Privacy Policy

Here's a quick summary of what this policy covers. The full detail follows below.

Do we collect personal data?

Yes. This includes things like your name, email, phone number, and IP address, plus how you interact with our website.

Do we use cookies and similar tracking?

Yes. See our separate Cookies Notice for the full breakdown.

Do we share data with third parties?

Yes. We work with tools like Google, Facebook, and LinkedIn.

Can you ask for a copy of the data we hold on you?

Yes.

Can you ask us to correct or delete your data?

Yes.

Can you withdraw your consent?

Yes, at any time.

Can you opt out of marketing?

Yes. Every marketing message includes an unsubscribe link. You can also contact us directly to be removed from our lists.

Do we protect your data?

Yes. We use reasonable technical and organizational measures to keep it safe.

Can you complain to a regulator?

Yes. In Spain, that's the Agencia Española de Protección de Datos (AEPD).

SOLERA (“SOLERA,” “we,” “us,” “our”) is a hospitality digital marketing agency working with independent hotels and restaurants in Spain, mainly across the Costa del Sol and Tenerife. We build direct booking websites, set up analytics, capture guest data, and run lifecycle marketing.

For the personal data described in this policy, SOLERA acts as the data controller. That means we decide why and how your data is collected and used. We take that responsibility seriously.

This policy is written to meet the requirements of the EU General Data Protection Regulation and the Spanish data protection framework (collectively, “GDPR”).

For questions about this policy, contact us at info@soleraway.com.

This policy applies to personal data we handle when you:

• Visit our website
• Fill in a consultation or contact form
• Download a report from our Profit Leak Calculator
• Receive marketing communications from us
• Otherwise interact with SOLERA directly

What this policy does not cover

Data we process for our clients

When we build and run systems for a hotel or restaurant, we sometimes handle personal data belonging to their guests — email addresses, stay dates, booking preferences. In those cases, our client decides why and how that data is used. We act as their service provider, and their privacy policy applies, not this one. If you booked a stay or a table with one of our clients and want to exercise your rights, contact that business directly.

Staff and applicant data

This policy doesn't cover data we hold about our own employees, job applicants, or contractors.

Aggregated and anonymized data

We may collect and use aggregated data — general information about how visitors use our site, such as traffic patterns and page visits — to improve and promote the site. This data doesn't identify you personally, and this policy doesn't apply to it. We may share aggregated data with third parties collectively and anonymously for legitimate business purposes.

We need a valid legal reason to use your data. Depending on the situation, we rely on one of these:

Your consent

For example, when you opt in to marketing or accept non-essential cookies. You can withdraw consent at any time.

Performing a contract

When we need your data to deliver a service you've asked for, respond to your request, or fulfill your order.

Our legitimate interests

Such as running, evaluating, and improving our business, measuring how well our marketing works, and keeping our website secure. Where we rely on this, you can ask us how we weighed it.

Legal obligation

When the law requires us to keep or share certain data.

If you withdraw consent, anything we did with your data before you withdrew it stays lawful. Withdrawing consent also doesn't affect processing we carry out on another legal basis.

We won't collect new categories of personal data without telling you first. We don't collect sensitive personal data.

We use cookies and similar technologies on our website to keep it running, measure how it performs, and — where you consent — show you relevant advertising. Cookies also help us keep track of your preferences, so you don't have to re-enter information each time you visit. Some are set directly by us. Others are set by third parties such as Google, Facebook, and LinkedIn.

We've set out the full detail in a separate document. For everything on how we use cookies and how to control them, see our Cookies Notice.

Note: if you reject certain cookies, you may not be able to access or use all features of our website.

We use your personal data to:

• Respond to your questions and consultation requests — legal basis: your consent to be contacted, or our legitimate interest in answering enquiries
• Deliver the services you've asked for and fulfill your orders — legal basis: performance of a contract
• Send you your Profit Leak Calculator report — legal basis: performance of a contract
• Keep records of the services you've purchased or considered — legal basis: our legitimate interest, and legal obligations around record-keeping
• Send you marketing about our services, only where you've agreed — legal basis: your consent
• Measure how well our own marketing and advertising is working — legal basis: our legitimate interest
• Analyze how our website is used so we can improve it — legal basis: our legitimate interest, or your consent where this relies on cookies
• Keep our website and systems secure — legal basis: our legitimate interest, and legal obligations
• Meet our legal obligations — legal basis: legal obligation

We will only use the information you give us for the purpose specified at the point of collection. All forms provide an option to opt out of marketing lists.

We share personal data with a small set of providers and partners so we can run our website, follow up on leads, and market our services. Here's who, and why — no black box.

Providers that help us run and measure our website and marketing

• Google — website analytics and advertising
• Facebook (Meta) — advertising and measurement
• LinkedIn — advertising and measurement

Some of these third parties — such as Google, Facebook, and LinkedIn — may collect information about your activity across different websites over time. This is known as cross-context behavioral advertising — tracking that follows you beyond our site to build an advertising profile. Where this happens through cookies, you control it through your cookie choices. See our Cookies Notice for how to opt out.

