ClicClac
The law How it works Pricing Questions Log in Español English Français

Draft awaiting legal review: the company's details or a lawyer's review are missing.

Privacy policy

ClicClac automates check-in for holiday rentals. We handle data about two groups of people, and our role is not the same for each: for the hosts who use ClicClac we are the controller; for the guests who check in, the property is the controller and we process their data on its behalf, as a processor (Article 28 GDPR).

Who we are

[company name], tax ID [NIF], [registered address]. For anything about your data: privacidad@theclicclac.com.

If you use ClicClac as a host

  • Data: your name and email; your properties and their settings (calendars, way in, hours, traveller-register codes); the people you invite to your account; and an activity log: sign-ins and changes to the team, the groups or the properties, with date, author and IP address. The log notes what changed, never the value (a code or a password is never copied into it).
  • Why: to provide the service, and to protect it: knowing who signed in and what changed.
  • Legal basis: the contract you accept when signing up (Art. 6.1.b GDPR) and, for the activity log, our legitimate interest in your account's security (Art. 6.1.f).
  • How long: as long as your account exists. When you close it, we delete your data except what the law requires us to keep. The activity log is kept [12 months].

If you check in as a guest

  • Controller: the property you are staying at. We process your data on its instructions and use it for nothing else.
  • Data: what the law of the property's country requires, and only that: first and last names, sex, date and place of birth, nationality, identity document (type, number and support number, never a photo), email, phone, address and, for minors, how they are related to the adult travelling with them.
  • Why: to give you access to the property (sending you the code or the arrival instructions) and, where the law requires it, to report your details to the authority shown on the form.
  • Legal basis: the accommodation contract (Art. 6.1.b GDPR) and the legal obligation to register travellers (Art. 6.1.c), in Spain Royal Decree 933/2021.
  • Who receives it: the property and, where the law requires it, the competent authority; in Spain, the Ministry of the Interior (SES.Hospedajes).
  • How long: three years from the end of your stay, as Royal Decree 933/2021 requires. Then it is deleted.
  • Your rights: exercise them with the property, or write to us and we pass your request on.

Who helps us provide the service

Only providers bound by a processing agreement to protect the data:

  • [Server provider and country, within the European Union]: hosts the application and the database.
  • [Encrypted backup provider and country]: keeps the backups.
  • Resend, Inc. (United States): sends the emails. [International transfer mechanism: e.g. the EU-US Data Privacy Framework or standard contractual clauses.]
  • Nuki Home Solutions GmbH (Austria), only if the property uses a Nuki lock: receives the code's name (the booking number) and its dates, never your personal data.

Cookies

We only use technical cookies the site needs to work: your session (cc_session), your language (cc_lang) and your country (cc_country). None for analytics or advertising, so we do not ask for consent.

How we protect the data

Encrypted connections (HTTPS); hosts' secrets (codes, passwords, calendars) encrypted in the database; each account kept apart from the others by the database itself; role-based access and an activity log; and encrypted backups kept off the server.

Your rights

You can ask to access your data, correct or delete it, object to or restrict its processing, and take it with you, at privacidad@theclicclac.com. If you think we are not handling it properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or your own country's authority.

Last updated: 2026-10-18