Who is responsible
Arxara, S.L. is the controller of personal data collected directly through this website and of the data needed to manage enquiries and bookings at Solapeña.
- Controller
- Arxara, S.L.
- Tax ID
- B91387985
- Address
- Calle Real, 5 · 24856 Pallide, León · Spain
- info@solapenya.com
- Tourism registration
- CRA-LE-576
What data we collect
We collect only the data required for each service: your name, email address, optional telephone number, subject and message when you use the contact form; and the identity, contact, stay, guest, billing or payment details requested by the booking engine when you decide to book.
Basic technical data may also be generated, including IP address, browser, device, access date and time, and security logs. When a family authorises us to publish a drawing, note or photograph from the playroom, we process that content and any name or caption supplied for publication.
Required fields are necessary to answer an enquiry or process a booking. Without them, we cannot provide that service. We do not obtain data from public sources or make automated decisions or profiles with legal effects.
How we use it
Each processing activity has a specific purpose and a legal basis linked to your relationship with Solapeña.
Enquiries and requests
- Data
- Name, email, optional phone number, subject and message.
- Purpose
- Reply to and follow up your enquiry.
- Legal basis
- Pre-contractual steps requested by you or consent, depending on the enquiry.
Bookings and stays
- Data
- Identity, contact, dates, occupancy, billing and payment-related details.
- Purpose
- Manage availability, booking, payment, stay and aftercare.
- Legal basis
- Contract performance, pre-contractual steps and tax, accounting and guest-registration legal obligations.
Operation and security
- Data
- IP, browser, device and technical logs.
- Purpose
- Deliver the website, prevent abuse, diagnose errors and protect systems.
- Legal basis
- Legitimate interest in keeping the service secure and operational.
Playroom and guest memories
- Data
- Drawing, note, photograph and optional caption.
- Purpose
- Show real memories from stays in the gallery.
- Legal basis
- Consent from the author or their legal representative where applicable.
Website administration
- Data
- Identity and credentials of authorised users.
- Purpose
- Manage the journal and playroom through the private panel.
- Legal basis
- Professional relationship and legitimate interest in access control.
How long we keep it
Enquiries are kept for as long as needed to reply and follow them up. If an enquiry results in a booking, the data becomes part of the contractual relationship. It may then remain blocked for the applicable limitation periods in order to address potential liabilities.
Booking, billing and accommodation-compliance data is kept for the periods required by tax, accounting, tourism and public-security rules. Technical logs are retained only as long as reasonably necessary for security and diagnostics. Playroom content remains published until consent is withdrawn or it is no longer appropriate for the stated purpose.
Who receives the data
We do not sell personal data. Providers delivering necessary services for Arxara, S.L.—such as hosting, email, maintenance, backups and booking management—may access it under confidentiality and data-protection obligations.
The embedded booking engine is provided by Smoobu GmbH. When you open the booking page, the Smoobu frame may receive technical device data; when you complete a booking, Smoobu processes the information entered to manage it on Solapeña’s behalf. Data may also be disclosed to public authorities, law enforcement, courts or financial institutions when legally required or necessary to perform the contract.
The contact form uses Google reCAPTCHA v3 to detect automated and abusive submissions. When you open that page and submit the form, Google may receive technical browser and device data and return a risk score to Solapeña in order to protect the service from spam.
Solapeña does not plan international transfers. If a provider uses sub-processors outside the European Economic Area, it must rely on an adequacy decision or GDPR safeguards such as standard contractual clauses.
Read Smoobu’s privacy policyYour rights
Email info@solapenya.com with “Data protection” in the subject and proof of identity where necessary. Exercising these rights is free unless a request is manifestly unfounded or excessive under applicable law.
You may withdraw consent at any time without affecting earlier lawful processing and lodge a complaint with the Spanish Data Protection Agency (AEPD), particularly if you believe we have not handled your request correctly.
- Access: find out whether we process your data and obtain a copy.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request deletion where applicable.
- Objection: ask us to stop processing based on legitimate interests.
- Restriction: temporarily restrict processing.
- Portability: receive data you supplied in a structured format where applicable.
Cookies and local storage
The website uses strictly necessary storage to protect forms, maintain authorised sessions and remember your cookie choice. Accept and reject options are presented at the same level. You can reopen the manager from “Cookies” in the footer.
The new website does not currently activate its own analytics tools. If introduced, they will not load before consent and this information will be updated. The Smoobu booking engine may use its own identifiers when the service loads or is used; details are available in the provider’s policy.
Children and guest content
The contact and booking forms are intended for adults. We do not knowingly ask children to send data directly. If a booking includes children, their data is limited to what is essential for the stay and legal requirements.
Drawings, notes or photographs created by children should only be supplied for publication with permission from a parent or legal guardian. You may ask us to remove a published memory at any time by emailing info@solapenya.com and identifying the content.
Security and policy changes
We apply technical and organisational measures proportionate to the risk to prevent unauthorised access, loss, alteration or disclosure. No system is completely infallible, but access is reviewed and information is limited to what each task requires.
We will update this policy when processing activities, providers or applicable rules change. The version published here is the current one. Last reviewed: September 2026.