Privacy Policy

At Zobooq we take the protection of your data seriously. This policy explains what information we process, on what legal basis, for how long and how you can exercise your rights, in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and Law 34/2002 (LSSI-CE).

This policy concerns the data we process as controller: that of the people who create an account on Zobooq (owners, managers and their team) and that of those who visit our site. The processing of the data of the guests you manage through the platform is governed by the Data Processing Agreement (DPA), in which you act as controller and Zobooq as processor.

1. Data controller

• Company name: VACATIOLABS, S.L.U.
• Tax ID (NIF/CIF): B93814903
• Address: Camino Viejo de Godella, 144, 46016 Valencia, Spain
• Contact email: legal@zobooq.com

If a Data Protection Officer (DPO) is appointed in the future, their contact details will be published in this same section.

2. Data we process

We process the following categories of data, depending on how you use the service:

• Account data: name, email address and encrypted password.
• Data of your business/accommodation: company name or name, tax data, data on your accommodations, bank or payment details to settle bookings, and account configuration.
• Booking and guest data: the information on bookings, guests and communications that you manage on the platform. With respect to this data, Zobooq acts as processor on your behalf (see the DPA).
• Minimal technical and usage data: preferred language, authentication session, and aggregated and anonymous usage metrics. We use our own analytics and, on the public website, Google Analytics and Google Ads conversion measurement only if you accept their cookies; on both the public website and the application we also use Microsoft Clarity (heatmaps and anonymous session recordings) only if you accept their cookies (see the Cookie Policy).
• Communications that you send us (support, chat, registration, team invitations).
• Public website chat: if you write to us from the zobooq.com chat without an account, we process your email address and your messages solely to reply to you (basis: our legitimate interest in handling your enquiry). These conversations are deleted after 12 months of inactivity.

3. Legal bases and purposes

We process your data on the following legal bases:

• Performance of the contract (Art. 6.1.b GDPR): to provide the accommodation management service you have contracted, including the creation of your account and the operation of bookings, channels and communications.
• Legal obligation (Art. 6.1.c GDPR): to comply with accounting and tax obligations, as well as to facilitate the functions legally required of accommodations (for example, the documentary registration of travelers).
• Legitimate interest (Art. 6.1.f GDPR): to maintain the security of the platform, prevent fraud and abuse, and improve the product through aggregated and anonymous analytics.
• Consent (Art. 6.1.a GDPR): when you connect external integrations (payment gateways, channels/OTAs or advertising platforms) or accept marketing communications. You may withdraw it at any time.

4. Disclosure of data to the authorities (traveler registration)

Spanish regulations require accommodation establishments to report certain traveler data to the authorities (Real Decreto 933/2021 and related regulations). When you use the traveler registration function, Zobooq facilitates the communication of that data to the platform of the competent Administration (Ministry of the Interior). This is a disclosure required by legal obligation, not a transfer for commercial purposes. You, as the accommodation owner, are responsible for complying with this obligation and informing the guests.

5. Retention periods

We keep your data while your account is active. When you request deletion or close your account, we delete or anonymize your personal data, except for that which we must retain to comply with legal obligations.

Spanish regulations require certain documentation to be kept for minimum periods: accounting documentation and supporting records for at least 6 years (Article 30 of the Spanish Commercial Code) and until the limitation period for tax obligations expires (normally 4 years); traveler registration data for the period provided for in its specific regulations. For this reason, certain records may be kept blocked during those periods even if you have requested their deletion, and accessible only to respond to requirements from the Administration or the courts.

6. Recipients and sub-processors

We do not sell your data. To provide the service we rely on the following processors (sub-processors), which process data on our behalf under contract pursuant to Art. 28 GDPR:

Sub-processor / function	Purpose	Location and transfers
Payment processing (Stripe)	Collection of your Zobooq subscription and, where applicable, of bookings.	EU / USA — Standard Contractual Clauses.
Connection with channels/OTAs (channel manager)	Synchronization of availability, prices and bookings with the portals you connect.	EU / United Kingdom — with adequate safeguards.
Transactional email delivery (Resend)	Confirmations, invitations and service notices.	USA — Standard Contractual Clauses.
Hosting and infrastructure (Digital Value, S.L.)	Hosting, database and service infrastructure.	Spain (EU).
Advertising (Meta), only if you connect it	Management of advertising campaigns on networks that you voluntarily activate.	USA — with adequate safeguards.
Behavioral analytics (Microsoft Clarity), only with your consent	Heatmaps and anonymous session recordings to improve usability.	USA — EU-U.S. Data Privacy Framework.

Some sub-processors may be located outside the European Economic Area. In those cases, international transfers are covered by adequate safeguards (the European Commission's Standard Contractual Clauses or adequacy decisions).

7. Your rights

As the data subject, you may exercise the following rights at any time:

• Access: to know what data we process about you.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to request the deletion of your data (subject to the retention obligations indicated above).
• Portability: to receive your data in a structured, machine-readable format.
• Objection and restriction: to object to certain processing or to request that it be restricted.
• Withdraw the consent given, without this affecting the lawfulness of the prior processing.

You may exercise the rights of access, portability and erasure directly from the application, under My Account → Privacy & data: there you can download a copy of your data in JSON format and request the deletion of your account. Deletion runs after a 7-day safety period during which you can cancel it, and is irreversible; records subject to legal retention will remain blocked as described in section 5. For the remaining rights, or if you prefer, contact us through the website's contact form selecting the "Privacy & data" subject. We will respond within a maximum period of one month. If you consider that we have not properly handled your request, you may file a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es.

8. Security

We apply technical and organizational measures to protect your data: encryption in transit (HTTPS), encryption at rest of sensitive secrets, role-based access control and isolation between the data of different customers. When you pay a subscription, your card details are handled directly by the payment provider; Zobooq does not store them.

9. Minors

The service is aimed at companies, self-employed professionals and professionals in the accommodation sector. It is not intended for minors and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy to reflect legal or service changes. We will publish the version in force on this page with its update date and, when the changes are significant, we will notify you through the usual means.