How we handle your data

Who is responsible for your data

What we collect and why

• If you book: your name, your phone number, the day, the time, how many of you there are and anything you tell us in the notes. It is used to keep your table and to let you know if there is any problem.
• If you order: the same, plus what you ordered and which table it is for or what time you will collect it. It is used to prepare it and to charge you at the restaurant.

There is no advertising, no tracking, and we do not use your data to profile you. Nor do we combine it with anything else.

On what legal basis

Because you ask us to: handling a booking or an order is what is needed to serve you. If you don’t give us your name and phone number we cannot keep your table, and there is no other purpose behind it.

In legal terms: performance of a contract, or steps taken at your request before entering into one (Article 6(1)(b) GDPR).

If you tell us about an allergy

The notes field is free text and you can tell us whatever you like there. If you write down an allergy or an intolerance, that is health data and it is more strongly protected than the rest. If you tell us about an allergy or an intolerance, we use it only to prepare your food safely and it is deleted along with the rest of the booking.

You don’t have to tell us here. If you prefer, tell us when you arrive or over the phone and it won’t be written down anywhere.

How long we keep it

• Bookings: 365 days from the day of the booking, after which they are deleted.
• Orders: 90 days for the name and phone number. After that they are removed from the order and only the dishes and the amount remain, which do not say who you were.

Who else sees it

Nobody buys it or receives it for their own purposes. Only so that this works, it is handled by Marian Vasilof, who develops and maintains this application on behalf of the restaurant, without using the data for any purpose of their own, and by the services that host the application.

• Vercel, to host and serve the website — United States, under the EU-US Data Privacy Framework, under which it is certified.
• Neon, to store bookings and orders — Frankfurt (Germany), within the European Union.
• Resend, to send us the notification of a new booking, without your name or phone number — United States, under the EU Standard Contractual Clauses and the EU-US Data Privacy Framework, under which it is certified.
• If the restaurant uses its own calendar (Google, Apple…) to organize service, your booking's name, day, time and number of diners may appear in it. This is not our service: the restaurant chooses and manages it.

If you would like to see in writing the safeguards under which your data leaves the European Union, ask us and we will send them to you.

What you can do

You can ask us to:

• · see what we hold about you
• · correct it if it is wrong
• · delete it
• · stop using it while we review it, or object to our using it
• · take it elsewhere in a readable file

Writing to hola@restaurante-de-prueba.invalid or calling +34 600 000 100 is enough, and you don’t have to give any reason.

If you think we have not handled it properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).

Cookies

We do not use tracking or analytics cookies, so you won’t see any banner asking for your consent. The only things stored on your phone are what the app needs to work: your basket while you order and whether you prefer light or dark mode. They stay on your device and go nowhere.