Privacy Policy
PropiedUp SL
Last updated: 17 July 2026
This policy is also available in Spanish. In the event of any discrepancy or difference in interpretation between versions, the Spanish version shall prevail, as it is the language in which this document was originally drafted and the version applicable under Spanish law.
Welcome to PropiedUp SL. This Privacy Policy describes how we collect, use, share and protect the personal information of users of our website and guests of our properties in Menorca, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights ("LOPDGDD").
1. Identity of the data controller
In accordance with Article 13.1.a) of the GDPR, the following identification details of the data controller are provided:
| Company name | PropiedUp SL |
| Tax ID (CIF) | B75752154 |
| Registered address | Calle Ramis i Ramis, 12, Esc. 2, Planta 1, Puerta A, 07760 Ciutadella de Menorca (Balearic Islands, Spain) |
| Contact email | soporte@propiedup.com |
| Contact phone | +34 623 00 96 78 |
| Website | www.propiedup.com |
2. Information we collect
2.1 Through the booking process on our website
During the booking and payment stage on our website, we collect only the following data, necessary to manage the booking and the charge:
- First and last name
- Postal and/or billing address
- Email address
- Phone number
- Payment details, processed directly by our payment gateway
Important clarification: at this stage of the booking process we do not collect any identity document, nor do we carry out the guest registration report ("parte de entrada de viajeros"). PropiedUp SL does not store full payment card data; this is handled directly by Addon Payments (CaixaBank / Global Payments), a PCI-DSS certified entity acting as an independent data processor for this purpose.
2.2 Non-personal / technical information
- Browser type and version
- IP address
- Cookies and tracking technologies (see section 7)
- Aggregated and statistical data on website usage
2.3 Bookings made through third-party platforms
When a booking is made through Airbnb, Booking.com, Vrbo or other distribution platforms, the personal data provided at the time of booking is collected and processed, in the first instance, by those platforms as controllers of their own processing, in accordance with their respective privacy policies. PropiedUp SL only receives from these platforms the data strictly necessary to manage the stay (booking reference, name, dates, contact details).
2.4 Guest registration (online check-in)
After the booking is confirmed, we send the guest an online check-in link through Chekin, through which we collect the identification data required under Annex I of Royal Decree 933/2021 (first and last name, document type and number, nationality, date of birth, sex and any other applicable fields depending on the type of guest), which is subsequently transmitted automatically to the competent authorities (the SES Hospedajes system of the National Police and Civil Guard, or the corresponding regional platform, such as the Mossos d'Esquadra Traveller Registry in Catalonia), in compliance with the aforementioned Royal Decree.
PropiedUp SL does not request or retain a copy, photograph or scan of guests' identity documents. This practice is expressly discouraged by the Spanish Data Protection Agency (AEPD) in its informative note of 17 June 2025, which states that requesting a copy of a national ID card or passport breaches the data minimisation principle (Art. 5.1.c GDPR), as it includes information not required by law (photograph, expiry date, CAN code, parentage) and increases the risk of identity theft.
Identity verification is carried out without the need to retain a copy of the document: the check-in link is sent, personalised, to the email address the guest themselves provided when booking, and payment of the tourist tax requires confirmation from the card-issuing bank. This cross-check between the booking data, the registered email address and the payment method constitutes a proportionate verification mechanism, in line with the criteria accepted by the AEPD in its informative note of 17 June 2025.
The legal basis for this processing is compliance with a legal obligation (Art. 6.1.c GDPR), and the guest registry records are kept for 3 years from the date of issue of the last report, in accordance with applicable public security legislation.
3. Purposes of processing and legal bases
In accordance with Article 6 of the GDPR, each processing purpose is based on the legal basis detailed below:
| Purpose | Legal basis (GDPR Art. 6) | Retention period |
| Managing the booking and charge | Performance of a contract (6.1.b) | Duration of the relationship + 5 years (statute of limitations, Art. 1964 Spanish Civil Code) |
| Communication about the stay and customer support | Performance of a contract (6.1.b) | Duration of the relationship + 5 years |
| Online check-in, identity verification and guest registration | Legal obligation (6.1.c) — Royal Decree 933/2021 | 3 years from issue of the last report (guest registry) |
| Invoicing and tax obligations | Legal obligation (6.1.c) — commercial and tax law | 6 years from the close of the financial year (Art. 30 Spanish Commercial Code) |
| Personalisation of the website experience | Legitimate interest (6.1.f), with right to object | Duration of the relationship or until objection |
| Commercial communications and marketing | Explicit consent (6.1.a) | Until consent is withdrawn |
| Analytics cookies | Explicit consent (6.1.a) / Art. 22.2 Spanish e-commerce law (LSSI-CE) | Maximum 24 months |
| Marketing cookies | Explicit consent (6.1.a) / Art. 22.2 LSSI-CE | Maximum 24 months |
| Technical cookies | Legitimate interest — exempt from consent (Art. 22.2 LSSI-CE) | Session or up to 2 years, depending on purpose |
Methodological note: the retention periods above are indicative criteria based on applicable Spanish civil, commercial and data protection law, as no prior retention policy existed. We recommend final validation by legal counsel prior to publication, particularly regarding any additional sector-specific obligations applicable to tourist rentals in the Balearic Islands.
4. How we share your information
4.1 Data processors
We share certain information with third parties acting as data processors on our behalf, with whom the corresponding data processing agreement is in place in accordance with Article 28 GDPR:
- Payment processing: Addon Payments (CaixaBank / Global Payments)
- Property and channel management (PMS / channel manager): Octorate S.r.l.
