Privacy Policy
Please read the following carefully before using Nōmae
Privacy Summary
Nōmae processes data to provide and personalize the guest experience, operate the Atlas, facilitate reservations and communications, maintain security, and improve service. When a hotel uses Nōmae to manage a stay, the hotel is typically the data controller, and Nōmae acts as a data processor, following the hotel’s instructions.
Nōmae does not sell personal data or use individually identifiable guest profiles to train general artificial intelligence models. Non-essential analytics or advertising technologies are only activated when the appropriate consent has been provided.
1. Data Controller and Scope
When Nōmae determines the purposes and means of processing, the data controller is:
DataController: Miguel Angelo Romo Rodríguez
Trade Name: Nōmae
Address: Calle de San Benito, 31, Block 2A
Privacy: legal@gonomae.com
This Policy applies to gonomae.com, app.gonomae.com, Atlas, hotel and supplier portals, forms, pre-arrival communications, business processes, support, and other digital services identified under Nōmae.
2. Allocation of Responsibilities
Nōmae acts as the data controller with respect to its own purposes, such as managing inquiries and demos, booking and billing, accounts and access, security, support, authorized communications, legal compliance, and—when there is a valid legal basis—continuity or memory functions between stays.
Nōmae acts as a data processor when a hotel provides reservation data or invites a guest to manage and personalize their stay. In such cases, the hotel determines the purposes, legal bases, and applicable retention periods, and Nōmae processes the data in accordance with the hotel’s instructions and the corresponding data processing agreement.
Experience providers are responsible for the processing they carry out to deliver their own experience, manage reservations, or fulfill their obligations. When a purpose is jointly determined with a hotel, the data subject will be informed of the applicable division of responsibilities.
3. What Data We Process and Why
In response to inquiries and demo requests, Nōmae may process data regarding identity, contact information, company, job title, and the content of the inquiry. The purpose is to respond, assess suitability, and prepare proposals. The legal basis may be the implementation of pre-contractual measures, consent, or a legitimate interest in managing relevant professional contacts.
With regard to hotels, suppliers, and professional users, Nōmae may process data related to identity, organization, role, permissions, account activity, support, managed reservations, and billing. This data is used to provide the service, operate integrations, manage support, handle reservations, and administer the contractual relationship. The legal basis is the contract, compliance with legal obligations, and the legitimate interest in the security and proper functioning of the service.
In the case of guests and stays, Nōmae may process data regarding identity and contact information, reservations and dates, travel context, pre-arrival responses, preferences, interactions with Atlas, recommendations, reservations, feedback, and usage patterns. The purpose is to invite and authenticate the guest, personalize the Journey, generate itineraries, facilitate reservations, provide support, and ensure continuity between stays when applicable. When Nōmae acts as a data processor, processing is carried out in accordance with the instructions and the legal basis determined by the hotel; when acting as a data controller, the legal basis may be the performance of the service, specific consent, or a limited legitimate interest.
For profiling and inferences, Nōmae may process stated preferences, stay context, and interactions. This data enables us to curate experiences, tailor recommendations, and provide operational insights. The legal basis will be that applicable to the specific data flow and, where required, consent.
Nōmae also processes technical data, such as IP addresses, session information, device information, browser information, usage events, access logs, errors, and security signals. This data is used for authentication, to prevent abuse, to resolve incidents, to maintain audit trails, and to measure service performance. The legal basis is the provision of the service and the legitimate interest in security; for analytics or non-essential advertising, consent will be requested when applicable.
Optional fields will be identified as such. Data regarding health, beliefs, sexual orientation, or other special categories should not be entered unless there is a genuine need, specific information, a valid legal basis, and adequate safeguards. Practical restrictions should be set out with the minimum necessary detail.
4. AI, Personalization, and Inference
Nōmae may use artificial intelligence, recommendation, and inference systems to personalize the experience, generate journey proposals, organize experiences, produce summaries, and offer contextual assistance.
Inferences are for guidance only and must be distinguished from information provided by the guest. Nōmae does not intend to make fully automated decisions that produce legal effects or similarly and significantly affect an individual without the applicable safeguards.
A complete explanation of transparency, interaction with AI, inferences, human oversight, providers, training, limitations, and agentic functions can be found on Política de IA y sistemas automatizados — Nōmae.
5. Analytics and System Improvement
Nōmae uses individually identifiable data only when necessary to provide, personalize, and protect the service; manage the stay; facilitate reservations; offer support; or comply with applicable obligations.
Nōmae does not use individually identifiable guest profiles for marketing, unauthorized self-promotion, or training general artificial intelligence models.
To compile statistics and improve its recommendation and artificial intelligence systems, Nōmae may use information that has been previously anonymized and, where possible, aggregated. Pseudonymization alone does not render data anonymous.
