C. Real Arriba, 1, 45470 Los Yébenes, Toledo
925 32 04 19

Hostal Restaurante Casa Apelio

La mejor gastronomía y trato familiar en Los Montes de Toledo

Privacy policy

Last updated: 13 October 2026

This policy explains what personal data we process at Hostal Restaurante Casa Apelio, why, on what legal basis, how long we keep it, who we share it with and what rights you have. It applies to the website hostalcasaapelio.com, to booking requests, to your stay and to restaurant table bookings.

1. Data controller

  • Owner: Apelio García Sánchez, sole trader (autónomo)
  • Tax ID (NIF): 03824792F
  • Trading name: Hostal Restaurante Casa Apelio
  • Address: Calle Real de Arriba, 1, 45470 Los Yébenes (Toledo), Spain
  • Telephone: +34 925 320 419
  • Email: [email protected]

2. What data we process and why

2.1. Booking requests made on the website

  • Data: first name, surname, email, telephone and any comment you write; dates, rooms, number of guests, extras and booking price.
  • Purpose: to manage your request, confirm or decline it, write to you about it and prepare your stay.
  • Legal basis: taking steps at your request before entering into a contract, and performing the accommodation contract (article 6.1.b of the General Data Protection Regulation, GDPR).
  • Retention: if the request is never confirmed, we delete it automatically 12 months after the planned check-out date. If the booking is confirmed, we delete it automatically 6 years after the check-out date. Accounting records, the guest register and the admission document are kept separately, for the periods given in sections 2.2 and 2.3.

How it is handled: the request is stored in the website’s database, hosted by IONOS in the European Union. We review it from our own panel, hosted on an IONOS server in the European Union, which keeps a copy of the bookings and updates it from the website, so anything deleted on the website also disappears from the panel. The emails about your booking (receipt, confirmation, decline or request for information) are sent through Brevo, and a hidden copy of each one is sent to a Gmail mailbox we use to manage bookings.

The copies of those emails in our mailboxes (IONOS and Gmail) and Brevo’s sending log are not deleted automatically: we keep them as long as they are needed to manage your booking or handle a complaint.

2.2. Payment and invoicing

  • Data: the data needed to charge for your stay and, if you ask us for an invoice, the tax details it must include.
  • Purpose: to take payment and meet our accounting and tax obligations.
  • Legal basis: performing the contract (article 6.1.b GDPR) and our legal obligations (article 6.1.c GDPR).
  • Retention: accounting and commercial records are kept for six years from the relevant last accounting entry (article 30 of the Spanish Commercial Code). If another legal obligation or a claim requires a document to be kept longer, we keep only what is needed for that purpose.

The website does not take payments or ask for card details. You pay at the establishment in cash, by Bizum or by credit or debit card (except American Express). Card and Bizum payments are processed by the financial institutions concerned.

2.3. Guest register and admission document

  • Data: the identity and stay details required by Spanish Royal Decree 933/2021, such as name, identity document, date of birth and nationality.
  • Purpose: to keep the guest register and report each guest’s arrival to the authorities (guest registration forms), as the law requires of accommodation establishments.
  • Legal basis: compliance with a legal obligation (article 6.1.c GDPR), established in Royal Decree 933/2021.
  • Retention: 3 years from the end of the stay (article 5.3 of Royal Decree 933/2021).

We send the guest registration forms to the Spanish Ministry of the Interior through its SES.HOSPEDAJES platform. Registration is done with our own form, which has its own privacy information: registro.hostalcasaapelio.com/privacidad.

On arrival we also fill in the admission document required by the tourism regulations of Castilla-La Mancha. It contains the details of the owner and the establishment, the number of guests, the arrival and departure dates, the type of stay and the total price, and the guest signs it. Its legal basis is also a legal obligation (article 6.1.c GDPR). We keep a copy for five years, as required by article 30 of Decree 253/2023, available to the tourism authorities. It is a separate document from the guest register and has its own retention period.

2.4. Contact form and emails

  • Data: name, email, telephone (optional) and message.
  • Purpose: to reply to you.
  • Legal basis: if the message is about a booking or a stay, taking the steps you ask for before a contract, or performing the contract, as applicable (article 6.1.b GDPR). For other enquiries, our legitimate interest in replying to people who write to us (article 6.1.f GDPR).
  • Retention: messages sent through the form are deleted automatically from the website 12 months after we receive them, and the contact record created from them 12 months after the last contact. The copies in our mailbox are not deleted automatically: we keep them as long as they are needed to deal with your enquiry or a complaint.

The form sends your message to our email account, hosted by IONOS, and stores a copy in the website’s database. To stop spam it uses a hidden field that only bots fill in, plus Google reCAPTCHA (see section 2.5). If you email us directly, your message only reaches our mailbox: it does not go through the form, is not copied to the website database and does not pass through those antispam tools.

