Privacy policy

This policy explains how personal data is processed in Ospikey, the online check-in service for holiday rentals available at ospikey.com and its subdomains.

Service provider: Yuriy Sultanov · Tax ID Y5129180X · Carrer Mendez Nunez 30 07450 Santa Margalida, Illes Balears, España · Contact: hola@ospikey.com

1. Two different roles

Ospikey processes two kinds of data and has a different role for each:

• Data of hosts and their teams (the people who use the panel): Ospikey is the data controller.
• Data of guests (what they fill in during check-in): the host is the controller, because the host has the legal duty to register their travellers. Ospikey acts as data processor (Article 28 GDPR) and only processes that data on the host's instructions, under the data processing agreement included in the Terms of use.

2. Data of hosts and teams

Data	Purpose	Legal basis
Name, email, language, company and role	Create and manage the account, provide the service	Performance of the contract (Art. 6.1.b GDPR)
Password (only its hashed fingerprint), two-step verification methods, sessions, IP address, activity log	Protect accounts and data, detect unauthorised access	Legitimate interest in security (Art. 6.1.f)
Billing details (company name, tax ID, address) and invoices	Invoicing and tax and accounting obligations	Contract and legal obligation (Art. 6.1.b and 6.1.c)
Messages you send us	Reply and help you	Contract or legitimate interest

We do not use this data for advertising and do not pass it on to third parties for commercial purposes.

3. Guest data

On behalf of the host, Ospikey collects the data required by Spanish Royal Decree 933/2021: identity (first name, surnames, sex, date of birth, nationality), identity document, address, contact details, relationship in the case of minors, and signature. If the host enables the feature, also photos of the document.

The purpose is to fulfil the host's traveller registration duty and to send the report to SES.Hospedajes (Spanish Ministry of the Interior). The host's legal basis is compliance with a legal obligation (Art. 6.1.c GDPR).

Guests who wish to exercise their rights should contact the host; Ospikey will help the host respond.

4. How long we keep data

• Traveller data: 3 years from the end of the stay, as required by Royal Decree 933/2021. It is then deleted automatically.
• Document photos: deleted automatically 30 days after the check-out date.
• Account data: while the account is active. Afterwards, only what is needed during legal periods (for example, accounting and tax records for 6 years).
• Security logs: as long as needed for the security of the service and, at most, as long as the law allows.

5. Who we share data with

• Spanish Ministry of the Interior (SES.Hospedajes): traveller data, on behalf of the host and because the law requires it.
• Providers (sub-processors) that help us deliver the service:
  • Hetzner Online GmbH (Germany): server hosting in data centres in Germany and Finland.
  • Brevo (Sendinblue SAS, France): sending of transactional emails (check-in links, login codes, notices).

All data is processed within the European Economic Area. There are no international transfers and we never sell data.

6. Security

We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), encryption of identity data and document photos, mandatory two-step verification for every panel user, permissions by role and by property, separation between customers and logging of sensitive actions.

7. Your rights

You can request access, rectification, erasure, restriction or portability of your data, or object to its processing, by writing to hola@ospikey.com. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Cookies

The website uses no cookies. The panel and the check-in only use strictly necessary technical cookies. More information in the Cookie policy.

9. Changes

If we change this policy in a significant way, we will announce it in the panel or by email before the change applies.