Privacy policy

Parte-Listo converts traveller lists in CSV, XLS or XLSX format into the SES.Hospedajes bulk-upload XML file (partes de viajeros). You download the XML and upload it to SES.Hospedajes yourself; Parte-Listo does not send any data to SES.Hospedajes or to any authority.

Traveller data is processed in memory only, for preview and export: it is not written to the database or to files and is not sent to third parties. We do not use artificial intelligence to process traveller data.

The application runs on Hetzner servers located in Nuremberg, Germany.

Radom UG (haftungsbeschränkt), Telemannstr. 2, 60323 Frankfurt am Main, Germany. Managing director: Arber Lamce. Email: support@parte-listo.es.

Radom UG (haftungsbeschränkt) is the controller for account, contact and billing data, server logs and usage statistics. For traveller data, see the next section.

When you convert a traveller list, you (the owner or operator of the establishment) are the controller of that data and Radom UG (haftungsbeschränkt) acts as processor under Art. 28 GDPR. We only process that data to provide the conversion service to you.

Traveller data is read into server memory to generate the preview and the XML. It is not written to the database or to files and is not sent to third parties.

You can request the data processing agreement by email to support@parte-listo.es. It is currently available in English; a Spanish version is in preparation.

If you are a traveller and want to exercise your rights regarding data submitted by an accommodation provider, please contact that accommodation provider, which is the controller.

To enforce the free limit (without an account, 1 traveller every 24 hours; with a free account, 5 travellers every 24 hours) we store counters in Redis on our own server, keyed by your IP address and by a random session ID (cookie parte_listo_guest_session).

These counters are deleted automatically after 25 hours.

If you create an account, we process your email address, your name (if you provide it), your password (stored only as a bcrypt hash, never in plain text), the establishment data you enter (name, SES.Hospedajes establishment code and address) and your sign-in sessions.

We keep this data while the account exists. We delete it when you ask us to or when you delete the account, unless the law requires us to keep it: if invoices are ever issued, German commercial and tax law requires them to be kept for up to 10 years.

If you have an account, we keep a history of your exports with the following metadata: date, file name and size, checksum, detected format, number of travellers, validation result and establishment. The history does not contain traveller data.

The history is kept while the account exists. You can ask us to delete it by writing to support@parte-listo.es.

If you write to support@parte-listo.es or use the contact form, we process the data you provide (for example, your email address and the content of your message) in order to reply.

Contact form messages are delivered to us by email via Google (Gmail/Google Workspace). Account emails, such as password reset emails, are also sent via Google, from the address support@konverter-pro.de, which belongs to another Radom UG service.

Our web server (nginx) logs the full IP address, the requested URL, the user agent (browser) and the status code for each request. We use these logs for service security and abuse prevention. They are kept for 14 days (daily rotation) and then deleted.

The application does not log IP addresses or traveller data in its own logs, which rotate by size.

Only if you accept "Statistics" in the cookie banner do we load Umami, a statistics tool that we host ourselves on the same Hetzner infrastructure (the script is served from analytics.konverter-pro.de). Umami does not use cookies or local storage.

Umami records the page URL, the referrer, the browser, the operating system, the device type, the screen size, the language and the country or region derived from the IP address. Umami does not store the IP address.

With the same consent, the home page stores in your browser's local storage which of three headline versions you saw.

Statistics are currently not deleted automatically. You can withdraw your consent at any time via "Cookie settings" in the footer and object to the processing by writing to support@parte-listo.es.

Hetzner Online GmbH (Gunzenhausen, Germany): hosting. Our servers are located in Nuremberg, Germany, and all application processing takes place there.

Google Ireland Limited (Gmail/Google Workspace): sending account emails and delivering contact form messages. Data may be transferred to the USA under the EU-US Data Privacy Framework or standard contractual clauses.

Stripe Payments Europe, Ltd. (Ireland): payment processing, only if paid plans are offered in the future and you purchase one; none can be purchased at the moment. Data may be transferred to the USA under the EU-US Data Privacy Framework or standard contractual clauses.

Art. 6(1)(b) GDPR (performance of a contract): providing the Service and managing the account, including establishment data and the export history.

Art. 6(1)(f) GDPR (legitimate interest): server logs for security, free-limit counters to prevent abuse, and answering contact requests.

Art. 6(1)(a) GDPR (consent) and Art. 22.2 LSSI-CE: Umami statistics and the headline version stored on the home page.

Art. 6(1)(c) GDPR (legal obligation): retention of invoices, if any are issued.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. To exercise them, write to support@parte-listo.es.

You can withdraw your consent at any time via "Cookie settings" in the footer, without affecting the lawfulness of processing carried out before the withdrawal.

You can also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the supervisory authority competent for Radom UG: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Wiesbaden, Germany.

We use encrypted connections (TLS) and access controls, and we store passwords only as bcrypt hashes.

We may update this policy when the Service, the infrastructure or the law changes. The current version is always published on this page.