2.5. Browsing and security

When you visit the website, these services receive your IP address and technical data about your browser (browser type, language, page visited):

  • Server logs (IONOS): date, page requested, browser and partially truncated IP address (the last block is removed). They are used for the security and proper operation of the website. The hosting provider deletes them automatically after about 8 weeks.
  • Cloudflare: all traffic to the website passes through Cloudflare, which protects it against attacks and serves it faster. We also use Cloudflare Web Analytics, a statistics service that, according to Cloudflare, does not use cookies.
  • Google reCAPTCHA (on the contact page only): analyses technical data from your browser and how the page is used to tell people from bots. We use it so that the form is not flooded with automated spam. It is not loaded on any other page.

Legal basis: our legitimate interest in keeping the website secure, working properly and free of spam (article 6.1.f GDPR).

The “Get directions” and “Read reviews on Google” links open Google Maps. If you click them, Google processes your data under its own privacy policy.

2.6. Google Analytics statistics (only if you accept them)

  • Data: pages viewed, length and source of the visit, device, browser and approximate location, linked to an identifier stored in a cookie. We also measure clicks on the email address and telephone number and submissions of the contact form.
  • Purpose: to understand how the website is used and improve it.
  • Legal basis: your consent (article 6.1.a GDPR and article 22.2 LSSI-CE). You can withdraw it at any time with the “Cookies” button at the bottom of every page.
  • Retention: user and event data are kept in Google Analytics for 14 months, without that period being reset when you visit again. Aggregated reports may be kept longer. Cookies have their own lifetimes, listed in the cookie policy.

We do not use this data for advertising: Google’s advertising features are switched off.

2.7. Restaurant table bookings

  • Data: name, telephone number, date of the booking and number of diners.
  • Purpose: to manage your table booking, which is made by telephone.
  • Legal basis: taking steps at your request before entering into a contract (article 6.1.b GDPR).
  • Retention: we keep it until the date of the booking and delete it afterwards.

3. Mandatory data

In the forms, the fields marked as mandatory are needed to deal with your request. If you do not fill them in, we will not be able to process it. The guest register and admission document data are mandatory by law.

4. Who we share your data with

We do not sell your data. Only these providers and services process it, and only as far as necessary:

  • IONOS SE (Germany): hosting of the website and its database, email, the booking panel server and backups.
  • Cloudflare, Inc. (United States): content delivery network, security and cookie-free statistics.
  • Sendinblue SAS (Brevo) (France): sending the emails about your booking.
  • Google (Google Ireland Limited and Google LLC): Gmail, where the owner receives a hidden copy of the emails about your booking; reCAPTCHA, on the contact page; and, only if you accept it, Google Analytics.

We also disclose data to these recipients where applicable:

  • the Spanish Ministry of the Interior, for the guest registration forms;
  • the tourism authorities of Castilla-La Mancha, if they ask to see the admission documents;
  • the Spanish Tax Agency and other public authorities, courts and tribunals, when the law requires us to;
  • the financial institutions that process card or Bizum payments at the establishment.

5. Transfers outside the European Economic Area

  • Google LLC and Cloudflare, Inc. are in the United States and, according to their own information, participate in the EU-U.S. Data Privacy Framework. Transfers to companies participating in that framework rely on the adequacy decision the European Commission adopted for it on 10 July 2023. This includes the copies of the booking emails kept in Gmail. You can check each company’s participation in the official list.
  • IONOS and Brevo are based in the European Union.

6. Your rights

You can exercise these rights free of charge at any time:

  • Access: find out what data about you we process.
  • Rectification: correct inaccurate data.
  • Erasure: ask us to delete your data when it is no longer needed, unless the law requires us to keep it.
  • Objection: object to processing based on our legitimate interest.
  • Restriction: ask us, in certain cases, to stop using your data temporarily.
  • Portability: where we process the data you gave us by automated means, on the basis of your consent or a contract, receive it in a structured, commonly used, machine-readable format, and ask us to send it to another controller where technically feasible.
  • Withdraw your consent at any time (for example, for statistics cookies). Withdrawing it does not make unlawful what we did with your consent before you withdrew it.

To exercise them, write to us at [email protected] and tell us which right you want to exercise. If we have reasonable doubts about your identity, we may ask for the information needed to confirm it. We will reply without undue delay and within one month at the latest. If the request is complex or we receive many, we may extend this by up to two more months; if so, we will tell you within the first month and explain why.

If you believe the processing of your data breaks data protection law, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos). Its current contact details and complaint channels are at www.aepd.es.

7. Security

The website uses an encrypted connection (HTTPS). Only the owner and the people he authorises can access the booking panel.

Every day we make a backup of the database so that we can restore the service if something goes wrong. Backups are deleted automatically after 31 days; if a backup fails, at least the last seven are kept, even if they are older than 31 days. Because the automatic data deletion runs every night, if we ever restore a backup, any data that had already expired is deleted again automatically.

8. Automated decisions

We do not make decisions based solely on automated processing that have legal effects on you or affect you in a similarly significant way. Every booking request is reviewed by a person. Browsing statistics are explained in section 2.6.

9. Changes to this policy

If we change what we do with your data, we will update this policy and the date at the top.