Privacy policy

Data controller

The controller of your data is Juan Antonio Cuartero Lozano (Xalet La Coromina).

• Juan Antonio Cuartero Lozano — NIF: 47616877T
• Carretera de Vic, 4 · 17406 Viladrau (Girona), Catalunya
• info@xaletcoromina.com · +34 676 237 016

What we process, why and on what basis

• Table bookings (online, by phone, by WhatsApp or at the restaurant): name, phone, email, date, time, number of guests and of children under 12, the table and the notes. We use them to manage the booking, send you the confirmation, a reminder and notices about it (changes, closures, days with fixed seatings) and look after you. Basis: performance of a contract or pre-contractual steps at your request (art. 6.1.b GDPR).
• Allergies and intolerances (health data): only if you tell us, with your explicit consent (art. 9.2.a GDPR), and only to prepare your meal. You can withdraw it at any time by writing to us; this does not affect what has already been done.
• Booking history: our staff can see your previous bookings (visits, cancellations and no-shows) to look after you better and plan the service. Basis: the restaurant's legitimate interest (art. 6.1.f GDPR). You can object.
• If you write or call us, we use your details to reply (art. 6.1.b or 6.1.f GDPR).
• Staff area security: we keep the IP address of failed sign-in attempts for 30 days to prevent unauthorised access (legitimate interest).

How long we keep it

• Booking notes (allergies included) are deleted 30 days after the booking date.
• Name, phone and email are kept for 2 years from the booking date; after that they are anonymised and only the figures remain (day, time and guests).
• If a claim requires keeping something longer, it is kept blocked for that purpose only.

Who receives it

We do not sell or share data for advertising. These providers process it on our behalf as data processors:

• Vercel Inc. — website hosting
• Supabase — reservations database
• Resend — reservation email delivery

They are based in the United States. When data leaves the European Economic Area, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

We may also have to provide data to the authorities when the law requires it. The map on the contact page is loaded from OpenStreetMap (United Kingdom, covered by an EU adequacy decision), which receives your IP address. If you book a room, the external booking engine direct-book.com applies its own privacy policy.

Security

Data travels encrypted (HTTPS). The database cannot be reached from the public website, and only authorised staff can sign in to the management area.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent, by writing to info@xaletcoromina.com. We will reply within one month at the latest. You can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). We make no automated decisions with effects on you.

Cookies

This website sets no cookies for visitors. See the cookie policy.