Privacy PoLicy
Last updated: 15 October 2026
Who we are
Ibiza Rocks Hotel Promociones S.L. is the controller responsible for the personal information covered by this policy, including information processed in connection with Ibiza Rocks Hotel and La Guay cafe.
CIF: B57615809
Address: Calle Cervantes 27, 07820 San Antonio, Baleares, Spain
Privacy contact: info@ibizarocks.com
This policy explains how we use personal information when you visit our websites, book or purchase from us, visit Ibiza Rocks Hotel or La Guay, use guest Wi-Fi or sign up for marketing.
La Guay does not take bookings. The hotel-booking, guest-registration, event-ticket and guestlist sections apply only when you use those services, rather than simply visiting the cafe.
We process personal information under the EU General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and applicable Spanish legislation.
Information we collect
Depending on how you interact with us, we collect:
- Your name, email address, telephone number and address.
- Booking, guest, event-ticket, guestlist and attendance information.
- Purchase, billing and payment-related information, including details you provide when requesting a named invoice.
- Nationality, identity and other details required by Spanish hotel guest-registration law.
- Preferences, requests, correspondence and feedback you provide.
- Marketing choices and consent records.
- Device and connection information, website activity and advertising-audience information.
- CCTV footage and photographs or videos.
We receive information directly from you, from someone booking on your behalf, from booking and payment providers, and through your use of our services.
We identify mandatory information when collecting it. Without information needed to fulfil a booking, purchase or legal obligation, we may be unable to provide the relevant service.
How we use your information
Bookings, purchases and guest services
We use your information to manage hotel bookings, event tickets, guestlist registrations, payments, service communications and guest requests.
We manage hotel reservations and guest stays through our booking and hotel property management systems. Guestlist registrations and restaurant reservations are made through our booking platforms. These booking arrangements do not apply to La Guay, which does not take reservations.
We record attendance where necessary to manage admission, reservations and associated follow-up.
Our legal basis is performing our contract with you or taking steps you request before entering into a contract. For accompanying guests who are not parties to the contract, we rely on our legitimate interest in administering bookings and providing guest services. We also rely on our legitimate interest in managing admission and reservations for necessary attendance records.
Booking communications may include practical information before and after your stay or event. Making a booking, purchasing a ticket or joining a guestlist does not automatically subscribe you to marketing.
La Guay purchases and customer service
At La Guay, we process personal information where necessary to take payments, provide requested invoices, handle refunds and respond to enquiries or complaints.
Our legal basis is performing our contract with you for purchases and related services, compliance with legal obligations for accounting and tax records, and our legitimate interest in responding to customer enquiries and resolving complaints.
Making a purchase at La Guay does not automatically subscribe you to marketing.
Legal obligations
We process information to meet guest-registration, reporting, accounting, tax and other applicable legal obligations.
For hotel stays, this includes providing required guest information to the competent authorities under Royal Decree 933/2021. These hotel guest-registration requirements do not apply simply because you visit La Guay.
Our legal basis is compliance with legal obligations.
Enquiries, fraud prevention and legal claims
We use information to answer enquiries, prevent fraud, protect our systems and establish, exercise or defend legal claims.
Our legal basis is our legitimate interest in responding to customers, protecting our business and safeguarding legal rights. Where an enquiry concerns a booking or purchase you wish to make, processing may instead be necessary to take steps at your request before entering into a contract.
Marketing emails
Where you opt in, we send marketing emails within the scope of your sign-up, such as Rocks Club offers or announcements about a particular event.
Our legal basis is your consent. We keep a record of your choices in our customer relationship management system.
You can withdraw consent using the unsubscribe link in any marketing email or by emailing info@ibizarocks.com. This does not affect your booking, purchase, essential service messages or processing that was lawful before withdrawal.
Event promoters
We securely share relevant guestlist and event-ticket information with external promoters to operate the event, including managing admission and attendance. Agreements restrict their use of this information to those purposes, unless you separately consent to receive marketing from that promoter.
Our legal basis for operational sharing is performing our contract with you where the sharing is necessary to fulfil your ticket or guestlist booking, or our legitimate interest in coordinating event operations and admission where contractual necessity does not apply.
Promoter marketing is optional and has a separate consent box during booking. The booking form identifies the promoter and provides its privacy information. Declining promoter marketing does not affect your ticket or guestlist registration.
Where you separately subscribe to a promoter’s marketing, the promoter is responsible for that marketing and explains how to withdraw consent in its privacy information and marketing messages.
Personalised advertising
Where you separately consent, we share your email address with advertising platforms such as Meta and Google to show you personalised advertising and help identify audiences with similar characteristics.
You can withdraw advertising consent by emailing info@ibizarocks.com. We then remove you from audiences we maintain on that basis.
Cookies and similar technologies
Our Cookie Policy explains the technologies used on our website, their providers, purposes and durations.
