Privacy Policy
1. Data controller
- Identity: EL TOMAQUET DE LA CREU, SL (Restaurant Tomàquet)
- Tax ID (NIF/CIF): B17838210
- Address: Carrer Albí, 34, 17003 Girona
- Phone: +34 972 218 868
- Email: reserva@restauranttomaquet.com
2. What data we process and for what purpose
| Purpose | Data | Legal basis |
|---|---|---|
| Managing bookings for tables, private spaces and group menus, by phone, email or form. | Name, phone number, email address, date and time, number of guests, allergies or intolerances and any other comments you provide. | Pre-contractual measures and performance of the service (art. 6.1.b GDPR). For data on allergies or intolerances, your explicit consent (art. 9.2.a GDPR). |
| Handling enquiries and requests for information, event quotes or any other communication. | Name, email address, phone number and message content. | Consent (art. 6.1.a GDPR) and, where applicable, pre-contractual measures (art. 6.1.b). |
| Complying with legal obligations (tax, accounting and health). | Identification and billing data. | Legal obligation (art. 6.1.c GDPR). |
| Website security and operation (technical logs and abuse prevention). | IP address, browsing and device data. | Legitimate interest (art. 6.1.f GDPR). |
We do not use your data to make automated decisions or to create profiles.
3. Mandatory nature of the data
Data marked as mandatory in forms or contact channels is necessary for us to handle your request. If you do not provide it, we will not be able to process it. You guarantee that the data you provide is accurate and undertake to inform us of any changes to it.
4. Retention period
- Bookings: while the service is being managed and, afterwards, for the time needed to handle any possible claims.
- Enquiries: for the time needed to reply to you and, at most, 12 months after the last communication.
- Data subject to legal obligations: for the periods required by applicable law (generally between 4 and 6 years for tax and commercial records).
Once these periods have expired, the data will be blocked and finally securely deleted.
5. Data recipients
We do not share your data with third parties, except where required by law (public authorities, courts and tribunals, law enforcement agencies). To provide the service, we may use providers who access the data solely on our behalf and under a data processing agreement (art. 28 GDPR), such as:
- Web hosting and website maintenance provider:
- Google Ireland Ltd. (Google Analytics and Google Maps), only if you consent through cookies
- Email service provider:
6. International transfers
As a general rule, we do not transfer data outside the European Economic Area. If any of the providers listed processed data outside this area, we would only do so with the appropriate safeguards provided for in the GDPR (European Commission adequacy decision or standard contractual clauses).
7. Your rights
You may exercise the following rights at any time:
- Access: find out what personal data of yours we process.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request the deletion of your data when it is no longer necessary, among other cases.
- Objection: object to processing based on legitimate interest.
- Restriction: request that processing be suspended in certain cases.
- Portability: receive your data in a structured, commonly used format, or have it transmitted to another controller.
- Withdraw your consent at any time, without affecting the lawfulness of prior processing.
To exercise them, send a request, together with a copy of your ID card or equivalent document, to reserva@restauranttomaquet.com or by post to Carrer Albí, 34, 17003 Girona, stating the right you wish to exercise.
If you believe your rights have not been properly respected, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
8. Security measures
We have adopted the appropriate technical and organisational measures to guarantee the security of the data and prevent its alteration, loss, or unauthorised processing or access, taking into account the state of the art and the nature of the data.
9. Third-party content and social media
The website displays third-party content, such as the Google Maps map or the Instagram gallery, and uses Google Analytics to measure and analyse browsing statistically. These services may collect browsing data in accordance with their own privacy policies and, where applicable, through cookies, which are only installed if you give your consent. You will find more information in our Cookie Policy.
10. Minors
This website is not aimed at children under 14. If you are under 14, you need the consent of your parents or guardians to provide us with personal data.
11. Changes to this policy
We may update this policy to adapt it to regulatory changes or to changes in our processing activities. The current version will always be the one published on this website, together with the date of the last update.