Third-party AI providers are not authorized to use data processed on behalf of Nōmae to train their general models. If, in the future, personal or pseudonymized information is to be used for a training purpose other than the requested service, the corresponding legal assessment will be conducted in advance, the information provided will be updated, and consent will be requested when necessary.
6. Source of the Data
Data may come directly from the data subject; from the hotel and its authorized users; from experience providers; from the use of Atlas, Wallet, communications, and links; from PMS, webhooks, and other integrations configured by the hotel; from providers necessary for payments, maps, messaging, email, flights, or infrastructure; and from professional public sources for lawful B2B prospecting. When data is not obtained directly and Nōmae acts as the data controller, it will provide the information required by Article 14 of the GDPR by the appropriate means and within the applicable timeframe.
7. Recipients, Service Providers, and International Transfers
Nōmae does not sell personal data. Data may be disclosed to hotels and authorized users in connection with their relationship with the guest; experience providers when necessary to manage a reservation; authorities when there is a legal obligation; advisors subject to confidentiality obligations; and technology providers necessary to provide the service. Depending on the activated features, the following categories of providers may be involved: cloud infrastructure, authentication, inventory and operations, maps and geocoding, messaging, email, payments, flight information, PMS, Wallet, analytics, advertising, and artificial intelligence.
Nōmae will maintain the required data processing agreements and review the actual list of subprocessors. Some third parties may act as independent data controllers for their own operations. When a transfer occurs outside the European Economic Area, Nōmae will use a mechanism valid under the GDPR, such as an adequacy decision, standard contractual clauses, and, where applicable, supplementary measures. You may request additional information at legal@gonomae.com.
8. Retention
Data will be retained only for as long as necessary for each purpose and, thereafter, for the applicable statutory retention or statute of limitations periods.
As a general rule:
unconverted inquiries: up to 12 months from the last interaction;
B2B prospecting: up to 24 months from the last relevant interaction, unless you object;
accounts and contractual relationships: for the duration of the contract and any subsequent liability periods;
commercial and tax documentation: for the applicable statutory periods;
marketing: up to the withdrawal of consent, objection, or loss of relevance;
security logs: typically up to 12 months, unless there is an incident or complaint;
stay data processed on behalf of the hotel: for the period specified by that hotel and in accordance with the data processing agreement;
cross-functional report or My Atlas: as long as the feature remains active or until consent is withdrawn or a request for deletion is made, without prejudice to legal obligations;
learning events or recommendation decisions: for the period documented for their purpose and, whenever possible, anonymized or aggregated once it is no longer necessary to identify the guest.
The minimum information necessary to verify consents, cancellations, and the exercise of rights will be retained for as long as liabilities may arise.
9. User Rights and Control
The data subject may exercise the rights of access, rectification, erasure, objection, restriction, data portability, withdrawal of consent, and, where applicable, the right not to be subject to decisions based solely on automated processing. You may write to legal@gonomae.com, indicating the right you wish to exercise and providing only the information reasonably necessary to verify your identity.
When the data pertains to a stay managed by a hotel, the request may first be directed to that hotel as the data controller. If Nōmae receives it while acting as a data processor, it will process or forward the request in accordance with the contract.
You may also file a complaint with the Spanish Data Protection Agency.
10. Communications, Cookies, Location, and Wallet
Nōmae or the hotel may send invitations, access codes, reminders, booking changes, pre-arrival messages, and support via email or WhatsApp. Operational communications are distinct from marketing, and opting out of marketing communications does not necessarily cancel the messages required to manage a stay.
The Sites use technologies necessary for authentication, security, preferences, and functionality. Analytics and advertising technologies—including Google Analytics 4 and Meta Pixel when actually deployed—will remain blocked until the appropriate consent is obtained. Continuing to browse does not imply consent. Detailed information can be found on Política de cookies — Nōmae. Location data will only be processed when necessary for a requested feature and with the appropriate permissions. The system architecture does not involve continuous background tracking nor does it use Wallet proximity as proof of presence or physical participation in an experience. Maps, routes, and times are for informational purposes only and may depend on third-party services and local conditions.
11. Security and Minors
Nōmae implements technical and organizational measures commensurate with the risk, including access controls and permissions, segregation of duties, encryption in transit, audit logs, and protective measures for integrations and infrastructure.
No system is completely invulnerable. In the event of a personal data breach, Nōmae will act in accordance with the GDPR and cooperate with the hotel when it acts as a processor. Nōmae is not designed for children under 14 to provide consent directly without the required authorization from their parents or guardians. Hotels that allow children to participate must implement the appropriate legal measures.
12. Changes and Contact
We may update this Policy due to legal, technical, operational, or service-related changes. When a change is significant, we will provide notice through reasonable means. The current version will always display its update date. For inquiries regarding privacy, rights, service providers, or data transfers: legal@gonomae.com.
