Español
Updates

Booking Calendar Privacy: How to Protect Guest Data in Spain

Protect guest data in your booking calendar: Google Calendar permissions, iCal links as credentials, and the Spanish check-in data rules for hosts.

Booking Calendar Privacy: How to Protect Guest Data in Spain

A booking calendar is private only if you decide who sees it, at what level of detail, and through which links. In practice that means four things: keep your Google Calendar unshared or limited to “free/busy”, mark sensitive events as private, treat every iCal URL as a password, and keep guest check-in data out of the calendar altogether. This guide walks you through each step, with the Spanish context for hosts who also have to register travelers.

TL;DR

  • A personal Google Calendar is private by default. Check that “Share publicly” is off, and share only what each person needs.
  • For cleaners, co-owners and outside managers, “See only free/busy” is the prudent level: it shows occupancy without names, notes or locations.
  • An iCal link works like a credential. Never post it publicly or paste it into chats, and replace it if it leaks.
  • Calendar privacy is not the same as check-in compliance. In Spain, the data agency says a full copy of an ID document should not be requested by default.

Table of Contents

What “booking calendar privacy” covers for a host

For a vacation rental, hotel or hostel, the calendar holds more than dates. Event titles often carry a guest’s name, a phone number, an arrival time, the number of children or a door code. Copy that into a shared calendar and every person with access can read it.

There are three separate places where a calendar can leak information:

  1. The calendar itself: who it is shared with and at what permission level.
  2. Individual events: what the title, description and location say, and whether the event is marked private.
  3. The sync links: the iCal URLs that Airbnb, Booking.com, Vrbo and others use to exchange blocked dates.

A fourth area sits next to the calendar: the personal data you collect at check-in. It is not a calendar setting, but it is where most of the legal risk lies in Spain, so we cover it below.

Step 1: Check that your Google Calendar is not public

Google states that a personal calendar is private unless you share it. A public calendar is different: it can appear in searches, sync with other apps and be subscribed to by anyone. Google offers two public levels, full details or only free/busy, according to its privacy basics page for Calendar.

To check, follow these steps on a computer:

  1. Open Google Calendar.
  2. In the left column, under “My calendars”, hover over the calendar you use for your property.
  3. Click “More” and then “Settings and sharing”.
  4. Review “Access permissions for events”.
  5. Make sure “Make available to public” is unchecked, and that no organization-wide access is enabled unless you intend it.

Do this for every calendar linked to a property. Hosts who manage several apartments often find one old calendar that was made public for a guest or a cleaner years ago and forgotten.

Step 2: Share by role, not by habit

The useful question is not whether to share, but how much. Google lets you share with specific people or groups and choose among four permission levels: free/busy only, all event details, make changes to events, and manage sharing. The same help page on sharing a calendar describes each of them.

Here is a practical way to map roles to permissions:

PersonWhat they needSuggested permission
Cleaner or laundry serviceKnow when the unit is freeSee only free/busy
Co-owner or family memberKnow if the home is occupiedSee only free/busy
Maintenance contractorGaps between staysSee only free/busy
Property manager or assistantHandle bookingsSee all event details, or make changes if they work in it daily
YouEverythingManage sharing

Only the last two rows should ever see guest names. Everyone else gets occupancy, nothing more.

Separate an operational calendar from an internal one

The safest setup uses two calendars. The first is operational: it contains only blocks of occupied dates. The second is internal: it holds tasks, owner notes and staff schedules. Google allows different calendars to be shared with different people, so you can give your cleaner free/busy on the operational one and keep the internal one to yourself.

Operational and internal calendar access compared

This also keeps names, locations and descriptions out of the view of people who have no reason to see them.

Remove access you no longer need

To stop sharing with someone, go to “Settings and sharing” for that calendar, find “Share with specific people or groups” and click “Remove” beside each address. If access is public or organization-wide, turn those options off as well. Google’s page on how to share or stop sharing a calendar confirms you can withdraw access at any time. Schedule a review each season, and always after a cleaner, assistant or manager leaves.

Step 3: Use private events for sensitive details

Open an event and set its visibility to “Private”. When a calendar is shared, Google says private events do not show their details to other users. If you never share or publish the calendar, only you can see the events, as the help page on changing event visibility explains.

Two cautions:

  • Marking an event private does not replace checking the calendar’s permissions or its iCal URLs. A public calendar can still reveal that a block exists, and apps can sync it.
  • Prefer short, neutral titles such as “Booked” or “Unit 2B occupied”. Keep names, phone numbers and access codes out of the calendar completely.

If a calendar seems to have disappeared, it may only be hidden. In the web version, look under “My calendars” or “Other calendars” in the left column and tick the box beside its name. If it is not listed, use “Settings” and “Add calendar” to find it or subscribe again. Options can vary between web, Android, iOS and managed accounts, and permissions are managed mainly from the web version, as Google’s help page indicates.

Platforms such as Booking.com, Airbnb and Vrbo exchange availability through iCal links. Booking.com explains that calendar sync uses iCal links to import and export booked or closed dates, and that you can sync your calendars across channels from the Extranet under “Rates & availability” and “Sync calendars”.

To connect Booking.com with another platform:

  1. Open the Extranet and go to “Rates & availability”, then “Sync calendars”.
  2. Add a connection and paste the iCal link from the external calendar to import it.
  3. To export, copy the Booking.com calendar link and paste it into the other platform.
  4. Repeat for each property or unit.

The same page notes some conditions: the function may require an open property, rates and availability permissions, 20 room types or fewer, one unit per type and no connectivity provider. Booking.com’s own calendar guide mentions updates every two hours.

