Privacy Policy — SES Peregrino

This Privacy Policy describes how personal data is collected, processed, and protected through the SES Peregrino mobile application, in compliance with the GDPR (EU Regulation 2016/679) and Spain's LOPDGDD (Organic Law 3/2018).

1. Data Controller and Wise Pilgrim's Role

1.1. Data Controller for guest data: The accommodation provider (you) using the Application is the sole controller of guest personal data. You are responsible for: the lawfulness of data collection, providing guests with privacy information before or at the point of data collection (GDPR Articles 13 and/or 14 as applicable), responding to data subject rights requests, reporting data breaches to the AEPD, and complying with Royal Decree 933/2021 retention requirements.

1.2. Wise Pilgrim's Role — Guest Data: Wise Pilgrim SL (Galicia, Spain) provides encrypted cloud storage infrastructure for guest data. All guest data is encrypted on your device before transmission using zero-knowledge encryption (see Section 4). Wise Pilgrim does not possess your encryption key, cannot access or read guest data in decrypted form, and does not determine the purposes or means of processing guest personal data. Wise Pilgrim is not a Data Processor for guest data within the meaning of GDPR Article 4(8). Wise Pilgrim's role is limited to providing a secure, encrypted storage service.

1.3. Wise Pilgrim as Data Processor — Operational Data: For operational metadata (submission logs, timestamps, API responses, technical logs), Wise Pilgrim acts as Data Processor on your behalf. This processing is governed by a separate Data Processing Agreement (DPA), which forms part of the Terms and Conditions.

1.4. Wise Pilgrim as Data Controller — Property Listing Data: For property listing information you provide for publication (property name, address, contact details, services, pricing), Wise Pilgrim acts as an independent Data Controller. You provide this data with the explicit understanding and consent that it will be published in Wise Pilgrim's applications, guidebooks, websites, and related media.

1.5. Wise Pilgrim as Data Controller — Saved Beds: In the optional "Saved beds" service (bed requests that pilgrims send from All Caminos, Wise Pilgrim's app for pilgrims), Wise Pilgrim acts as an independent Data Controller, both for pilgrims' data and for data on how each property keeps its confirmed beds, because Wise Pilgrim sets the rules of the service (trust score, record, badge and deletion periods). Here Wise Pilgrim does not act as the owner's Data Processor. When the owner receives the name the group will check in under, or a WhatsApp message from a pilgrim, the owner is responsible for how they use that data. This section and Sections 2.5, 3.6, 5.4, 6.6 and 7 also inform pilgrims.

Contact: privacy@wisepilgrim.com

2. Categories of Personal Data

2.1. Guest Data (encrypted, controller: accommodation provider). This includes all data submitted to the Ministry of Interior (MIR) via the SES.HOSPEDAJES system, plus check-in and payment details:

• Identity: full name, identity document type and number (NIF/NIE/passport), date of birth, sex, nationality
• Contact: postal address, phone number, email address
• Travel companions: names, relationships, dates of birth (including minors)
• Guest signature
• Check-in and check-out details
• Payment information
• Scanned identity document data

All guest data is encrypted on your device with your personal encryption key before being stored on Wise Pilgrim's cloud infrastructure. Wise Pilgrim cannot access this data in decrypted form.

2.2. Operational Metadata (processor: Wise Pilgrim, on your behalf):

• Submission logs: date/time of SES.HOSPEDAJES submissions, submission status (success/failure), API responses from the Ministry of Interior
• Technical logs: timestamps, error logs, app performance data

2.3. Property Listing Data (controller: Wise Pilgrim, with your consent):

• Property name, address, and location
• Contact details (phone, email, website)
• Services offered and pricing
• Property descriptions and photographs you provide

This data is published in Wise Pilgrim's applications and guides and is not treated as confidential. Providing property listing data is entirely optional and is not required to use the core compliance features of the Application.

