Privacy Policy

Last updated: October 16, 2026

This policy explains how we process your personal data when you visit this website, send us an enquiry or stay with us, in accordance with the EU General Data Protection Regulation 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the protection of personal data and guarantee of digital rights (LOPDGDD).

1. Data controller

We have not appointed a data protection officer as we are not required to do so. For any question about your data, write to us at info@masiadequeralt.com.

2. What data we process, why and on what legal basis

Enquiries and quotes

When you contact us through the contact form, by email, by phone or by WhatsApp, we process your first name and surname, your email address, your phone number if you give it to us and the information in your message (for example, the date and number of guests of an event), in order to reply and, if you ask us to, prepare a quote.

Legal basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time, and, when the enquiry relates to a booking, steps taken at your request prior to entering into a contract (art. 6(1)(b) GDPR). Fields marked with * are required: without them we cannot handle your enquiry.

Bookings and stays

To manage your booking and your stay we process the identification and contact details of the person making the booking, the dates, the accommodation and services booked, payment and billing details and related communications.

Legal basis: performance of the accommodation contract (art. 6(1)(b) GDPR) and compliance with legal accounting and tax obligations (art. 6(1)(c) GDPR).

Guest register

Spanish law requires accommodation providers to record guests' details (name and surname, identity document, nationality, date of birth, dates of stay and other data required by law) and to report them to the police, which in Catalonia is the Policia de la Generalitat – Mossos d'Esquadra.

Legal basis: compliance with a legal obligation (art. 6(1)(c) GDPR) laid down in Organic Law 4/2015 on the protection of public safety, Royal Decree 933/2021 and the applicable Catalan regulations.

Spam protection of the form (reCAPTCHA)

The contact form is protected by Google reCAPTCHA, which analyses technical data about your interaction with the page (IP address, browser and device data, mouse movements and Google cookies) to tell people apart from automated programs. It is only loaded when you start using the form. Google processes this data in accordance with its privacy policy.

Legal basis: our legitimate interest in protecting the website and our email from spam and abuse (art. 6(1)(f) GDPR).

Browsing and security

Like any web server, ours logs technical data about each visit (IP address, date and time, page requested, browser) to make the site work and to detect and block attacks.

Legal basis: our legitimate interest in the security and proper functioning of the website (art. 6(1)(f) GDPR).

Third-party content

YouTube videos and the Google Maps map are only loaded if you accept them or activate them yourself. From that moment, Google receives your IP address and may set cookies, as explained in the Cookie Policy. The Avaibook availability search is loaded on the pages that include it, and Avaibook receives your IP address and the search details; it does not set cookies on this website.

Marketing communications

We will only send you offers or news if you give us your express consent, and you can unsubscribe at any time.

We do not make automated decisions or create profiles with your data, with the sole exception of reCAPTCHA's automatic assessment, which is used only to block automated submissions.

3. How long we keep your data

  • Enquiries: for as long as needed to handle them and, if you do not make a booking, for no more than one year after our last communication.
  • Bookings and billing: for the duration of the relationship and, afterwards, for the legal periods (six years for accounting records under the Spanish Commercial Code and four years for tax purposes).
  • Guest register: three years, as required by Royal Decree 933/2021.
  • Server logs: for as long as needed for the security of the website and, unless an incident needs to be investigated, no more than twelve months.

After these periods, the data is deleted or anonymised.

4. Who we share your data with

  • Mossos d'Esquadra and other authorities, when required by law (guest register, Spanish Tax Agency, courts).
  • Service providers that process data on our behalf, under a data processing agreement and only to provide their service to us: the Avaibook booking and management system (its privacy policy), web hosting, email and banks or payment providers.
  • Booking platforms such as Booking.com or Airbnb, when you book through them. They act as independent controllers and their own privacy policies apply.
  • Google, for reCAPTCHA and, if you activate them, for YouTube videos and the Google Maps map.

We do not sell your data or share it with third parties for marketing purposes.

5. International transfers

Google LLC may process data in the United States. It is certified under the EU-U.S. Data Privacy Framework, recognised by the European Commission as ensuring an adequate level of protection (Decision of 10 July 2023), and applies standard contractual clauses approved by the Commission. If you book through international platforms, please check their privacy policies for the safeguards they apply.

6. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent you have given us (without affecting prior processing), by writing to info@masiadequeralt.com or by post to Avenida Diagonal, 463, pral. 1, 08036 Barcelona, Spain, with the reference "Data protection". If needed to identify you, we will ask you to prove your identity. We will reply within one month.

If you believe we have not processed your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan 6, 28001 Madrid) or with the data protection authority of your country of residence.

7. Minors

Children under 14 must not send us personal data without the consent of their parents or guardians.

8. Security

We apply appropriate technical and organisational measures to protect your data, such as encrypted connections (HTTPS), restricted access to information and protection of the forms against automated use.

9. Changes to this policy

We may update this policy to reflect changes in the law or in the website. The date of the last update is shown at the top.