Legal
Privacy policy
Last updated: 23/09/2026
At Sereno Tech S.L. we take the protection of your personal data seriously. This Privacy policy explains what data we process, what we use it for, on what legal basis, how long we keep it, who we may share it with and how you can exercise your rights.
This policy applies to your use of tusereno.es, to contact forms, requests for information, marketing communications, the booking process, customer service, the management of stays and, where applicable, the private area or the guest and owner portal.
1. Data controller
| Item | Details |
|---|---|
| Controller | Sereno Tech S.L. |
| CIF/NIF | B44916658 |
| Registered address | Calle Tulipán, 1 — 11160 Barbate, Cádiz, España |
| Contact email | gestion@tusereno.es |
| Telephone | +34 623 008 140 |
| Website | tusereno.es |
| Data Protection Officer | Not appointed, unless legally required or unless we state otherwise |
For any matter relating to privacy or data protection you may write to gestion@tusereno.es, putting Data protection in the subject line.
2. Personal data we may process
We process different data depending on your relationship with Sereno and on how you use the website.
2.1. Contact and form data
- First name and surname.
- Email address.
- Telephone number.
- The message or query you send.
- Any data you choose to include in the form.
2.2. Booking and stay data
- First name and surname of the person making the booking.
- Contact details.
- The accommodation selected.
- Arrival and departure dates.
- Number of guests.
- Preferences, special requests or comments attached to the booking.
- Information needed to handle changes, cancellations, incidents or assistance during the stay.
2.3. Data required for the traveller register
In order to comply with the applicable rules on accommodation and public safety, we may request the legally required details of the people staying, including, as appropriate:
- Identifying details.
- Identity document or passport, type and number.
- Nationality.
- Date of birth.
- Sex, where this is compulsory.
- Address or contact details, where these are required.
- Relationship to, or details of, accompanying minors, where the rules require it.
- Arrival and departure dates.
- Signature on the entry form, where this is required.
Sereno will neither request nor keep full copies of identity documents or passports unless there is a specific legal obligation or a duly documented lawful basis for doing so.
2.4. Payment and billing data
- The booking amount.
- Payment status.
- Transaction reference.
- Billing details where these are needed.
- Partial or tokenised payment method information provided by the payment provider.
Card payments are processed through Stripe. Sereno does not store full bank card details.
2.5. Data of owners and partners
When you contact Sereno as an owner, a prospective owner, a supplier, a partner or an investor, we may process:
- First name and surname.
- Email address and telephone number.
- Details of the home or property.
- Financial, contractual or operational information needed to assess or manage the relationship.
- Communications exchanged with Sereno.
2.6. Data of job applicants
When you send us your application through the ‘Work with us’ form, or send us your CV by any other means, we may process:
- First name and surname.
- Email address and telephone number.
- Town or city of residence.
- Your CV and all the information you decide to include in it.
- The roles and areas you are interested in working in, and whether you have a vehicle.
- Any message or covering note you write to us.
- The date of your consent and technical details of the submission, such as the IP address, so that we can evidence it.
We do not ask for your identity document, date of birth or a photograph in order to join the talent pool. Those details are only requested if we go on to hire you.
2.7. Browsing data and cookies
When you visit the website we may process:
- IP address.
- Online identifiers.
- Browser and device type.
- Pages visited.
- Date and time of access.
- Traffic source.
- Interactions with the website.
Details of cookies and similar technologies are available in the Cookie policy.
2.8. Newsletter subscription data
When you sign up on the website or on the guest portal to be told when next season’s dates open or to receive our news, we may process:
- First name and email address.
- Telephone number, only if you tick the box to receive the alerts by WhatsApp as well.
- The language you are browsing in and where you signed up (the website, the guest portal or the traveller register).
- The date of your consent, the version of the text accepted, your IP address and browser, so that we can evidence it.
The subscription is activated when you confirm the link we send you by email (double opt-in); until then we send you nothing. You can unsubscribe from any message.
2.9. Data from conversations with Serena, the booking assistant
Serena is an automated assistant that answers questions about our houses, availability and prices in the website chat. It does not ask for personal details and we recommend you don’t type any. When you use it, we process:
- The text of the messages you write and of the assistant’s replies.
- The page you write from, the language, and the date and time of each message.
We do not store your IP address with the conversation. To prevent abuse we count how many messages are sent from the same connection using an encrypted fingerprint of the IP, which is deleted automatically within 24 hours at most.
3. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Contact and requests for information | Answering queries, sending the information requested and maintaining related communications | Consent or steps taken prior to entering into a contract |
| Booking management | Handling requests, confirming bookings, managing payments, changes, cancellations, check-in, the stay and customer service | Performance of a contract or pre-contractual steps |
| Traveller register | Collecting, keeping and reporting the data required by accommodation legislation | Legal obligation |
| Payments | Processing charges, refunds, confirmations and fraud prevention | Performance of a contract and legitimate interest in preventing fraud |
| Invoicing and accounting | Issuing invoices and receipts, keeping accounting records and meeting tax obligations | Legal obligation |
| Marketing communications | Sending news, offers or commercial information about Sereno where there is consent or a prior relationship that allows it | Consent or legitimate interest in the cases permitted by the LSSI (the Spanish e-commerce act) |
| Website security | Preventing abuse, fraud, unauthorised access, attacks and improper use | Legitimate interest |
| Management of owners and partners | Assessing properties, preparing proposals and managing contractual, operational and commercial relationships | Pre-contractual steps, performance of a contract, legal obligation and legitimate interest |
| Management of job applications | Assessing your CV, contacting you and considering you in current and future selection processes | Consent (Article 6(1)(a) GDPR) |
| Booking assistant (Serena) | Answering your questions about houses, availability and prices, and reviewing conversations to improve the service | Legitimate interest in answering your queries and improving the service, and pre-contractual steps when you ask about a booking |
4. Marketing communications
We will only send marketing communications by email, SMS, WhatsApp or other electronic means where there is a legal basis for doing so.