2.4. Owner Account Data:

• Email address used for registration
• Session identifiers (encrypted secure tokens)
• Password (salted hash, never stored or transmitted in plain text)

2.5. Saved beds data (controller: Wise Pilgrim):

About the pilgrim (no account, no email, no phone number):

• Pseudonymous identifier (no name, email or phone; a random code tied to the device), created for their phone when they use Saved beds in All Caminos, without sign-up
• Device check: the system (iOS or Android), a SHA-256 hash of the Apple App Attest key or of the Google Play Integrity install identity, and the date the phone passed the check. It lets the record follow the phone and prevents abuse. A hardware identifier is never stored in clear
• Pilgrim code: a short random code (for example "P-7K3QM") that only the pilgrim and Wise Pilgrim see, to ask for a review without giving a name
• Trust score: number of stays, no-shows and late cancellations, and Wise Pilgrim's corrections with their reason
• Each bed request: property, night, number of people (1 to 8), room types requested, room confirmed, status, the time of each change and its coded reason, and that bed's check-in deadline and free-cancellation time
• Text: the name the group will check in under (up to 80 characters) and the optional message to the property (up to 300 characters). The app rejects phone numbers in both
• "I'm here": the time the pilgrim tapped it and the distance to the property worked out by their own phone, rounded up to the nearest 50 m (50, 100, 150, 200, 250 or 300 m). Never coordinates or a position
• "I was turned away" reports: the time, whether the report is checked, and the pilgrim's optional note
• Notifications: the phone's push token, the app, the system, the type (notification or, on iPhone, Live Activity) and the phone's language
• Plan backup in All Caminos: unless the pilgrim switches off "Back up my plans" (it is on by default), a copy of their plans and favourites: the route, towns, dates, nights, where they plan to stay and whether it's booked. Notes are copied only if they switch on "Back up my notes". The app also records which properties' Live Bed Count they looked at each day. The copy is linked to the same random code for their phone, never to a name, email or phone number

About the owner and their property:

• Saved beds settings: check-in deadline, free-cancellation time, response time, auto-accept, rest days, weekly summary and, if the WhatsApp introduction is switched on, the property's WhatsApp number
• Their answers to each request (confirmation, decline and its reason, proposal of another option and its note, cancellation with its reason and note, arrival, no-show and corrections), when they opened each request, and their "They never arrived" answer and account on turn-away reports
• The record worked out from the above: confirmed and cancelled beds in the last 90 days, counted turn-aways, the "Keeps its word" badge and automatic pauses of "Tonight"
• The push tokens of their devices

Saved beds does not process identity documents, the pilgrim's email or phone number, their location, or any payment data. The device check in this section applies to pilgrims' phones in All Caminos; what Section 4.8 says about the Application is unchanged.

3. Purposes and Legal Basis

3.1. Legal Obligation (GDPR Article 6.1(c)): Guest data processing is required by Royal Decree 933/2021 for guest registration with the SES.HOSPEDAJES system. The accommodation provider (as controller) processes this data to comply with Spanish law. Wise Pilgrim provides the encrypted storage infrastructure to support the 3-year retention obligation.

3.2. Contract Performance (GDPR Article 6.1(b)): Operational metadata is processed to deliver the SES Peregrino service: confirming submissions, troubleshooting errors, and providing proof of submission. Owner account data is processed for account management and authentication.

3.3. Consent and Contract Performance (GDPR Article 6.1(a) and (b)): Property listing data is processed and published based on your explicit consent, given when you provide this information through the Application with knowledge that it will appear in Wise Pilgrim's apps and guides. You may withdraw consent at any time (see Section 7).

3.4. Legitimate Interest (GDPR Article 6.1(f)): Technical and security logs (IP addresses for security monitoring, error diagnostics) are processed for the legitimate interest of maintaining the security and stability of the Application. Wise Pilgrim has assessed that this interest is not overridden by data subject rights.

3.5. Consent (GDPR Article 6.1(a)): Optional features such as marketing communications are processed only with your prior explicit consent, which may be withdrawn at any time.