You can accept or reject optional technologies and change your choices through Cookie Settings.
Guest Wi-Fi
Where you use our guest Wi-Fi, we collect an email address, account information and technical connection records to provide and secure access.
We rely on our Wi-Fi service agreement where processing is necessary to provide access, and on our legitimate interest in operating and protecting the network for necessary security processing.
Marketing sign-up is separate and optional. Declining marketing does not prevent Wi-Fi access.
CCTV
We use CCTV in signed areas to protect people, property and facilities. Our legal basis is Article 6(1)(e) GDPR in conjunction with Article 22 LOPDGDD.
Access is restricted to authorised people. Relevant footage may be disclosed to competent authorities.
Footage is deleted within one month, or sooner where no longer needed, except where preservation is permitted by law as evidence of an incident affecting people, property or facilities.
Photography and filming
Photography and filming take place at the hotel for social media and hotel marketing. We provide information at booking and through notices at the venue. Where promotional photography or filming takes place at La Guay, we provide information at the cafe.
We favour images in which individuals are not identifiable. Where we feature an identifiable guest or customer in promotional material, we obtain separate, specific consent for the intended use.
To withdraw consent or raise a concern about an identifiable image, contact info@ibizarocks.com. We will stop consent-based future use and remove material from channels we control where required. We may be unable to remove copies independently shared by others.
Who receives your information
We share relevant information with providers supporting bookings, hotel property management systems, ticketing, payments, customer communications, advertising, website hosting, Wi-Fi and security.
Our UK-based agency, Unruled Ltd, manages marketing and customer relationship management activities under our instructions.
We also share relevant guestlist and event-ticket information with external promoters as explained above.
Providers acting as processors work under appropriate data-processing agreements. Where a provider or promoter acts as an independent controller, its own privacy information also applies to that processing.
We may disclose necessary information to professional advisers, insurers, courts and public authorities to meet legal obligations or handle legal claims.
International transfers
Our UK-based agency and some technology providers process information outside the European Economic Area, including in the United Kingdom and United States.
Where applicable, we rely on European Commission adequacy decisions. For US recipients, reliance on the EU-US Data Privacy Framework applies only where the recipient’s certification covers the transfer.
Where no adequacy decision applies, we use appropriate safeguards, such as European Commission standard contractual clauses, with additional protections where necessary.
Email info@ibizarocks.com for details of the safeguards relevant to your information or to request a copy.
How long we keep information
We retain information for the periods below, unless a legal obligation or necessary dispute-related retention requires otherwise.
| Information | Retention |
| General enquiries that do not result in a booking or purchase | 12 months after closure |
| Hotel booking, event-ticket, guestlist, attendance and cafe customer-service records outside statutory registers and accounting records | Until the booking, event, purchase or customer-service matter and associated follow-up are complete. Necessary contractual-claim records are then retained with restricted access, generally for five years from when the relevant obligation can be enforced, subject to applicable limitation periods and any interruption or extension |
| Marketing contacts | Until consent is withdrawn, or after 24 months without a booking, purchase, affirmative response or preference confirmation |
| Consent-based advertising audiences | Until advertising consent is withdrawn or the marketing inactivity limit is reached |
| Wi-Fi accounts | 30 days after last use |
| Wi-Fi connection and security logs | 30 days. Relevant incident records may be retained separately for as long as necessary to investigate the incident or address resulting legal claims |
| Selected promotional media | Up to three years after the event or photography session, reviewed annually and subject to applicable withdrawal or objection rights |
| Statutory hotel guest registers | Three years after the service ends |
| Accounting and supporting business records, including relevant cafe sales and invoice records | Generally six years after the last accounting entry, subject to other applicable obligations |
| CCTV | Maximum one month, except statutory incident evidence |
We retain consent evidence while relying on it and subsequently restrict its use for applicable legal-claims periods.
We keep minimal suppression records as necessary to respect unsubscribe choices and prevent renewed marketing.
Records needed for disputes, investigations or legal obligations may be retained with restricted access. Where Spanish law requires blocked retention, information is removed from ordinary use and destroyed when the applicable period ends.
Your rights
Subject to the applicable legal conditions, you can request access, correction, deletion, restriction or portability of your information.
You can withdraw consent at any time without affecting earlier lawful processing.
You can object to processing based on legitimate interests or a public-interest task for reasons relating to your situation. You can object to direct marketing and related profiling at any time.
Email info@ibizarocks.com or write to our address above. We may request proportionate information to verify your identity.
Requests are normally free and answered within one month. If a permitted extension is necessary, we will explain it within that month.
You can complain directly to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority, including in the EU country where you habitually live or work.
Security
We use technical and organisational safeguards appropriate to the risks and restrict access to people who need the information for their work.
Contact us if you believe a child’s personal information has been collected or used inappropriately.
Changes to this policy
We update this policy when necessary. Where required, we will inform you of material changes before they take effect and obtain fresh consent.
