Privacy policy

Reservations

When you make a reservation we store your name, email, optional phone and the reservation details (date, time, party size, area). Purpose: handling and confirming your table. Legal basis: Art. 6(1)(b) GDPR (contract).

Retention: name, email and reservation date are kept for 3 years (commercial record-keeping). Phone, dietary notes, occasion and internal notes are automatically deleted 30 days after your visit.

Dietary notes (Art. 9 GDPR)

Information about allergies, intolerances or religious dietary rules may constitute special-category data under Art. 9(1) GDPR. Providing it is voluntary; the legal basis is your explicit consent under Art. 9(2)(a) GDPR, which you grant when submitting the form. You can withdraw consent at any time; these entries are automatically deleted within 30 days of your visit.

E-Mail

Transactional emails are delivered via Resend.com (Resend, Inc., USA) under EU Standard Contractual Clauses and a signed data processing agreement.

Analytics

We use Plausible Analytics (Plausible Insights OÜ, Estonia). It does not set cookies, does not store personal data, and does not transfer data to third countries outside the EU.

Hosting & database

This site is hosted on Hetzner Online GmbH (Nuremberg, Germany). Reservations are stored in a self-managed PostgreSQL database on the same infrastructure. Cloudflare, Inc. (USA) acts as CDN/proxy in front of the origin server (transfer covered by EU Standard Contractual Clauses).

Subprocessors

• Hetzner Online GmbH — hosting (DE)
• Cloudflare, Inc. — CDN/Proxy (US/EU, SCCs)
• Resend, Inc. — email delivery (US, SCCs, DPA)
• Plausible Insights OÜ — Analytics (EE)

Your rights

You have the right to access, rectification, erasure, restriction of processing, portability and objection. You can request erasure via the automated endpoint /api/gdpr/delete or by writing to [email protected]. You may also file a complaint with the Spanish data protection authority AEPD (aepd.es).