3.6. Saved beds (GDPR Articles 6.1(b) and 6.1(f)):

• Performance of the service the pilgrim and the owner request by using it (Article 6.1(b)): sending, answering, confirming and cancelling bed requests, showing the property the name and message, and sending notifications.
• Legitimate interest (Article 6.1(f)): preventing abuse (beds requested and never used, pilgrims turned away at the door) through the pseudonymous trust score, properties' records, the "Keeps its word" badge, the device check, the "I'm here" check and the review of doubtful cases. Wise Pilgrim has assessed that this interest is not overridden by data subjects' rights: the score is pseudonymous (no name, email or phone; a random code tied to the device) and holds no document, and the name and text are deleted after 3 days.
• Location: the "I'm here" check is done on the pilgrim's phone, only when they tap it and with their phone's location permission. Their position is not sent to Wise Pilgrim or stored; only the time and the distance, rounded up to the nearest 50 m (50 to 300 m), are sent.
• Plan backup and demand statistics (Article 6.1(f)): the copy is used to bring the pilgrim's plans back if their phone loses them and, as totals only, to see where pilgrims will need beds. The statistics are anonymous aggregates: properties only see totals of at least 5 pilgrims, and figures shown in the app or published hide totals under 10, are rounded to the nearest 5 and are a day behind. Properties never see a plan. Switching off "Back up my plans" in the All Caminos settings deletes the copy and removes that pilgrim's plans from the totals at once; it works as an objection to this use.

4. Data Storage, Encryption, and Security

4.1. All data — encrypted guest data, operational metadata, property listings, and account data — is hosted by Supabase Inc. on Amazon Web Services servers located in the EU (AWS region eu-west-1, Ireland).

4.2. Guest Data Encryption. Guest data is encrypted on your device using AES-256-GCM (authenticated encryption) with a key derived from your password via PBKDF2-SHA256. Only the encrypted ciphertext is transmitted to and stored on Wise Pilgrim's cloud infrastructure. Wise Pilgrim does not possess, store, or have access to your encryption key at any time.

4.3. CRITICAL: Data Loss from Key Loss. Because of the zero-knowledge architecture, if you lose both your password and your recovery code, your encrypted guest data is permanently and irreversibly unrecoverable. Wise Pilgrim cannot recover, restore, or decrypt this data under any circumstances. This applies regardless of the reason — forgotten password, lost recovery code, device damage, or any other cause. This is the inherent trade-off of zero-knowledge encryption: maximum privacy (no one, including Wise Pilgrim, can access your data) in exchange for the risk of permanent loss if you lose your credentials.

4.4. SES.HOSPEDAJES credentials are stored exclusively in your device's secure keychain (iOS Keychain or Android Keystore) and are never transmitted to Wise Pilgrim servers.

4.5. Scanned identity document data is automatically deleted from your device within 24 hours or immediately after successful SES submission, whichever occurs first.

4.6. Security Measures:

• Encryption at rest: AES-256-GCM for all guest data
• Encryption in transit: HTTPS/TLS for all network communications
• Key derivation: PBKDF2-SHA256 to protect against brute-force attacks
• Screenshot protection: Personal information screens are protected against screenshots
• Input validation: All data validated against schemas before processing
• Access controls: Wise Pilgrim employees cannot access encrypted guest data
• Infrastructure security: Supabase SOC 2 Type II certified; AWS ISO 27001 certified

4.7. Password Change Re-Encryption. When you change your password, the Application must re-encrypt all stored guest data with your new password-derived key. Records are processed in batches to minimise the volume of data held in decrypted form on your device at any given time. During this process: (a) a temporary backup copy of your encrypted data (under your old key) is retained on Wise Pilgrim's servers to enable recovery if the process is interrupted; (b) only the current batch of guest data is temporarily present in decrypted form in your device's memory during re-encryption; (c) upon your in-app confirmation of successful completion, Wise Pilgrim will separately verify and confirm with you before deleting the temporary backup copy. The backup is not deleted automatically — it is retained until Wise Pilgrim has confirmed successful completion with you and manually initiates deletion. This manual verification may be replaced with an automated process in the future if the protocol demonstrates consistent reliability at scale. This temporary backup is stored under the same encryption and security conditions as your original data. No duplicate copies are retained beyond what is necessary for process integrity, verification, and data minimisation.

