Skip to content

We use strictly necessary cookies and, only if you accept, analytics cookies (Google Analytics 4) to measure visits. Cookie policy

Legal

Privacy policy

Last updated: 23 Oct 2026

1. Data controller

The controller of your personal data is Travel Capital S.L. (NIF B72836760), Calle Esperanza 6, Bajo B, 41009 Sevilla, contact email hola@travelcapital.es. This policy applies to travelseville.com and to communications arising from your booking, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

2. What data we process and why

We process only the data needed for each purpose:

  • Booking management: name, email, phone, nationality, stay dates, number of guests and any messages you send. Legal basis: performance of a contract (art. 6.1.b GDPR).
  • Payment: card payments are processed by Revolut Bank UAB; we never store your card details. Legal basis: performance of a contract.
  • Traveller registration: Spanish law (Royal Decree 933/2021) requires us to record the ID details of every guest and the booking data, including the payment method (type, masked card number and holder), and to report them to the Ministry of the Interior (SES.Hospedajes). Legal basis: legal obligation (art. 6.1.c GDPR).
  • Operational communications: confirmation emails, payment reminders and receipts, arrival instructions and the digital key. Legal basis: performance of a contract.
  • Proof of your booking: when you book we keep the version of the terms you accepted, the payment authorisation shown to you, the date, your IP address and your browser, to be able to prove what was agreed. Legal basis: legitimate interest (art. 6.1.f GDPR) and legal obligation.
  • Booking reminder: only if you tick the box when booking, we send you one email if you leave the booking unfinished. Legal basis: consent (art. 6.1.a GDPR), which you can withdraw at any time by writing to us.
  • Contact form: name, email, phone (optional), your message and the IP address it was sent from (to prevent abuse), in order to reply. Legal basis: consent (art. 6.1.a GDPR), given through the checkbox on the form.
  • Bookings made on Airbnb or Booking.com: we receive your name, contact details and stay from that platform through our channel manager (art. 14 GDPR), and use them to manage your stay, your digital key and your invoice. Legal basis: performance of a contract and legal obligation.
  • Analytics: only if you accept cookies, Google Analytics measures visits to the website (see the cookie policy). Legal basis: consent.

3. Recipients

We do not sell your data or share it for third-party marketing. We share it only with these providers, who process it on our behalf, and with authorities where the law requires it:

  • Revolut Bank UAB: card payments. As a payment institution it is also an independent controller for its own legal duties (fraud prevention, anti-money-laundering).
  • SuiteClerk: channel manager and online check-in (booking, name, contact details, nationality and your message to us).
  • Nearkey: digital keys for the apartment door (your email and name; it records each opening of the lock).
  • Hostinger International Ltd.: web hosting and email delivery (servers in the European Union).
  • Google Ireland Ltd.: website analytics, only if you accept cookies.
  • Airbnb and Booking.com, when you book through them.
  • Ministry of the Interior (SES.Hospedajes, RD 933/2021) and the tax authority (AEAT), when the law requires it.

4. International transfers

Some providers may process data outside the European Economic Area. Google may process analytics data in the United States: that transfer relies on the EU-US Data Privacy Framework (Commission Decision 2023/1795), as Google LLC is certified under it. Any other transfer relies on the European Commission's Standard Contractual Clauses or another valid GDPR Chapter V mechanism.

5. Retention

Booking data is kept for the duration of the contract and afterwards for the applicable tax and legal limitation periods (generally 6 years for commercial documentation). Traveller-registry data is kept for 3 years under RD 933/2021. Personal data of bookings that were started but never paid is deleted after 30 days. Technical copies of the data sent to our channel manager are deleted after 90 days. Contact messages are kept for a maximum of 12 months.

6. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by writing to hola@travelcapital.es, stating the right you exercise and providing identity verification. We reply within one month.

If you believe our processing breaches the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Security

We apply appropriate technical and organisational measures: TLS encryption on all communications, access control to the booking database, and data minimisation. Access to booking data is restricted to authorised staff.

8. Maps and third-party content

Location maps are displayed with the Leaflet library served from our own server and map tiles from OpenStreetMap (or the tile provider configured at the time). Loading tiles sends your IP address to that provider; tiles are only requested when the map scrolls into view.