mellom

Mellom products

Mellom HostYour booking website, built to measureAvailable Mellom GuestOnline check-in and SES.Hospedajes registrationAvailable Mellom InvoiceInvoices for any freelancer or businessSoon

Legal

Privacy

Last updated: 17 October 2026

What personal data we process at Mellom, what for and for how long. It applies to mellom.es and to the Mellom Guest, Mellom Host and Mellom Invoice services.

Who is the controller

Owner
Irene de Quevedo Rogado
Tax ID (NIF)
70938317S
Address
Calle Mayor, 69, 37710 Candelario (Salamanca)
Email
hola@mellom.es

Our role depends on whose data it is:

  • People who visit this website or write to us, and Mellom’s customers (accommodation providers and businesses): we are the data controller.
  • Guests who check in with Mellom Guest: the controller is the property where you are staying, which is required by Royal Decree 933/2021 to register your data. Mellom is its data processor: it processes the data only on behalf of the property and under the data processing agreement (in Spanish).
  • Customers and guests of a website built with Mellom Host: the controller is the property that owns that website, which has its own privacy policy. Mellom develops and maintains it as a data processor, under the contract with that property.

What data we process and what for

Forms on this website (contact, Mellom Host quote, access to Mellom Guest and the Mellom Invoice waiting list): your name, your email, the name of your business if you give it and whatever you tell us. We use them only to reply, prepare your quote or let you know when the service is available. The basis is your own request (art. 6.1.b GDPR, steps prior to a contract) or our legitimate interest in answering your query (art. 6.1.f GDPR). We do not add you to any newsletter.

Mellom Guest account: email, password (only its hash, with bcrypt), name and address of the property, phone number and SES.Hospedajes credentials (encrypted). We use them to provide the service the property contracts (art. 6.1.b GDPR) and to alert it to anything that needs attention, such as a rejected report.

Guests (Mellom Guest): the traveller report data required by Royal Decree 933/2021 (first name, surnames, document, date of birth, nationality, address, contact details, dates of the stay and signature). The property collects them through Mellom to comply with that legal obligation (art. 6.1.c GDPR) and they are sent to SES.Hospedajes, run by the Spanish Ministry of the Interior. If the property switches it on, Mellom also reports each booking there, with any change or cancellation, as the same decree requires: the lead guest’s name and surnames, their phone and email where available, the dates and the number of guests. Along with the signature we keep its date and a pseudonymised fingerprint of the IP address and the browser, as proof of who signed.

Mellom Host customers: the contact and billing details of whoever contracts the website, to provide the service and invoice it (art. 6.1.b and 6.1.c GDPR). We process the bookings, payments and guest data of that website only on behalf of the property.

Technical logs: like any web server, ours records the IP address, date, requested page and browser of each visit. They serve to keep the service secure and running (art. 6.1.f GDPR). We do not use them to identify you or to build profiles.

What we do not keep: the photo of the identity document. It is read on the guest’s own phone and never reaches our server: only the data the guest confirms is sent.

For how long

  • Traveller report data, 3 years from the end of the stay, as required by Royal Decree 933/2021. After that it is deleted automatically.
  • Account data, for as long as the account exists. When it is closed we delete it, except for what the law requires us to keep (invoices, for example).
  • Contact messages and quote requests, for as long as it takes to deal with them.
  • The waiting list, until the service is available or you ask us to remove you.
  • Technical logs are rotated automatically.

Who we share it with

  • Spanish Ministry of the Interior (SES.Hospedajes): the traveller report and, if the property switches it on, the booking report, by legal mandate and on behalf of the property.
  • Hetzner Online GmbH: server and database. Germany (EU).
  • Cloudflare, Inc.: the network that delivers the website and protects it against attacks; traffic passes through it, encrypted, before reaching our server. United States and its global network, under standard contractual clauses.
  • Resend: email delivery. United States, under standard contractual clauses.
  • If a property enables it, its WhatsApp or SMS notices go out through its own Meta or Twilio account.
  • We never sell data or use it for advertising.

Your rights

You can request access, rectification, erasure, objection, restriction and portability by writing to hola@mellom.es. If you are a guest, contact the property; if you write to us, we will pass it on. Bear in mind that the traveller report cannot be deleted before the 3 years set by law.

If you believe we are not handling your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).

Security

All traffic is encrypted with TLS. SES.Hospedajes credentials are encrypted with AES-256-GCM, and passwords are never stored in plain text. The server and the database are in the European Union.

Cookies

This website does not use analytics or advertising cookies. The Mellom Guest panel only uses technical cookies, needed to log in, and the network that protects us (Cloudflare) may set a technical security cookie. The guest check-in and the getting-started guide keep temporary data in the browser itself so progress is not lost; they are not cookies and are not used to track you. That is why we do not ask for consent.

If this policy changes in a relevant way, we will notify customers with an account by email.

This English version is a courtesy translation. If there is any discrepancy, the Spanish version prevails.