4.8. The Application does not use third-party analytics services, advertising trackers, or device fingerprinting. Crash reporting and app performance data may be collected by the device operating system (Apple Crash Reporter, Google Play Vitals) in accordance with your device settings. Wise Pilgrim does not receive personally identifiable information from these operating system services.

5. Recipients and Transfers

5.1. Ministry of Interior (MIR): Guest data is submitted to SES.HOSPEDAJES by you (the data controller) through the Application. Wise Pilgrim facilitates this submission but does not independently transmit guest data to the government.

5.2. Supabase Inc.: All data is hosted on Supabase Inc.'s infrastructure (AWS eu-west-1, Ireland). Supabase Inc. is a US-headquartered company. Wise Pilgrim has Standard Contractual Clauses (SCCs) in place with Supabase Inc. to ensure GDPR-compliant data transfers, along with supplementary technical measures including encryption of all guest data with keys Supabase cannot access. Supabase's sub-processors (including Amazon Web Services) are documented in the DPA and available upon request.

5.3. Wise Pilgrim does not sell, rent, or share personal data with third parties for commercial purposes. Property listing data is published in Wise Pilgrim's own applications and guides as described in Section 2.3.

5.4. Saved beds:

• The property a pilgrim asks for a bed sees the shortened name (first name and initial of the surname) before confirming and the full name afterwards, the number of people, the room types, the message and the trust score (level, points, stays and no-shows). It never sees the pseudonymous identifier, the pilgrim code, Wise Pilgrim's corrections or device data.
• Pilgrims see, in All Caminos, about a property: if it has confirmed at least 5 beds in the last 90 days, how many ended cancelled by the property or with a turn-away report; and the "Keeps its word" badge, if it has it.
• Apple (Apple Push Notification service and App Attest) and Google (Firebase Cloud Messaging and Play Integrity) receive push tokens and notification content, and take part in the device check. Saved beds notifications carry only the number of people or the property's name, never the pilgrim's name. Apple and Google are US-headquartered companies.
• WhatsApp: if the property switches on the WhatsApp introduction and the pilgrim chooses to write, the conversation goes directly from the pilgrim to the property over WhatsApp (Meta). Wise Pilgrim does not receive the pilgrim's number or see the conversation.

6. Retention Periods

6.1. Encrypted guest data: Retained for a maximum of 3 years from the date of guest check-in, as required by Royal Decree 933/2021, then automatically purged from Wise Pilgrim's servers. You may also delete guest data from your device at any time, though you acknowledge this may affect your compliance with the retention obligation.

6.2. Scanned identity document data: Deleted from your device within 24 hours or upon successful SES submission.

6.3. Operational metadata: Retained while your account is active; erased automatically 30 days after you ask us to delete your account, or after Wise Pilgrim closes it if that comes first. SES submission references linked to guest records still within their retention period are kept with those records (see Section 6.5).

6.4. Property listing data: Retained and published while your account is active. Removed from digital publications within 30 days of your request or account closure. Previously published print editions issued before the removal request may continue to display the listing. Wise Pilgrim will not include the listing in new print editions published after the removal date.

6.5. Owner account data: Retained while your account is active. Your personal data (your name, contact and tax details, address and sign-in details) is erased automatically 30 days after you ask us to delete your account, in the app or by writing to privacy@wisepilgrim.com, or 30 days after Wise Pilgrim closes the account under the Terms, whichever comes first. Your login is blocked as soon as you make the request or the account is closed; within those 30 days you can cancel a deletion request by writing to privacy@wisepilgrim.com, and the account is restored. Three things are kept: (a) anonymous booking and availability history (Saved beds and Live Bed Count), for statistics, with no link to you or your account, as explained in Section 6.6; (b) the encrypted guest register, until its 3-year legal period ends (Section 6.1): while any guest record is still within that period, only what the register needs is kept (the encrypted records, the key data to open them, the SES submission references and an account entry with no name or email that nobody can sign in to), and it is deleted together with the last guest record; (c) the record of which legal documents you accepted (document, version and date, without your name or email), for 3 years from the erasure as evidence, then deleted. Example: if you ask us to delete your account at midday on 15 October 2026, your personal data is erased in the early hours of 15 November 2026, and the acceptance record in the early hours of 15 November 2029.