Our partners

Where you've separately agreed to it, the details you provide when you download a report from our Profit Leak Calculator — your name, email address, phone number, and the information entered in the calculator — may be shared with a named partner for performing a service. Other than this disclosed partner-sharing, we do not sell, rent, or share your personal data with any other party for commercial purposes. If you'd rather not hear from us, you can opt out at any time by using the unsubscribe link in any marketing email or by contacting us directly at info@soleraway.com.

Other disclosures

We may share your data if the law requires it, to respond to a lawful request from authorities, to protect the security, property, assets, or rights of SOLERA, or in connection with a sale or restructuring of our business. We may also share fully anonymized, aggregated data — which cannot identify you — for any lawful purpose, such as analyzing usage trends.

Transfers outside the EEA

Some providers — including Google, Meta, and LinkedIn — may process data outside the European Economic Area, principally in the United States. Where that happens, we make sure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses or, where the provider self-certifies, the EU-U.S. Data Privacy Framework. You can ask us for a copy of the relevant safeguard. We keep this under review, since the Data Privacy Framework is subject to ongoing legal challenge in the EU.

We keep your personal data only as long as we need it for the purpose we collected it — and for any linked purpose the law allows.

For example, we keep lead and marketing data while you're an active contact and for a reasonable period afterward, unless you ask us to delete it sooner. We keep some data longer where the law requires it, or to resolve disputes and enforce our agreements. When data is used for more than one purpose, we keep it until the longest applicable period ends.

Usage and analytics data is generally kept for a shorter time, unless we need it to keep our website secure or to comply with the law.

Our website may include links to third-party websites that we believe may be of interest. Those sites are not controlled by us and may not follow the same privacy practices. We're not responsible for their privacy policies or how they handle your data. We recommend reviewing the privacy notice of any third-party site before you submit any personal information to them.

Under GDPR, you have clear rights over your personal data. Here's what each one means, in plain terms.

Right to be informed

You have the right to know how we collect and use your data, how long we keep it, and who we share it with. This policy is how we tell you.

Right of access

You can ask for a copy of the personal data we hold about you, along with details of how and why we process it.

Right to rectification

You can ask us to correct anything that's wrong or fill in anything that's incomplete.

Right to erasure

You can ask us to delete your data. Sometimes we can't — for legal or technical reasons — and if that's the case, we'll tell you why.

Right to restrict processing

You can ask us to pause how we use your data in certain situations, such as when you think it's inaccurate.

Right to object

You can tell us to stop using your data where we rely on legitimate interests. You can also object to direct marketing at any time — and when you do, we'll stop.

Right to data portability

You can ask for a copy of the data you gave us in a structured, commonly used, machine-readable format, so you can move it elsewhere.

Right to withdraw consent

Where we rely on your consent, you can withdraw it at any time. That won't affect anything lawful we did before you withdrew it.

Right to non-discrimination

We won't treat you differently, or give you a worse service, for exercising any of these rights.

To exercise any of these rights, contact us at info@soleraway.com.

To protect your data, we may need to confirm your identity before we act on your request. We'll only use the details you give us for that verification.

We'll confirm we've received your request within ten business days and aim to respond fully within four weeks. If your request is complex and we need more time, we'll tell you why and how long it will take. We won't charge for this, unless a request is clearly excessive or repetitive — and if that's the case, we'll explain before doing anything.

We only send you marketing where you've agreed to it or where the law allows. Marketing lists are used only for SOLERA purposes or in joint promotions with a SOLERA partner. We do not sell, rent, or share your personal data with any other party for commercial purposes.

Every marketing message includes a clear way to unsubscribe. You can also email us at info@soleraway.com to be removed from our lists at any time. Opting out won't affect any service you've asked us to deliver.

Our website and services are meant for business owners and operators, not children. They're not directed at anyone under 16, and we don't knowingly collect data from children. If you believe a child has given us their data, contact us and we'll delete it.

We use reasonable technical and organizational measures to keep your data safe from unauthorized access, loss, or misuse. That includes limiting who can access it and working with providers that maintain proper security standards. No system is ever completely secure, but we take real steps to protect what you share with us. Any use of the site and downloading of materials is done at your own risk, and SOLERA cannot guarantee that information submitted through the site will be entirely free from unauthorized interception.

If you think we've mishandled your personal data, we'd like the chance to put it right first — so please contact us at info@soleraway.com. You also have the right to complain to a supervisory authority.

If you live in an EU country other than Spain, you can complain to your own country's data protection authority instead of, or as well as, the AEPD — you don't have to complain in Spain.

In Spain, that's the Agencia Española de Protección de Datos (AEPD). Website: www.aepd.es. Address: C/ Jorge Juan, 6, 28001 Madrid, Spain.

We may update this policy from time to time — for example, if our services or the law change. When we do, we'll post the revised version here and update the date at the top. Please check back now and then.

Questions about this policy or how we handle your data? Get in touch at info@soleraway.com and we'll walk you through it.

We'll confirm receipt within ten business days and aim to respond fully within four weeks.