Privacy policy

v1.2 · 2026-09-25

This Privacy Policy explains how Zonbook ("the Controller") processes the personal data you provide when using our websites, apps and services. We comply with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and Law 34/2002 (LSSI).

1. Data Controller

  • Name: Artem Zon
  • Tax ID (NIF/NIE): Y0686425G
  • Address: Calle El Chipre 70, Gran Alacant, 03130 Santa Pola, Alicante, España
  • Contact email: [email protected]
  • Data-protection contact: [email protected]

2. Data we process

  • Identification and contact data (name, email, phone).
  • Account and authentication data.
  • Booking, payment and billing data.
  • Traveller data collected during online check-in on the host's behalf (contact details, identity-document image and self-portrait) so the host can comply with SES.Hospedajes (Royal Decree 933/2021). The host is the controller for that reporting; Zonbook acts as processor and does not file on the host's behalf.
  • Browsing and cookie data (see the Cookies policy).

3. Purposes and legal bases

  • Providing the booking service — basis: performance of the contract (Art. 6(1)(b) GDPR).
  • Compliance with legal obligations (SES.Hospedajes, Form 179, accounting) — basis: legal obligation (Art. 6(1)(c)).
  • Commercial communications — basis: consent (Art. 6(1)(a)), revocable at any time.
  • Service improvement and analytics — basis: legitimate interest (Art. 6(1)(f)), after cookie consent.

4. Retention periods

  • Account data: while the account is active.
  • Accounting and tax data: 6 years (Art. 30 Commercial Code).
  • Online check-in data (contact details, identity-document image and self-portrait): erased from the platform 90 days after check-out. Filed SES.Hospedajes records are kept by the host for 3 years; Form 179 data: 3 years.
  • Cookie consent records: 3 years.

5. Recipients and international transfers

We share data with processors: Stripe (payments), Resend (email), AWS / GCP (infrastructure). When these providers process data outside the EEA, EU-Commission-approved Standard Contractual Clauses apply.

6. Your rights

You may access, rectify, erase, object, restrict processing, port your data, and withdraw consent at any time. To exercise these rights, email [email protected]. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Changes to this policy

We may update this policy to reflect legal or product changes. The current version is always shown on this page, together with its effective date.

Analytics and session recordings

We measure site usage with Google Analytics 4 and with Umami, which we host on our own servers in the European Union; its data is not shared with any third party. Umami's page measurement is cookieless and uses no identifier.

If you accept the "Session recordings" category we additionally keep, for 30 days, a sampled and masked reconstruction of how public pages are used (clicks, scrolling and navigation). Text and form fields are masked in your browser before transmission, and pages showing your account, your bookings, payment, check-in or messages are never recorded. Legal basis: your consent (Art. 6(1)(a) GDPR), withdrawable at any time from "Change cookie preferences" in the footer. The detail is in the Cookie policy.

Update — September 2026: session recordings in the host portal

This section replaces the corresponding paragraph above.

On the public marketplace, recordings remain limited to public pages as described there. In the host portal, recordings now cover the whole portal except sign-in, password and identity-verification pages — including pages that display reservation and guest details. Text and form fields are masked in the browser before transmission, and recordings are kept for 30 days.

If you are a guest: details of your booking appear on your host's screen, and can therefore appear in a masked recording of that host's session. We are the controller for those recordings. The legal basis is our legitimate interest in diagnosing and improving the platform (Art. 6(1)(f) GDPR), weighed against in-browser masking of all text, a 30-day retention limit, storage on our own servers in the European Union, and access restricted to our own staff. You can object at any time using the contact details in this policy.

If you are a host: the "Session recordings" option is pre-selected in the cookie preferences dialog. You can switch it off before saving, or change your choice at any time from "Change cookie preferences" in the footer.