6.6. Saved beds:

• The group's name, the pilgrim's message, the property's note on a proposal, notes on turn-away reports and written reasons are deleted automatically 3 days after the night, by a daily job. Example: those for the night of 10 October are deleted in the early hours of 14 October.
• The pilgrim's trust score and history (their requests, their saved plan and favourites, and Wise Pilgrim's corrections) are one record. It is kept while the pilgrim uses the service and deleted as a whole, automatically, after 3 years without activity. Activity is anything the pilgrim's app sends to our server: a bed request, a report about a property, a backup of the plan or favourites, a look at live bed availability, a sign-in, registering for notifications, or the device check when opening Saved beds. A request for a future night counts until that night. Example: if the last activity was at 18:00 on 10 October 2026, the record is deleted in the early hours of 11 October 2029.
• The request without name or text (property, night, number of people, statuses and times) is also part of the property's record. When the pilgrim's record is deleted, the request keeps no link to the pilgrim; while the pilgrim still has a record, the request also stays in their history. Booking records without names are kept long-term for statistics (how often a property offered beds, how many were saved). When the owner's account is erased (30 days after the deletion request, Section 6.5), they are anonymised: the property's record keeps only the public listing details (name, town and location), its beds and rooms and its settings; the owner's name, contact details, tax details and street address are removed, and so is any link to the owner's account. Example: if the owner asked to delete the account at midday on 15 October 2026, from the early hours of 15 November 2026 its bookings remain only as anonymous lines of a property with no owner. What pilgrims see about a property is worked out from the last 90 days only; the pilgrim's score counts all their stays.
• Push tokens are kept until the app unregisters them (for example, when signing out) or Apple or Google report that they are no longer valid.
• The IP address is not stored: to limit abuse, a keyed hash (HMAC) is stored and deleted within a day.

7. Your Rights

Under GDPR Articles 15-22, you may exercise the following rights:

For guest data: You are the controller. Guests should contact your accommodation directly to exercise their rights (access, rectification, erasure, restriction, portability, objection). You are responsible for responding within 30 days. Because guest data is encrypted with your key, Wise Pilgrim cannot assist with these requests directly — only you can access the data.

For property listing data: You may update, correct, or request removal of your property listing at any time by contacting privacy@wisepilgrim.com or through the Application settings.

For owner account and operational data: Contact privacy@wisepilgrim.com. Wise Pilgrim will respond within 30 days.

Right to erasure limitations: The right to erasure (GDPR Article 17) is limited where guest data must be retained to comply with Royal Decree 933/2021 (legal obligation, Article 17(3)(b)). Guests cannot demand erasure during the legally mandated 3-year retention period. After this period, data is automatically deleted.

For Saved beds data: Wise Pilgrim is the controller. There is no account. A pilgrim can delete their record themselves in All Caminos (Settings, "Delete my pilgrim record"): the whole record is deleted at once (trust score and history, Wise Pilgrim's corrections, the plan and favourites backup, notes, the link with an Apple or Google account, notification tokens and the pilgrim code), and their past requests stay only as part of the property's record, with no link to the pilgrim (Section 6.6). While they have a request pending or a confirmed bed for that night or later, they cancel it first. One exception, for fraud prevention on the basis of our legitimate interest (Article 6(1)(f) GDPR): if the trust score is below 50 when the record is deleted, we keep only the phone's pseudonymous device identifier (a scrambled code, not a hardware identifier) and that score, for 3 years, so that a new record on the same phone starts at that score instead of 50 and a low score cannot be wiped out by deleting it. Nothing else is kept, and with a score of 50 or more nothing at all. Example: a record deleted on 15 October 2026 with a score of 30 → a new record on that phone starts at 30 until 15 October 2029, and at 50 after that. For any other right, or if they cannot use the app, a pilgrim writes to privacy@wisepilgrim.com with their pilgrim code (in All Caminos, under "How trust works"): this lets us find their record without needing their name. If they think a no-show or a late cancellation is unfair, they can ask for a review with the same code. Owners can write to privacy@wisepilgrim.com about their record.

