Hosts in Spain keep the guest register for three years from the end of each stay (Real Decreto 933/2021, article 5.3). After that, there is no reason to keep it, and the GDPR asks you not to keep personal data longer than you need it. In between, the register is what lets you answer "was this stay reported?" in minutes instead of an afternoon.
This article is practical guidance, not legal advice.
What to keep for each stay
A useful record per stay shows:
- the property, the dates and the number of guests;
- the guests' details as you recorded them;
- that the booking communication and the traveller communication were sent to SES.Hospedajes, and when;
- what SES answered for each: accepted or rejected, and any reference it returned;
- anything you did by hand, such as a communication you entered in the portal yourself or one you cancelled and resent.
The decree asks you to communicate bookings and guests and to keep the register (articles 5 and 6). The SES result is what turns "I think we sent it" into something you can show.
Answering "was this stay reported?"
Requests come from different places: a property owner checking your work, a co-host, or an authority. Whoever asks, the steps are the same:
- Ask which property and which period the question is about.
- List the stays for that property and period.
- For each stay, check that both communications were accepted. If one is open, fix it before you reply rather than explaining it afterwards; see what to do with a rejected communication.
- Share a summary: dates, communication states and SES references.
- Note what you shared, with whom and when.
What not to hand over
- Do not send guest lists or passport copies to someone who only needs to know whether stays were reported. The summary in step 4 answers that question without personal data.
- Share guests' personal details only when a competent authority asks for them under a legal basis. If you are unsure whether a request is legitimate, ask the requester which rule they rely on.
- Share the smallest period and the fewest properties that answer the question.
Deleting on time
Three years after a stay ends, delete its guest details. In practice:
- Once a month, find stays that ended more than three years ago.
- Delete their guest details from your register, spreadsheets and email.
- Keep a short note that you deleted them and when, without the personal data itself.
Example
Example data. The owner of "Ruzafa Loft 3B" asks whether October's stays were all reported. You list the eleven stays from 1 to 31 October. Ten have both communications accepted; one has its booking communication rejected because the booking date was missing. You add the date, resend, and once it is accepted you send the owner a table of dates, states and SES references. It contains no guest names or document numbers.
Keeping the record without extra work
A spreadsheet works if you fill it in every time. Guest registration software such as Claveo keeps the history of every communication on each booking and can delete guest data after the retention period you set. See an example booking.
In short
- Keep the guest register three years after each stay, then delete it.
- Keep SES's result for both communications of every stay.
- Answer requests with a summary, not with guest data.
- Note what you shared, and delete on a fixed monthly routine.