your rights

You may exercise the following rights at any time and free of charge by writing to hotel@enoturismomainetes.com, stating the right you wish to exercise and proving your identity:

  • Access: to know what personal data we process about you.
  • Rectification: to correct inaccurate data.
  • Erasure: to request the deletion of your data, except data we must keep by law.
  • Objection: to object to a specific processing activity.
  • Restriction: to request that processing be restricted in certain cases.
  • Portability: to receive your data in a structured format.
  • Withdrawal of consent: where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of prior processing.

If you believe your rights have not been properly respected, you may file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

6. Security measures

We apply the technical and organisational measures necessary to guarantee the security of personal data and prevent its alteration, loss, or unauthorised processing or access, in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).

7. Changes to this policy

This privacy policy may be updated to reflect changes in legislation or in the website’s services. We recommend reviewing it periodically.

Last updated: November 2026.