Privacy and Data Protection Policy

1. Data controller

WACheckin is the data controller for the personal data of people who visit this website, request a demo, register as customers or contact us. When we provide the service to an accommodation, we process its guests' data on behalf of that accommodation, acting as a data processor (see section 7).

2. Data we process

Depending on your relationship with us, we may process the following categories of data:

• Contact and demo-request data: name, email, phone, company, number and type of accommodations, and the content of your message.
• Customer data: identification and tax data required for contracting, invoicing and managing your account.
• Payment data: handled through certified payment providers; we do not store full card numbers.
• Usage and technical data: IP address, device and browser type, pages visited and cookie data according to your preferences (see cookie policy).

We do not request special categories of data (art. 9 GDPR) through this website. We ask that you do not provide us with data of this kind via the contact forms.

3. Purposes and legal basis

4. Retention periods

We keep your data only for as long as necessary for the purposes indicated:

• Demo requests and enquiries: while your request is being handled and, if no contractual relationship arises, up to 12 months afterwards.
• Customer and invoicing data: for the duration of the contractual relationship and the applicable legal periods (for example, tax and commercial obligations).
• Commercial communications: until you withdraw your consent or unsubscribe.

Afterwards, we will block the data during the applicable statutory limitation periods and then securely erase it.

5. Recipients and data processors

We do not sell your data. We only share it when necessary to provide the service or by legal obligation. We work with providers that act as data processors, under a contract compliant with art. 28 GDPR, including:

We currently do not use any third-party analytics or marketing tools; if any are integrated, they will be reflected in this list and in the cookie policy. You can request the full, up-to-date list of processors by writing to hola@wacheckin.com.

6. International transfers

Some of our providers may be located outside the European Economic Area. In those cases, we ensure there is a valid basis for the transfer (a European Commission adequacy decision or Standard Contractual Clauses with additional safeguards), so that your data maintains a level of protection equivalent to that of the GDPR.

7. WACheckin as data processor

When an accommodation contracts WACheckin, we process its guests' data (for example, check-in details, identity documents or the traveller report for the authorities) on behalf of and according to the instructions of that accommodation, which is the data controller with respect to its guests. In these cases:

• We sign the corresponding processing agreement (art. 28 GDPR) with each customer.
• We process the data solely to provide the contracted service.
• Guests who wish to exercise their rights should first contact the accommodation acting as data controller; we will provide the necessary assistance.

8. Your rights

You may exercise the following rights at any time:

• Access: find out what data of yours we process.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete your data (the "right to be forgotten").
• Objection: object to certain processing activities.
• Restriction: ask us to restrict the processing.
• Portability: receive your data in a structured, commonly used format.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise them, write to us at hola@wacheckin.com stating the right you wish to exercise. We will respond within the legal period of one month. If you believe we have not handled your request properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).

You may also lodge a complaint with the competent data-protection or privacy authority in your country or state of residence. U.S. residents may have rights under state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA), including the right to know, access, delete and correct your personal information, to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising these rights. We do not sell your personal information. To exercise any of these rights, contact us at hola@wacheckin.com.

9. Data security

We apply appropriate technical and organizational measures to protect your data against unauthorized access, loss or alteration, including encryption of communications, access control and backups. No system is infallible, but we work to maintain a level of security appropriate to the risk.

10. Minors

This site and our services are aimed at professionals and companies in the accommodation sector. They are not intended for minors, and we do not knowingly collect their data through the website.

11. Changes to this policy

We may update this policy to adapt it to legal changes or changes to our service. We will always publish the current version on this page, together with its update date.