You may file a complaint with Spain's Data Protection Authority (Agencia Española de Protección de Datos, AEPD, www.aepd.es).

8. Controller Responsibilities — Important Notice for Property Owners

As the data controller for guest data, you are legally responsible for:

a) Informing guests of their privacy rights. Before or at the time you collect guest data, you must provide guests with the information required by GDPR Articles 13 and/or 14 as applicable: who controls their data (you), why it is collected (Royal Decree 933/2021 compliance), who receives it (Ministry of Interior via SES.HOSPEDAJES), how long it is retained (up to 3 years), and how they can exercise their rights (by contacting your accommodation). Wise Pilgrim provides a guest privacy notice template within the Application that you may use or adapt.

b) Responding to data subject requests. If a guest requests access to, rectification of, or erasure of their data, you must respond within 30 days. Because data is encrypted with your key, only you can fulfill these requests.

c) Reporting data breaches. If guest data is compromised (for example, through device theft, unauthorized access, or loss of your encryption key to an unauthorized person), you must assess the risk and, if required, notify the AEPD within 72 hours and affected guests without undue delay.

d) Safeguarding your encryption key and recovery code. Loss of these credentials means permanent loss of access to guest data, which may impair your ability to fulfill legal obligations.

e) Using Saved beds data only for the stay. The group's name and the messages you receive through Saved beds are for managing that stay. If you switch on the WhatsApp introduction, the conversations and numbers you receive over WhatsApp are your responsibility.

9. Minors

The Application may process data of minors only as travel companions of adult guests, as required by Royal Decree 933/2021. This data is provided by the accompanying adult guest or the accommodation provider. Minors under 14 cannot use the Application directly. The accommodation provider (as controller) is responsible for ensuring lawful processing of minors' data.

10. Automated Decision-Making

The Application does not use automated decision-making or profiling that produces legal effects on data subjects. Data validation (format checks, required field verification) is used to assist data entry but does not result in automated decisions about individuals.

Saved beds uses these automatic rules, all explained in the app: (a) auto-accept, which the owner switches on and whose minimum score the owner sets; a request not accepted this way still reaches the owner to decide; (b) the automatic pause of "Tonight" (Terms and Conditions, Article 7A.11), which is not a penalty; and (c) the automatic switch-off of Saved beds for a property after turn-aways from two trusted sources (Terms and Conditions, Article 7A.7), which only Wise Pilgrim can reverse. Any pilgrim or owner can ask for a person at Wise Pilgrim to review one of these decisions by writing to privacy@wisepilgrim.com.

11. Data Protection Impact Assessment

Wise Pilgrim maintains a Data Protection Impact Assessment (DPIA) in accordance with GDPR Article 35, evaluating risks associated with processing identity documents, minors' data, zero-knowledge encrypted storage, and legal data retention. The DPIA includes a formal assessment under GDPR Recital 26 of the "means reasonably likely to be used" for re-identification of encrypted guest data, and a cryptographic assessment aligned with the AEPD's Encryption Guide for SMEs (December 2025). The DPIA is reviewed and updated periodically, including reassessment of the cryptographic architecture against current best practices and post-quantum cryptography developments. The DPIA concluded that the zero-knowledge encryption architecture, automatic retention limits, and local-device processing provide adequate safeguards to mitigate identified risks. A summary of the DPIA is available upon request by contacting privacy@wisepilgrim.com.

Wise Pilgrim also keeps a data protection impact assessment and a legitimate interest assessment for the Saved beds trust score, both available on request from privacy@wisepilgrim.com.

12. Changes

Substantial changes to this Privacy Policy will be communicated through the Application and by email at least 30 days before taking effect.

13. Contact

Wise Pilgrim SL
Galicia, Spain
Privacy and data protection: privacy@wisepilgrim.com
Security issues: security@wisepilgrim.com