If you build or integrate software for hospitality clients, "just add a booking system" is one of those requests that sounds simple until you look at what it actually touches: real-time inventory sync across multiple OTAs, PCI-DSS payment flows, GDPR-scoped guest data, and — if your client operates in Spain — a mandatory government API integration with real financial penalties for getting it wrong.
This post is a practical breakdown of what "booking system" means architecturally for a small/boutique hotel property, why the Spanish market has a compliance requirement most international platforms don't handle out of the box, and what we at SoftWin check before recommending build-vs-integrate for a client.
The problem, in one line
Boutique hotels (think 8–40 rooms) are usually running disconnected tools: an OTA extranet, a generic booking widget, and a PMS that doesn't talk to either — plus, since December 2024, a legal obligation to report guest data to Spain's Ministry of Interior that most of these tools were never built to handle. The result is double bookings, commission leakage to OTAs, and compliance risk that nobody notices until an inspection or a fine.
The system, architecturally
Three components, ideally sharing one data layer:
Booking engine — the guest-facing UI/UX layer. Calendar, availability, room selection, payment. Should be embeddable on the hotel's own domain (not an iframe redirect to a third-party subdomain, which kills conversion and looks untrustworthy on mobile).
PMS (property management system) — the source of truth for reservations, guest profiles, folios, and — critically for Spain — the guest registration record. This is where SES.Hospedajes reporting should be triggered from, ideally automatically on check-in/reservation confirmation.
Channel manager — syncs availability and rates across OTAs (Booking.com, Expedia, Airbnb, Google Hotel Ads) via each OTA's API or a connectivity aggregator (SiteMinder, RateGain, and similar act as this layer). This has to be near-real-time and idempotent — a delayed or dropped sync event is how a room gets sold twice.
A minimal event flow looks like this:
Guest books (web widget / OTA)
│
▼
Booking Engine / OTA API
│ (webhook / API call)
▼
PMS ──────────────┐
│ │
▼ ▼
Channel Manager SES.Hospedajes
(update inventory submission
across all OTAs) (within 24h)
The failure mode we see most often: the booking engine and channel manager are connected, but the PMS's SES.Hospedajes reporting is a manual, human-triggered step bolted on afterward — which works until someone's on holiday or it's a busy check-in day.
Why the Spanish compliance layer specifically matters
Since December 2, 2024, SES.Hospedajes guest registration has been mandatory nationwide (Catalonia and the Basque Country run their own regional equivalents, which is its own integration wrinkle if you're building for multi-region clients). Requirements that affect your data model:
- Required guest fields include identity document number, email, phone, age, relationship to any accompanying minors, and habitual residence.
- Submission is required within 24 hours of check-in.
- Records must be retained for 3 years.
- Penalties: €100–€600 for minor infractions (late or incorrect submissions), €601–€30,000 for serious ones (failure to register, missing retention) .
If you're integrating this yourself rather than relying on a PMS vendor's built-in connector, budget time for the government platform's submission format and authentication — it's not a modern REST/JSON API with clean docs and a sandbox you'd expect from a SaaS vendor, and edge cases (minors, groups, corrections after submission) need explicit handling in your data model rather than being an afterthought.
A guest record schema that accounts for this up front looks roughly like:
{
"reservation_id": "string",
"check_in": "ISO8601 datetime",
"guests": [
{
"full_name": "string",
"document_type": "DNI | NIE | Passport",
"document_number": "string",
"date_of_birth": "ISO8601 date",
"nationality": "string",
"residence_address": "string",
"email": "string",
"phone": "string",
"relationship_to_minor": "string | null"
}
],
"ses_submission_status": "pending | submitted | failed",
"ses_submission_deadline": "ISO8601 datetime (check_in + 24h)",
"retention_expires": "ISO8601 date (submission + 3y)"
}
Model ses_submission_status and ses_submission_deadline as first-class fields, not an afterthought — it gives you something concrete to alert on when a submission is late or fails silently, which is exactly the scenario that produces fines.
Why this matters commercially, not just technically
OTA commission rates have risen from roughly 10% a decade ago to a typical 15–30%+ today depending on platform and market. Every booking your direct engine captures instead of an OTA is margin the property keeps — which is the business case for investing in a good booking engine and SEO/conversion work on it, rather than relying solely on OTA distribution.
Build vs. integrate: how we decide
Our default at SoftWin is integrate first, build only the gap:
- If a PMS/booking platform already has solid SES.Hospedajes support, OTA connectivity, and reasonable API access (Cloudbeds and Mews are common starting points; Avirato is Spain-built and worth evaluating specifically for local compliance), configure and integrate it rather than reinventing a channel manager.
- Build custom when the gap is specific: connecting a legacy/in-house PMS to the SES.Hospedajes submission flow, a guest portal with features the platform doesn't offer, or syncing reservation data into a client's existing accounting/ERP system via API.
- Either way, treat the SES.Hospedajes integration as a first-class requirement in the technical spec, not a "we'll handle that later" line item — it's the one piece with statutory deadlines and fines attached.
Common technical mistakes
- Polling instead of webhooks/events for channel manager sync, introducing latency that causes double bookings during high-demand periods.
- No idempotency handling on inventory updates — a retried webhook shouldn't double-decrement availability.
- SES.Hospedajes submission as a synchronous blocking call in the booking flow instead of an async job with retry and alerting — a slow government endpoint shouldn't stall your checkout.
- No monitoring/alerting on submission failures, meaning a silent SES.Hospedajes API failure isn't caught until an inspection.
- GDPR and SES.Hospedajes treated as the same compliance problem. They overlap but aren't identical — data minimization and retention rules under GDPR need to coexist with the 3-year mandatory retention under SES.Hospedajes.
- Hardcoding Catalonia/Basque Country the same as the rest of Spain in a multi-property system, when those regions use separate systems.
FAQ
Is there a public sandbox/test environment for SES.Hospedajes?
Access and onboarding are typically handled through registered software providers or direct Ministry of Interior channels rather than a self-serve developer sandbox — plan integration time accordingly and verify current access requirements before committing to a timeline.
Can I use webhooks for OTA channel sync, or is polling required?
It depends on the OTA and whether you're going direct or through an aggregator like SiteMinder/RateGain; most modern connectivity layers support push-based updates, which you should prefer over polling for latency reasons.
Does GDPR conflict with the 3-year SES.Hospedajes retention requirement?
Not inherently — SES.Hospedajes retention is a legal obligation, which is a valid basis under GDPR for retaining that specific data for that period; the two need coordinated handling, not a single blanket policy for all guest data.
Is it worth building a custom PMS instead of integrating an existing one?
Rarely, for a single boutique property — the ROI is in the direct booking engine and the SES.Hospedajes/channel manager integration layer, not in re-implementing core PMS functionality that mature platforms already handle well.
Wrapping up
For a boutique hotel in Spain, "best booking system" isn't a single product recommendation — it's an architecture decision: a direct-conversion-optimized booking engine, real-time channel sync with no polling lag, and a SES.Hospedajes integration treated as a compliance-critical async pipeline rather than a manual afterthought.
We work on exactly this kind of integration at SoftWin — auditing existing hospitality stacks, connecting PMS platforms to Spain's guest-registration requirements, and building the custom pieces off-the-shelf tools don't cover.
