Privacy policy

Last updated: 11 October 2026

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR), and with Spanish Organic Law 3/2018 of December 5 on Personal Data Protection and Digital Rights (LOPDGDD), we inform you about how we process your personal data:

Data controller

• Owner: Silvia Espadas Nieves
• Tax ID (NIF): at the end of this page
• Address: Carretera Gradefes 15, 24162 Villafañe, León, Spain
• Email: apartamentosnaturleon@gmail.com
• Phone: +34 887 82 45 50

Purpose of processing

The personal data collected through the website https://apartamentosnaturleon.com is used for the following purposes:

• Management of holiday accommodation bookings.
• Sending communications related to your stay.
• Invoicing and administrative management.
• Compliance with legal obligations (guest registration, tourism rules, tax law, etc.).
• Ensuring the safety of people, premises and assets through the CCTV system (see our CCTV Policy for details).

Legal basis

The legal basis for processing your data is:

• The performance of a holiday accommodation contract.
• The data subject’s consent for sending communications.
• Compliance with legal obligations.
• The legitimate interest of the controller for CCTV security systems.

Recipients

Data may be shared with:

• State security forces (in compliance with guest registration regulations).
• Spanish Tax Authority (in compliance with tax obligations).
• Processors required for providing the service (accountant, web hosting or booking platforms), with whom appropriate processing contracts have been signed.

Data retention

Personal data will be kept:

• While the contractual relationship lasts and for the corresponding legal periods.
• Data related to guest registration will be kept for 3 years as per regulations.
• CCTV images are kept for a maximum of 30 days unless incidents occur.
• Accounting and tax data for up to 6 years according to the Spanish Commercial Code.

How visits to this website are counted

This is a separate and independent processing activity. It has nothing to do with guest data, the traveller register or video surveillance: it only concerns people browsing this website.

To know whether the website is of any use, visits are counted with a system built by Shyn Design, who designs and maintains this site. Google Analytics and other third-party tools are not used, and no cookies are installed. The count is sent to shyndesign.com.

For each visit, only the following is stored:

• Date and time.
• Which page was viewed.
• The domain you came from (for example google.com), never the full address.
• Whether you arrived from a mobile, tablet or computer.
• Clicks on the phone, WhatsApp, email and “directions” links, without knowing who made them.

Your IP address is not stored, nor any data that could identify you. To avoid counting the same person ten times in one day, an irreversible code is calculated that changes every day, so your visits on one day cannot be linked to the next.

This is why no prior consent is required: it relies on the legitimate interest of knowing how the site is used (Art. 6.1.f GDPR) and does not involve tracking individuals. Even so, if your browser sends the “Do Not Track” or “Global Privacy Control” signal, nothing at all is recorded.

The assistant on this website

This is a separate and independent processing activity from all of the above. It only affects those who choose to write in the chat window on this page. If you write nothing, none of your data is processed.

The assistant answers questions about the accommodation and collects the basic details of a booking enquiry, so that you do not have to repeat them later. It is not a person: it is an automated assistant, and this is stated in the window itself.

From each conversation we store only:

• What you write in the chat and what the assistant replies.
• The enquiry details: dates, number of guests, whether a baby is coming and whether you travel with a pet.
• A random session code, used only to keep track of the conversation. The conversation expires after 6 hours without writing: after that, the chat starts again from scratch.
• A random code stored in your own browser, which contains no personal data and is only used to tell that a new enquiry comes from the same browser as an earlier one, so we do not ask you the same things twice. You can delete it at any time by clearing the site data in your browser.

You are asked for a phone number or an email so that we can get back to you, because the assistant does not close bookings and the answer comes from us. Giving it is voluntary: you can keep asking without leaving it, and in that case we will not be able to reply once you close the chat. Whatever you leave is used only to answer that enquiry.

WhatsApp alert. When you leave your details, an alert reaches our phone so we can attend to you quickly. That alert is sent through CallMeBot (a WhatsApp notification service), and it carries the minimum: your name or phone if you left them, and the dates and number of guests of your enquiry. Nothing else.

Who processes it. In order to understand what you write and draft a reply, the text of the conversation is sent to Anthropic PBC (United States), the provider of the artificial intelligence model, acting as a data processor. The international transfer relies on the European Commission's standard contractual clauses. Conversation content is not used to train models.

