Monday evening. A friendly message from Lanzarote. "Hello! 👋 To ensure your arrival goes smoothly, you must complete the online check-in in the HOOMVIP app. Due to local regulations, this registration is mandatory."
Wonderful. Welcome to your holiday. First item on the agenda: another form. Who is HOOMVIP? Nowhere in the listing I booked. I click the link, and Airbnb itself warns me: "You are leaving Airbnb. Make sure you trust the source before continuing." So I am leaving the company I booked with in order to do the check-in that is the condition for entering the apartment I paid for through Airbnb.
That alone is absurd. It gets better.
Tuesday morning, I sit down with my Swiss ID and my phone. The scanner won't read the code on the back. Manual entry: rejected. Again: rejected. I send photos of my ID through the Airbnb chat. The reply, from a staff member named Gina: "For security and data protection reasons, we cannot complete the check-in using JPG images of your ID sent by message."
Read that sentence again. A photo of my ID over Airbnb's encrypted chat is too insecure. Uploading the same document plus my face to a third-party app I'd never heard of three days earlier — that's secure. I ask whether I can simply show the card at the door, as in any hotel. No. The lock won't open without the form. I cancel. Airbnb refunds 50 percent at first. For an apartment I never set foot in.
So much for the anecdote. Now the substance — and it is bigger than I thought.
On Airbnb the host appears as "Sarah Y Andrés" — friendly first names, a small profile picture. Behind it stands Country Villas Lanzarote, a holiday-rental brand based in Mácher. The legal entity behind it is GESTUR MARAVILLA, S.L.U. (tax ID B76202332), founded in 2014, registered office Camino Los Olivos 76, Mácher. Through its own website the company manages 53 properties; on Airbnb, under the profile "Sarah Y Andrés" (host ID 133523114), there are around 45 active listings — up 350 percent in the past year (source: Airbtics, May 2026).
And here it becomes a matter of public interest: the automated access system my check-in failed on is no private side-project. At the foot of the Country Villas website it states plainly — the project "LanzaLock — Acceso Automatizado en Alojamientos" (file number DUM-030000-2023-578) was financed under the Spanish funding programme "Última Milla" for the digitalisation of tourism businesses. That programme is part of the Plan de Recuperación, Transformación y Resiliencia — that is, financed from EU money under the Next Generation EU fund. The Spanish tourism ministry's public register confirms it: the recipient of the funding is GESTUR MARAVILLA, S.L.U.
In other words: an access system funded with European taxpayers' money locked a traveller out at the door because it could not read his valid Swiss ID — and the operator offered no alternative.
And this is exactly where the design flaw lies. Switzerland is not part of the EU. The Swiss identity card is a fully valid travel document throughout Europe — but it does not follow the same templates as the standard EU documents these scanner systems are trained on. Anyone arriving with a Swiss, British, or other non-EU European ID is, for precisely this reason, at heightened risk of the automation failing. A system with no human fallback at the door is a system that structurally disadvantages these travellers.
That an alternative exists is not my opinion. It is the software provider's own statement. Asked by CITA News, HOOMVIP replied within hours, plainly and clearly: "Hoomvip acts as a data processor, NOT AS THE DATA CONTROLLER. It is the responsibility of the accommodation owner to comply with the GDPR principles." And, asked what happens when the scanner cannot read an ID: "Guest can fulfil a form and the owner may check the identity at the guest's arrival."
So the override exists. Country Villas Lanzarote could have checked me in at the door with my passport. It was a choice. They did not make it.
Country Villas Lanzarote, the company behind the friendly pair of first names, is no small private individual. Based in Mácher, founded in 2014, a five-person team, its own website, parallel listings on Booking, Vrbo, Expedia. By press time Sarah and Andrés had left two detailed inquiries from CITA News unanswered — including the question of whether the procedure is the same across all 45 apartments. As no denial came, it must be assumed the standardised system is applied identically everywhere. A professional property manager running uniform, state-funded software does not operate 45 different check-in procedures.
Spanish law is also on the guest's side. The Spanish data protection agency AEPD clarified on 17 June 2025: to comply with the guest-registration law (Real Decreto 933/2021), visual inspection of the physical ID at the door is sufficient. Operators may not require a copy or scan — that breaches the GDPR's data-minimisation principle. One hotel was already fined 30,000 euros for it.
What did the listing I booked actually say? The only passage about check-in reads: "Once you confirm your booking, we will ask you to complete an online check-in through our app… you will receive a personal access code for the electronic lock." No mention of HOOMVIP. No mention of biometric processing. No mention that the form is mandatory. No mention that visual verification at the door will be refused. None of what the GDPR requires to be communicated before personal data is collected.
In parallel with this article, CITA News has filed a formal complaint with the AEPD.
What I would have walked into at the door is the new architecture of the Spanish short-stay business. The guest sees Airbnb. Behind Airbnb sits Avantio, a Valencia software company. Behind Avantio sits HOOMVIP, which handles the keys, the form, and the biometric scan, and sends the data to the Ministry of the Interior. You book with one company. Four end up handling your data. You chose one of them.
And Airbnb? After three written escalations, a senior supervisor named Laura granted the full refund — with one remarkable phrase: "As a one-time exception." A one-time exception. Not the application of its own Rebooking and Refund Policy, which treats a host-caused failure to check in as a Travel Issue qualifying for a full refund. An exception — for the guest who escalates three times.
Laura's letter defends the practice with the claim that "the host did disclose the registration requirement within the listing description." The listing text quoted above refutes this. Airbnb takes its commission on every one of those 45 bookings, creates the trust that makes the bookings possible — and leaves the guest at the door to an app it has not certified, and an override the host does not use.
A brand when you book. An intermediary when you pay. That is not what the commission is for.
What you can do before you book
Check the operator. If the listing runs under "Sarah Y Andrés" (host ID 133523114) or contains the name "Country Villas Lanzarote", you know what check-in procedure awaits you.
Read the check-in section closely. "Online check-in", "digital key", "our app" are code words for a third-party procedure with ID scan and possible biometric verification.
Know your rights. On 17 June 2025 the AEPD clarified: visual inspection of the physical ID at the door is sufficient. Operators may not require a copy or scan. You can insist on visual verification — even when the app fails.
If it all goes wrong: complaints go to the AEPD (sede.aepd.gob.es), to the Canary Islands consumer authority (Dirección General de Consumo), or via the EU online dispute resolution platform. Escalate in writing, with a deadline and a date. Under Article 20 of the EU Digital Services Act, Airbnb is obliged to provide an effective internal complaints system.
CITA News asked Country Villas Lanzarote / GESTUR MARAVILLA S.L.U., Airbnb, Avantio and HOOMVIP for comment. HOOMVIP and Airbnb responded; their statements are quoted in the text. Country Villas Lanzarote had not responded by press time. A formal complaint against the company has been filed with the Spanish data protection agency AEPD. This article will be updated as further statements arrive.