Data Controller
In compliance with Regulation (EU) 2016/679 of the European Parliament (GDPR) and Organic Law 3/2018 on the Protection of Personal Data (LOPDGDD), we inform you that the controller of your personal data is:
Pensión Koxka Calle 31 de Agosto, 22 – 1.º Izda. 20003 Donostia – San Sebastián (Gipuzkoa) Phone: +34 943 426 885 Web: pensionkoxka.ibd.es
What personal data do we collect?
Depending on how you interact with our website, we may collect the following data:
Communications: content of the messages you send us through the contact form or by email.
Contact details: first name, last name, email address, and phone number.
Booking data: check-in and check-out dates, number of guests, and accommodation preferences.
Browsing data: IP address, browser type, and browsing behavior (through analytical cookies, with your prior consent).
For what purpose do we process your data?
We process your personal data for the following purposes:
Managing and confirming your accommodation booking: Execution of a contract (Art. 6.1.b GDPR).
Responding to your inquiries and requests for information: Legitimate interest / consent (Art. 6.1.a and 6.1.f GDPR).
Sending you commercial communications about offers and news (only if you have accepted): Consent (Art. 6.1.a GDPR).
Complying with legal obligations (tax, accounting, etc.): Legal obligation (Art. 6.1.c GDPR).
Improving the performance of our website through statistical analysis: Consent (Art. 6.1.a GDPR).
How long do we keep your data?
Booking data: kept for the time necessary to manage the accommodation and, subsequently, for the legally required period to comply with tax and commercial obligations (generally 5 years).
Contact data and inquiries: kept as long as necessary to handle your request and up to 1 year after the last communication.
Data for commercial communications: until you withdraw your consent.
Browsing data: as established in our Cookies Policy.
Who do we share your data with?
Pensión Koxka does not sell or transfer your data to third parties for commercial purposes. However, we may share your data in the following cases:
- Booking platforms (such as Booking.com, etc.) when the booking is managed through these channels, as they act as independent data controllers.
- Technology service providers that provide us with web hosting, email, or analysis services, acting as data processors under contract and with confidentiality guarantees.
- Public administrations and law enforcement agencies, when required by current regulations (for example, the mandatory traveler registry).
- Traveler registry: in accordance with public safety regulations, guest identification data is communicated to the competent authorities (National Police or Ertzaintza).
In no case will international data transfers be made outside the European Economic Area without adequate guarantees.
What are your rights?
You can exercise the following rights over your personal data at any time:
- Access: to know what data of yours we process.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to request the deletion of your data when it is no longer necessary.
- Objection: to object to the processing of your data in certain circumstances.
- Restriction: to request that we restrict the processing of your data.
- Portability: to receive your data in a structured and commonly used format.
- Withdrawal of consent: to withdraw the consent given at any time, without affecting the lawfulness of the previous processing.
To exercise these rights, you can contact us in writing at the postal address indicated in section 1, or through the contact phone or email, providing proof of your identity.
If you consider that the processing of your data does not comply with current regulations, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD) — www.aepd.es.
Security measures
Pensión Koxka has adopted the necessary technical and organizational measures to guarantee the security of your personal data and prevent its alteration, loss, unauthorized processing, or access, taking into account the state of technology, the nature of the stored data, and the risks to which they are exposed.
Minors
Our services are not directed at children under 14 years of age. If you become aware that a minor has provided us with personal data without parental consent, please let us know so we can proceed with its deletion.
Updates to this policy
This Privacy Policy may be updated to adapt to legislative changes or modifications in our services. We recommend reviewing it periodically. This version was updated in June 2025.
For any inquiries related to the processing of your personal data, please do not hesitate to contact us using the details provided in section 1.
