1. Data controller
- Controller: [RAZÓN SOCIAL] (Trencabeach)
- Tax ID (NIF): [NIF]
- Address: [DOMICILIO FISCAL]
- Phone: 961 02 34 21
- Email: [CORREO ELECTRÓNICO]
2. What data we process
When you book a table with the form, we process: your first and last name, phone number, email (optional), the number of guests, your terrace/indoor preference, any notes you choose to add, and the day, time and table chosen.
Health data. The notes field may contain food allergies or intolerances, which the GDPR treats as health data, a special category of data (art. 9). We only process this if you give your explicit consent by ticking the specific box on the form, and it is only used by the restaurant's kitchen and floor staff to prepare your food safely. We do not use it for any other purpose or share it with third parties. Please write only what is necessary.
3. What we use it for
- Managing your booking: holding the table, contacting you to confirm or change it, and serving you on the day of your visit.
- Preparing your food taking into account any allergy or intolerance you tell us about (only the restaurant's kitchen and floor staff).
- Sending you the booking confirmation, if you leave us your email.
We do not build profiles, make automated decisions, or use your data for advertising.
4. Legal basis
The taking of pre-contractual steps at your request (art. 6.1.b of Regulation (EU) 2016/679, GDPR) and the consent you give by ticking the box on the form (art. 6.1.a GDPR). You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before you did so.
For allergies and intolerances given in the notes, the legal basis is your explicit consent (art. 9.2.a GDPR), given by ticking the specific box on the form. If you'd rather not give it, leave the notes blank and mention it to staff on the day, or book by phone. You can withdraw it at any time by writing to [CORREO ELECTRÓNICO], and we will erase that data.
5. How long we keep it
Booking data is kept [PLAZO DE CONSERVACIÓN, p. ej. 12 meses tras la reserva]. If the visit results in an invoice, the data it contains will be kept for the periods required by tax and commercial law.
6. Who we share it with
We do not share your data with third parties, except where legally required. To run the website we rely on providers that process data on our behalf (data processors), under contract and with adequate safeguards:
- Supabase: the database where bookings are stored.
- Cloudflare: website hosting (Cloudflare Pages).
- Resend: sending confirmation emails and the booking alert to the restaurant.
Some of these providers may process data outside the European Economic Area. In such cases, the transfer is covered by the safeguards provided for in the GDPR, such as the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to [CORREO ELECTRÓNICO] or contacting the restaurant, stating which right you wish to exercise. If you believe we have not properly handled your request, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).
8. Cookies, map and local storage
This website does not use advertising, analytics or third-party cookies, and fonts are served from the same domain. The OpenStreetMap map only loads if you click «Show the map»; your browser then connects to OpenStreetMap's servers, which receive your IP address. The browser stores your chosen language (Spanish, Valencian or English) to remember it on your next visit. The private admin area stores the authorised user's session in the browser, strictly necessary for it to work.
9. Security
We apply technical and organisational measures to protect the data: encrypted connections, booking access limited to the restaurant's authorised staff, and storage with providers that offer security guarantees.