You may unsubscribe at any time by following the link included in each communication, by replying to the message you received, or by writing to gestion@tusereno.es.
5. Recipients and processors
We do not sell your personal data.
We may disclose data to third parties where this is necessary to provide the service, to comply with legal obligations or to manage our relationship with you. In particular:
- Public authorities, State law-enforcement agencies, courts and competent administrative bodies where there is a legal obligation.
- Accommodation owners or operators where this is necessary to manage a booking or a stay.
- Payment providers.
- Providers of web hosting, infrastructure, security, maintenance and technical support.
- Providers of booking management software, channel managers, PMS platforms and operational tools.
- Providers of email, messaging and communications services.
- Tax, accounting, employment, legal and administrative advisers.
- Banks and other providers needed for charges, payments and refunds.
Where these third parties process data on behalf of Sereno, they act as processors and must offer appropriate guarantees of confidentiality, security and regulatory compliance.
| Provider | Use | Description |
|---|---|---|
| Stripe | Online payments | Processing of charges, refunds and fraud prevention |
| Hostify | PMS and accommodation management | System for managing bookings, availability and operational property data |
| Microsoft Azure | Infrastructure and web hosting | Hosting, containers and cloud computing services |
| Resend | Transactional email | Sending booking confirmations, notifications and system emails |
| Supabase | Contact database | Storage of contact requests and leads |
| Microsoft Azure OpenAI | Booking assistant | Generates Serena's replies. Conversations are processed within the European Union and Microsoft does not use them to train its models |
6. International transfers
Some technology providers may be located outside the European Economic Area, or may provide services with support from third countries. In those cases, Sereno will seek to ensure that appropriate safeguards are in place under the GDPR, such as adequacy decisions, adherence to recognised transfer frameworks, standard contractual clauses or other safeguards provided for by law.
If you would like more information about the specific providers and the safeguards applied, you may write to us at gestion@tusereno.es.
7. Retention periods
We will keep your data for as long as is necessary to fulfil the purpose for which it was collected and, thereafter, for the periods required by law or needed to deal with any liability that may arise.
| Type of data | Indicative period |
|---|---|
| Contact enquiries | Up to 12 months from the last communication, unless a contractual or legal relationship arises |
| Bookings and contractual documentation | For the duration of the contractual relationship and thereafter for the applicable liability periods |
| Tax, accounting and invoicing data | For the applicable statutory tax and commercial periods |
| Traveller register | The period required by the applicable accommodation legislation |
| Marketing communications | Until you withdraw your consent or ask to be unsubscribed |
| Cookies | The period indicated for each cookie in the Cookie policy |
| Data of owners and partners | For the duration of the relationship and for as long as legal or contractual liability may arise |
| Applications and CVs | 12 months from receipt, unless you ask us to delete them sooner or the application leads to a job offer |
| Conversations with the booking assistant | 30 days from the last message; they are then deleted automatically |
Once the data is no longer needed, it will be securely deleted or blocked for the applicable limitation periods.
8. Rights of data subjects
You may exercise the following rights:
- Access: to know what data we process about you.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to ask for your data to be deleted where appropriate.
- Objection: to object to certain processing.
- Restriction: to ask us to restrict the processing of your data.
- Portability: to receive your data in a structured format where appropriate.
- Withdrawal of consent: to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise your rights, write to:
Please state which right you wish to exercise and provide the information needed to identify you. If we have reasonable doubts about your identity, we may ask for additional information that is proportionate and necessary to verify it.
You may also lodge a complaint with the Agencia Española de Protección de Datos (the Spanish data protection authority) if you consider that the processing of your data does not comply with the rules: www.aepd.es.
9. Security
Sereno applies reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction.
These measures may include access controls, encryption in transit, backups, permission management, security requirements for providers, access reviews and internal confidentiality procedures.
10. Minors
The website and the booking services are aimed at adults with the legal capacity to enter into a contract. We do not knowingly collect data about minors except where this is necessary to manage a booking or a stay, or to comply with legal obligations regarding the traveller register, in which case the data must be provided by the responsible adult.
11. Accuracy of the data
The user warrants that the data provided is truthful, accurate, complete and up to date. Where the data belongs to third parties, the user declares that they have sufficient authority to provide it and undertakes to inform those third parties of this Privacy policy where appropriate.
12. Changes to this policy
Sereno may update this Privacy policy to reflect legal, technical, operational or service changes. The version in force at any given time is the one published on this page.
Where the changes are significant, we will endeavour to inform users by reasonable means.