- Online check-in and guest registration (no identity document copy retained): Chekin
- Domain registration and management: Hostinger
- Website builder and hosting: Octosite, a tool by Octorate S.r.l. which relies on infrastructure provided by Duda, Inc. (United States) as a sub-processor
- Analytics and marketing cookies: managed through the cookie consent panel built into Octosite / Duda, Inc.
- Customer support: via WhatsApp and the messaging channels native to each distribution platform (Airbnb, Booking.com, Vrbo) and the Octorate PMS
4.2 Distribution platforms
We share the data strictly necessary to manage the booking with Airbnb, Booking.com and Vrbo when the booking is made through these platforms.
4.3 Legal requirements
We may disclose your information where required by law or in response to valid requests from public authorities.
5. International data transfers
Our payment gateway, Addon Payments (CaixaBank / Global Payments), operates within Spain and the European Union. Our PMS and channel manager, Octorate S.r.l., is based in Rome, Italy. Our online check-in and guest registration tool, Chekin, is based in Spain. Hostinger, which we use solely for domain registration and management, is based in the European Union.
Our website is built and hosted through Octosite, a tool developed by Octorate S.r.l. that relies on infrastructure provided by Duda, Inc., a company based in the United States. Duda, Inc. acts as a sub-processor of Octorate S.r.l. and, according to its own privacy policy, processes information in the United States, applying Standard Contractual Clauses approved by the European Commission and, where applicable, the EU-U.S. Data Privacy Framework as safeguards, in accordance with Chapter V of the GDPR. This transfer relates to browsing data and to the analytics and marketing cookies managed through the website's own cookie consent panel.
Data that guests provide directly to Airbnb, Booking.com or Vrbo when booking through those platforms is not disclosed or transferred by PropiedUp SL, as those platforms act as independent controllers of their own processing, as described in section 2.3. Likewise, should a guest choose to contact us via WhatsApp, that communication is handled by Meta Platforms Ireland Ltd. in accordance with its own privacy policy.
6. CCTV / video surveillance
PropiedUp SL does not operate any CCTV or video surveillance systems in any of the properties it manages. The installation of cameras inside or in areas used by guests is strictly prohibited in our properties, precisely in order to guarantee guests' right to privacy.
7. Cookies and tracking technologies
Our website uses first-party and third-party cookies. When you access the site, a cookie consent panel is displayed, allowing you to accept, reject or configure your consent before any non-essential cookie is installed, in accordance with Article 22.2 of Spanish Law 34/2002 (LSSI-CE) and the Spanish Data Protection Agency's Cookie Guide.
- Technical / necessary cookies: essential for the website to function (e.g. keeping the booking session active). Consent is not required.
- Analytics cookies: allow us to measure traffic and browsing behaviour. These require the user's prior consent and are only installed after explicit acceptance via the consent panel.
- Marketing cookies: used to display personalised content and measure the effectiveness of our promotional activities. Like analytics cookies, these require prior, explicit user consent.
You may withdraw your consent or change your preferences at any time via the cookie consent panel, accessible from the website footer, or through your browser settings.
Recommendation: keep this section linked to a separate, more detailed Cookie Policy listing each specific cookie, its provider, purpose and duration, as recommended by the AEPD.
8. Commercial communications and marketing
Commercial and promotional communications by electronic means are only sent when the user has given prior, explicit consent (opt-in), in accordance with Article 21 of Spanish Law 34/2002 (LSSI-CE) and Article 6.1.a) of the GDPR. This consent is independent from that required to manage the booking and may be withdrawn at any time, as easily as it was given, via the unsubscribe link included in each communication or by contacting us using the details in section 1.
9. Minors
Our booking and accommodation services are intended exclusively for persons aged 18 or over. PropiedUp SL does not knowingly collect personal data from minors through its website.
10. Information security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss or alteration, in accordance with Article 32 of the GDPR. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you without undue delay, in accordance with Articles 33 and 34 of the GDPR.
11. Your rights
In accordance with the GDPR and the LOPDGDD, you have the right to:
- Access: request a copy of your personal data.
- Rectification: request correction of inaccurate information.
- Erasure: request deletion of your data, where applicable.
- Restriction of processing: request that we restrict the processing of your data, under certain circumstances.
- Objection: object to the processing of your data, in particular for direct marketing purposes.
- Portability: receive your data in a structured, commonly used, machine-readable format and transmit it to another controller, where processing is based on consent or a contract.
- Withdraw consent: at any time, without affecting the lawfulness of processing prior to withdrawal.
12. How to exercise your rights
You may exercise the rights above by sending your request, together with a copy of a document proving your identity, to soporte@propiedup.com or to the postal address indicated in section 1. We will respond to your request within a maximum of one month of receipt, extendable by a further two months in cases of particular complexity, in accordance with Article 12.3 of the GDPR.
13. Right to lodge a complaint
If you believe that the processing of your personal data does not comply with applicable law, you have the right to lodge a complaint with the competent supervisory authority:
Spanish Data Protection Agency (AEPD) — C/ Jorge Juan, 6, 28001 Madrid, Spain — www.aepd.es
14. Data Protection Officer
PropiedUp SL does not have a designated Data Protection Officer, as its activity does not fall within the cases requiring mandatory appointment under Article 34 of the LOPDGDD. Any queries regarding data protection may be directed to the contact details indicated in section 1.
15. Changes to this Privacy Policy
We may update this Privacy Policy periodically to reflect regulatory or operational changes. We will notify any substantial change by publishing the new version on this page, indicating the date of the last update.
16. Availability in other languages
This Privacy Policy is available in Spanish and in English, in order to ensure it is understood by international guests booking through Airbnb, Booking.com and Vrbo. In the event of any discrepancy or difference in interpretation between versions, the Spanish version shall prevail, as it is the language in which this document was drafted and the version applicable under Spanish law.