Legal basis. Processing is based on your consent, given by voluntarily writing in the chat (Art. 6.1.a GDPR), and on pre-contractual measures taken at your request when the enquiry concerns a booking (Art. 6.1.b GDPR).

If the notification fails. When you leave your details, a notification is sent to the property so they can get back to you. If that notification fails to send because of an email problem, its contents are stored on this website’s server so that your enquiry is not lost. It is kept for the same period as everything else and is then deleted automatically.

Who can see it. Only the owners of the property, through a private password-protected panel. Nobody else has access.

How long it is kept. Conversations are stored for a maximum of 90 days and are then deleted automatically. If the enquiry results in a booking, that booking's data is kept as described under "Data retention".

What it does not do. The assistant does not confirm availability, does not set final prices, does not handle payments and does not request bank details or identity documents. Never enter card details, passwords or ID numbers in the chat.

You may close the window at any time and contact us directly by WhatsApp or email, without using the assistant.

The voice answering assistant

This is a separate processing activity, independent of the previous ones. It concerns people who call the accommodation's phone number (+34 887 82 45 50), or another number of ours that we cannot answer at that moment and that is forwarded to it.

These calls are answered by an automated assistant with artificial intelligence, which says so when it picks up and tells you the call is recorded, as required by Regulation (EU) 2024/1689. It gives information about the accommodation, takes the basic details of your enquiry and tells you our team will be in touch with you shortly. In an emergency (being locked out, a leak, no water or power) it puts the call through to a member of our team at any hour; if there is smoke, fire or someone injured, it tells you to call 112. If you ask, it also puts you through to the team Monday to Friday, from 9:00 AM to 2:00 PM and from 4:00 PM to 8:00 PM (Spanish time). It is not a person and does not conclude anything by itself.

What data is processed. The number you call from, the audio of the call, its transcription and whatever you choose to say (name, dates, number of people, what you need). It does not ask for, and must not be given, bank details, passwords or identity documents: do not say them on the call.

Who processes it. The call is carried by Zadarma (Voice Cloud S.L., Valencia, Spain), an internet telephony operator, with the data in the European Union. Speech is converted to text and text to speech, and the assistant runs, at ElevenLabs Inc. (USA); the language model that understands and drafts the replies is provided by OpenAI (USA) through ElevenLabs. All three act as processors under their business terms; for ElevenLabs and OpenAI, with the European Commission's standard contractual clauses for the international transfer. OpenAI does not use data received this way to train its models, and at ElevenLabs we have switched off the use of these conversations to improve its models.

How long it is kept and who sees it. The audio and transcription are kept at ElevenLabs for a maximum of 30 days and then deleted. When the call ends, our team receives an email with your number, the details you gave, a summary and the transcription, which we keep while our conversation lasts and for one more year and, if a booking results from it, as set out under "Data retention". The call is also stored, with your number encrypted, in the Natur León management panel and in that of Shyn Design, who designs and maintains this website and its panel; in the panels it is kept for 90 days and then deleted automatically. If the email fails to go out, the notice is kept on the server until it does, for up to 90 days. Only our team and Shyn Design see it.

Legal basis. Your consent, given by continuing the call after being told, when it picks up, that you are speaking to an automated assistant and that the call is recorded (Art. 6(1)(a) GDPR), and pre-contractual steps at your request when the enquiry is about a booking (Art. 6(1)(b) GDPR). If you prefer not to talk to an automated assistant, ask to be put through to a member of our team (Monday to Friday, from 9:00 AM to 2:00 PM and from 4:00 PM to 8:00 PM), or hang up and write to us by email or through the form on this website.

Your rights

You can exercise at any time your rights of access, rectification, erasure, objection, restriction and portability of your data by sending a written request, with a copy of your ID, to the physical or email address of the controller.

Furthermore, if you consider that your rights have been infringed, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

Security measures

Apartamentos Natur León applies the technical and organisational measures necessary to ensure the security and integrity of the personal data processed, and to prevent its loss, alteration or unauthorised access.

Changes to this policy

We reserve the right to modify this Privacy Policy to adapt it to legislative changes or changes in our activity. Periodic review is recommended.

Owner identification details

• Owner: Silvia Espadas Nieves
• Tax ID (NIF): 43113208F