1. Data Controller

The data controller responsible for processing your personal data is:

• Balordi
• Carrer Creu Coberta, 23
• Sants-Montjuïc, 08014 Barcelona, Spain
• Email: [email protected]

2. Personal Data We Collect

We may collect and process the following personal data:

• Contact form data: name, email address, phone number, and message content when you contact us through our website.
• Navigation data: IP address, browser type, operating system, referring URLs, pages visited, and timestamps collected automatically when you browse our website.
• Reservation data: name, email, phone number, date, time, and party size when you make a reservation.

3. Purpose of Data Processing

Your personal data is processed for the following purposes:

• To respond to your enquiries and messages submitted via the contact form.
• To manage table reservations and communicate relevant information about your booking.
• To improve the functionality and user experience of our website.
• To comply with legal obligations applicable to our business.
• To protect our legitimate interests, including website security and fraud prevention.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under the GDPR:

• Consent (Art. 6(1)(a) GDPR): When you voluntarily submit information through our contact form or subscribe to communications.
• Legitimate interest (Art. 6(1)(f) GDPR): For website analytics, security, and improving our services, where our interests do not override your fundamental rights.
• Contractual necessity (Art. 6(1)(b) GDPR): When processing is necessary to fulfil a reservation or respond to a service request.
• Legal obligation (Art. 6(1)(c) GDPR): When we are required to process data to comply with applicable laws.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact form enquiries: up to 12 months after your last communication with us.
• Reservation data: up to 12 months after the reservation date.
• Navigation and analytics data: up to 26 months.
• Data required for legal compliance: for the duration required by applicable law.

After the retention period expires, your data will be securely deleted or anonymised.

6. Your Rights

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete data.
• Right to erasure: You may request deletion of your personal data where there is no compelling reason for continued processing.
• Right to restriction of processing: You may request that we limit how we use your data in certain circumstances.
• Right to data portability: You may request to receive your data in a structured, commonly used, and machine-readable format.
• Right to object: You may object to the processing of your data based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

7. Cookies

Our website may use cookies and similar technologies to enhance your browsing experience. Cookies are small text files stored on your device that help us understand how you interact with our website. For detailed information about the cookies we use and how to manage your preferences, please refer to our cookie settings.

8. Third-Party Services

We use the following third-party services that may process personal data:

• Google Fonts: We use Google Fonts to display web fonts on our website. When you visit our pages, your browser downloads the required fonts from Google servers, which may result in your IP address being transmitted to Google LLC (USA). Google's privacy policy applies: https://policies.google.com/privacy

We ensure that any third-party processing complies with GDPR requirements, including appropriate safeguards for international data transfers.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted data transmission (SSL/TLS), access controls, and regular security reviews.

10. Changes to This Policy

We may update this data protection policy from time to time to reflect changes in our practices or applicable legislation. Any updates will be published on this page with a revised "last updated" date. We encourage you to review this policy periodically.

11. Contact Us

If you have any questions or concerns about this data protection policy or how we handle your personal data, please contact us:

• Balordi
• Carrer Creu Coberta, 23
• Sants-Montjuïc, 08014 Barcelona, Spain
• Email: [email protected]