Effective Date: August 28, 2026 16:28
Last updated: 30 October 2026 16:00
Gogamar Solutions S.L. ("Estada", "we", "us" or "our") makes Estada, a property-management platform for holiday-rental companies. This policy explains what personal data we process when you visit estada.io, use the Estada platform or the Estada PMS mobile app, or contact us; why we do it; how long we keep it; and how you can exercise your rights. If anything is unclear, write to us at info@estada.io.
Terms such as "personal data", "controller", "processor" and "processing" have the meaning given to them in the General Data Protection Regulation (GDPR).
The controller of the data described in this policy is:
Gogamar Solutions S.L.
Tax ID: B93889657
c/ Rosselló 439, 08025 Barcelona, Spain
Email: info@estada.io
We are the controller for the data of Visitors, Customers and Users that we need to run our business: accounts, billing, support, security and marketing.
For the data Customers store in the Platform about their Guests, owners and staff (bookings, guest registration, messages, tasks, time records and so on), the Customer is the controller and we act as its processor, under a data processing agreement and only on its instructions. That processing is governed by the Customer's own privacy policy. If you are a Guest, or a User of a Customer, please send requests about that data to the Customer; if you send them to us, we will pass them on.
When you use the Platform you enter data about other people: Users you invite, Guests, owners and suppliers. You are responsible for informing them and for having a legal basis to share their data with us. In particular, Customers who register Guests or record staff working time do so under their own legal obligations.
When a Customer connects booking channels, payment providers or other services, we receive the data they send, such as bookings and guest details from channels, and payment confirmations from payment providers. If you sign in with Google, we receive your name and email from Google.
We never see or store full card details. Card payments are handled by Stripe and Redsys, which act as independent controllers for payment data.
Estada PMS is the app for Users of Customers. There is no public sign-up: accounts are created by the Customer's administrator. In the app:
The app has no advertising and no analytics or tracking tools, and it uses no cookies. We do not track you across other companies' apps or websites.
Purpose: creating, configuring and maintaining Customer and User accounts, including sign-in and permissions.
Legal basis: performance of a contract, or steps taken at your request before entering into one (art. 6.1.b GDPR).
Retention: while the account is active. After it is closed, only what is needed to meet legal obligations or to deal with possible claims, and then it is deleted or anonymised.
Purpose: giving Customers and Users access to the Platform and its features (bookings, check-ins, messages, tasks, expenses, the time clock, notifications), and hosting the data Customers store in it as their processor.
Legal basis: performance of a contract (art. 6.1.b GDPR). For data processed on a Customer's behalf, the legal basis is the Customer's.
Retention: for as long as the Customer's contract lasts. When it ends, the Customer's data is deleted or returned to it, except where the law requires us to keep it.
Purpose: charging subscriptions, issuing invoices and keeping accounting records.
Legal basis: performance of a contract and compliance with tax and accounting obligations (art. 6.1.b and 6.1.c GDPR).
Retention: for the period required by tax and commercial law, currently six years.
Purpose: answering your questions and requests, including requests to exercise your rights.
Legal basis: performance of a contract for Customers; our legitimate interest in answering Visitors; legal obligation for data protection requests.
Retention: until the matter is resolved, and then only as long as needed to deal with possible claims.
Purpose: protecting accounts and the Platform from unauthorised access and misuse, through two-factor authentication, trusted devices, sign-in monitoring, rate limiting and error monitoring.
Legal basis: our legitimate interest in keeping the Platform and the data entrusted to us secure (art. 6.1.f GDPR).
Retention: only as long as needed for that purpose, or longer where a security incident must be investigated.
Purpose: sending news about Estada, new features and offers by email.
Legal basis: your consent, or for existing Customers our legitimate interest in telling them about similar services (art. 21 of Spanish Law 34/2002). You can unsubscribe at any time using the link in each email.
Retention: until you withdraw consent or unsubscribe. We then keep your email address only on a suppression list, so that we do not write to you again.
We do not sell personal data, and we do not use it for decisions based solely on automated processing that have legal or similarly significant effects on you.
We use service providers that process personal data on our behalf, under data processing agreements, and only to provide their service to us:
You can ask us for the current list of providers at info@estada.io.
Stripe and Redsys process card payments as independent controllers.
When a Customer connects the Platform to a booking channel (such as Airbnb or Booking.com) or to another service, we send it the data the Customer asks us to send. That provider processes it under its own privacy policy.
We also disclose data when required by law or by a court or public authority (for example, tax authorities or the police for guest registration), when necessary to protect our rights, enforce our terms or prevent fraud, and to a buyer or successor in a merger or sale of the business, under the same protections.
Some of these providers are located in, or may access data from, countries outside the European Economic Area, mainly the United States. In those cases we rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or on the Standard Contractual Clauses approved by the European Commission (art. 46.2 GDPR).
To exercise these rights, write to info@estada.io or to Gogamar Solutions S.L., c/ Rosselló 439, 08025 Barcelona, Spain. We will answer within one month. We may ask you to prove your identity.
If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos) or to the data protection authority of your country.
Our website uses cookies that are needed for it to work, such as keeping you signed in and remembering your language, and, only with your consent, cookies to measure traffic and to show relevant content or advertising. You can change your choice at any time from the cookie banner or your browser settings. See our Cookie Policy for details. The mobile app uses no cookies.
We protect personal data with encryption in transit (HTTPS/TLS) and at rest, role-based access, optional two-factor authentication, secure storage of credentials on mobile devices, and regular reviews of our systems.
Estada is a service for businesses and is not directed to children. Customers may record minors' details where the law requires it, for example in guest registration, as controllers of that data.
We may update this policy to reflect changes in our services or in the law. We will publish the new version on this page with a new date and, if the changes are significant, tell Customers by email or in the Platform.