From a privacy point of view, apply these rules:

  • Do not publish the URL on a website, forum or social post.
  • Do not paste it into chats or group messages with cleaners or friends.
  • Share it only with the platform that needs it.
  • Generate a new link or revoke the old one if you shared it by mistake.

Note that an iCal link carries dates, not rates or guest profiles, but anyone holding it can see when your property is empty. That information alone is useful to someone planning a burglary, so it is worth protecting.

Privacy does not remove the sync delay

Because iCal sync is not real time, two guests can book the same dates inside the update window. A well-protected link does not fix that. When you manage several units, need faster updates, or want prices and restrictions under one control, evaluate a tool built for synchronization instead of relying on manually pasted links. We cover how that fits with check-in below.

Step 5: Keep guest data out of the calendar

Most hosts in Spain have a second reason to care about privacy: they must collect traveler data. The Real Decreto 933/2021 requires specific data about each guest. The Spanish data protection agency (AEPD) points out that it does not automatically authorize asking for and keeping a complete copy of an ID card or passport. Its note on lodging registration says the form can be filled in online or in person with the required data.

The AEPD explains why this matters: a full copy contains extra data such as a photograph, expiry date, CAN number or parents’ names, and it can raise the risk of identity theft. It also reminds hosts of the GDPR principles: minimization, purpose limitation, limited retention, integrity and confidentiality.

For your daily routine, that means:

  • Collect only the fields the regulation requires.
  • Do not ask guests to send ID photos by WhatsApp or email.
  • Do not copy guest details into calendar events, spreadsheets or shared notes.
  • Limit who can open the dashboard where the data sits.

Keep the two ideas separate. A calendar with perfect permissions does not make your registration compliant, and a compliant registration does not make an open calendar safe.

Our perspective: calendar, check-in and registration in one flow

We see the same pattern with the hosts we work with. The calendar starts as a simple tool, then grows into a place where guest names, arrival times, phone numbers and notes pile up. Every new cleaner, co-host or assistant gets another share, and nobody removes the old ones.

Our view is that the calendar should answer one question: is the property free or occupied? Everything else belongs elsewhere. Guest data should go through a structured online check-in form that asks for the legally required fields and nothing more. That data should then be sent to SES Hospedajes without anyone retyping it into a spreadsheet or forwarding it by message. Every manual copy is another place where personal data can leak.

Our perspective: calendar, check-in and registration in one flow — overview diagram

That is how EuroCheckin is designed. The guest completes a multilingual online check-in. The platform sends the data to SES Hospedajes under Real Decreto 933/2021 and the GDPR, keeps the traveler register digital, and hosts the information on secure infrastructure within the European Union. Calendars from Airbnb, Booking.com and more than 12 other platforms are synchronized automatically, so you are not pasting iCal links into a dozen places or finding out about an overlap after it happens.

None of this replaces good habits. You still decide who gets access and review it regularly. But when the calendar holds availability and the platform holds guest data, there is much less to protect in the wrong place.

— Sofía Herrera

A quick privacy audit you can do in 20 minutes

Use this checklist once per property, then repeat every season.

  1. List every calendar connected to the property: Google, Airbnb, Booking.com, Vrbo, any other.
  2. Check public settings on each Google calendar and turn off public sharing.
  3. Review each person with access and downgrade to free/busy where possible.
  4. Remove people who no longer work with you.
  5. Search event titles for names, phone numbers, door codes and Wi-Fi passwords, and delete them.
  6. Mark remaining sensitive events as private.
  7. List every iCal link you have exported and where it is pasted. Replace any that sit in chats, emails or documents.
  8. Review your check-in process: does it ask for more than the required data? Are ID copies stored in email or phone galleries?

Common mistakes

  • Making a calendar public to “make it easier” for a cleaner.
  • Putting access codes in the event description.
  • Sharing the same iCal URL in a group chat.
  • Assuming a private event protects a public calendar.
  • Requesting a full ID copy by message “just in case”.
  • Forgetting to remove a former assistant’s access.

Automate the registration, reduce the exposure

If you manage registration by hand, you handle the most sensitive data you hold in the least controlled channels. EuroCheckin for accommodations automates guest registration, sends data to SES Hospedajes, and synchronizes your calendars, for €5 per month per accommodation, with a free trial. Hotels can look at EuroCheckin for hotels, priced at €3 per month per room. If you would rather have someone set up your access, our SES Hospedajes registration service starts from €79 one-off per accommodation.

FAQ

How do I make sure my Google Calendar is private?

Open “Settings and sharing” for the calendar on a computer and review “Access permissions for events”. Make sure public sharing is off and remove anyone you no longer want to have access. Google says a personal calendar is private by default, so you only need to check that you have not changed that.

In the Extranet, go to “Rates & availability” and “Sync calendars”, add a connection and enter the iCal link of the external calendar. To export, copy the Booking.com link and paste it into the other platform. Repeat for each unit, and remember the sync is not real time.

How do I stop sharing my Google Calendar with family?

In “Settings and sharing”, go to “Share with specific people or groups” and click “Remove” next to each address. If the calendar is public or shared across an organization, turn those options off too. If family only needs to know whether the home is occupied, switch them to free/busy instead.

How do I unhide a calendar in Google Calendar?

On the web version, tick the box next to the calendar’s name under “My calendars” or “Other calendars”. If it is not there, go to “Settings” and “Add calendar” to find it or subscribe again. Also check that it is not hidden only in your current view.

Is a private event enough to protect guest details?

No. A private event hides its details from people the calendar is shared with, but it does not replace reviewing permissions and iCal links. The safest approach is to keep guest names and codes out of the calendar entirely.

Sources

Related articles