Privacy Policy

Last updated: 28 October 2026

This policy explains how we process your data when you check in online (pre-check-in) at a CM Hotels hotel. Online check-in is voluntary: if you prefer, you can check in at reception when you arrive.

1. Data controller

Hotel Playa del Moro, S.A. (CM Hotels), tax ID A07008543, registered in Cala Millor, 07560 Sant Llorenç des Cardassar (Balearic Islands, Spain), which operates the hotels CM Castell de Mar, CM Playa del Moro and CM Mallorca Palace.
Contact for any privacy matter: customer@cmhotels.com.

2. What data we process

• Booking details: booking reference, arrival and departure dates, hotel and room.
• Identification data required by law: first name and surnames, sex, date of birth, nationality, document type and number, document support number, issue and expiry dates and, for minors, their relationship to the responsible adult.
• Contact details: address, postcode, town, country, phone number and email address.
• Your signature on the registration form.
• Technical data: IP address, browser, date and time of each step, for the security of the service and as proof of what you signed and accepted.
• Your choices in the consent boxes, together with the exact text and version you accepted or declined.

Automatic document reading (optional). If you choose to scan your identity document, the image is sent to Microsoft Azure, on servers in the European Union, only to read the data and fill in the form. The image is processed on the spot and discarded: we do not keep any photo or copy of your document, only the data you review and confirm. If you prefer, you can type the data in yourself.

3. Why we use it and on what legal basis

• Guest registration and reporting to the Spanish Ministry of the Interior. Every accommodation in Spain must register its guests and report them to the authorities. Legal basis: legal obligation (Art. 6(1)(c) GDPR; Spanish Organic Law 4/2015 on public safety and Royal Decree 933/2021).
• Managing your arrival and stay: preparing your arrival, generating your signed registration form and emailing you a copy. Legal basis: performance of the accommodation contract (Art. 6(1)(b) GDPR).
• Security of the service: preventing unauthorised access to bookings, detecting abuse and being able to prove what you signed and accepted. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• Customer profile and marketing communications, only if you tick the corresponding box: creating or updating your CM Hotels customer profile with your contact details, language, country and stays at our hotels, and sending you offers, news and information about our hotels by email and WhatsApp, tailored to your stays and preferences. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 21 of Spanish Law 34/2002 on information society services). Ticking it is not required to check in, and you can withdraw your consent at any time.

We do not take automated decisions that have legal effects on you or significantly affect you.

4. Minors

The data of children under 14 is provided by the adult responsible for the booking. From the age of 14, guests sign their own registration form, as required by Royal Decree 933/2021. We do not send marketing communications to minors.

5. Who we share your data with

• The Spanish Ministry of the Interior (SES.Hospedajes platform) and, when they request it, the police and security forces, as required by law.
• Providers processing data on our behalf (data processors), under contract and following our instructions:
  • Microsoft Ireland Operations Ltd. (Microsoft Azure): hosting of the service, optional automatic document reading and sending of emails, on servers in the European Union.
  • The provider of our hotel management system, where your stay is recorded.

We do not sell your data or share it with third parties for their own purposes. There are no international transfers of data outside the European Economic Area; should a provider ever need one, it would be made with the safeguards required by the GDPR, such as the European Commission's standard contractual clauses.

6. How long we keep it

• Guest register and signed registration form: 3 years from the end of your stay, as required by Article 5.3 of Royal Decree 933/2021. After that it is deleted automatically.
• Check-in started but not completed: deleted automatically 30 days after the booking's departure date.
• Technical security data (booking search attempts): 90 days.
• Customer profile and marketing communications: until you withdraw your consent, or 3 years after your last stay or interaction with us if there is no new one.
• Proof of your consents: for as long as needed to show that you gave or withdrew them in case of a claim.

7. Your rights

You can exercise your rights of access, rectification, erasure, restriction of processing, objection and portability, and withdraw at any time any consent you have given, without affecting anything done before you withdrew it. To do so, write to customer@cmhotels.com stating which right you wish to exercise; where needed to identify you, we will ask you to prove your identity. To stop receiving marketing communications you can also use the unsubscribe link in each message or reply STOP on WhatsApp.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of your country.

8. Security

Your personal data is stored encrypted, communications are protected with HTTPS, access is limited to authorised staff and check-in links expire. Please do not share your booking link with people who are not travelling with you.

9. Changes to this policy

If we change this policy, we will publish the new version here with its date. If the change affects something you accepted, we will ask you again.

← Back