Privacy policy

This page explains what personal data is processed through this website, for what purpose, for how long, who else sees it, and what you can require at any time. Regulation (EU) 2016/679 and Spanish Organic Law 3/2018 apply.

Who the controller is

• Controller: Rodeiro da Costa, S.L. (El Labriego)
• Spanish tax number (CIF): B85983435
• Address: C. de las Veneras, 4, 28013 Madrid, Spain
• Email: info@ellabriego.es
• Telephone: +34 915 59 24 07

No data protection officer has been appointed, because the activity does not require one. For anything concerning your data, the email address above is the channel.

This website has no forms

Worth saying up front: there is no form anywhere on ellabriego.es. No data is collected by typing on this website. Data reaches us by other routes, which are the ones explained below.

What data is processed and why

Online bookings

The booking button opens the Google reservations platform in a separate window. The booking is completed there, under Google’s own terms and privacy policy, and the restaurant then receives the data needed to hold the table: name, telephone, date, time and number of guests.

For the data we receive, the legal basis is performance of the booking, under Article 6(1)(b) of the Regulation. Whatever happens inside the Google platform is governed by Google’s terms, not by this policy.

Bookings, orders and enquiries by telephone

When you call, we process your name, your telephone number and the details of what you order or ask about: date, time, number of guests, menu, or any note you want to leave, such as an allergy or a table preference. This is used to handle the booking or the enquiry. The legal basis is performance of a contract or of pre-contractual dealings, Article 6(1)(b).

Enquiries by email

If you write to info@ellabriego.es we process the data you provide and the content of your message in order to reply. The legal basis is your consent in contacting the restaurant and the legitimate interest in answering those who ask, Articles 6(1)(a) and 6(1)(f).

Groups and celebrations

Quotes for groups are handled by telephone or email. We process the contact details of the person organising and the details of the event: date, number of people, menu and any particular needs. Legal basis: pre-contractual dealings and performance of a contract, Article 6(1)(b).

Website measurement and analysis

With your permission, third-party tools record visits and site use. The legal basis is your consent, Article 6(1)(a), which you can withdraw at any time. The detail is in the cookie policy. Without that permission they are not activated.

First-party audience measurement

In addition to the above, the site runs its own counter that uses no cookies and stores nothing in your browser, and that works even if you reject the cookie notice. It records the page viewed, the domain you arrive from, the device type, the browser language, the load time and whether you press the phone number, the email address or the booking button.

Your IP address is never stored. So as not to count you twice on the same day, a cryptographic digest is computed using a random key that changes every night and is not kept, which makes it impossible to link you to the previous day. Individual records are turned into counters every night and destroyed after two days; the counters are kept for a maximum of 25 months.

The processing is carried out solely on the restaurant behalf, no third party is involved, the data never leaves this server, it is not cross-referenced with any other processing and it cannot be used to follow you across other websites. The legal basis is the legitimate interest in understanding how the site itself is used, Article 6(1)(f), and it meets the conditions of the audience-measurement exemption set out by the Spanish Data Protection Agency.

What is not done

• No newsletters or marketing messages are sent: there is no mailing list.
• No profiling and no automated decision-making about anyone.
• Data is not sold or transferred to third parties for their own purposes.
• No special category data is requested. If you mention an allergy when booking, it is used only to look after you and is not kept longer than necessary.

How long data is kept

• Bookings: as long as needed to manage them, plus a reasonable period afterwards to deal with issues or complaints.
• Enquiries and quotes: for the duration of the exchange and a sensible period afterwards.
• Tax and accounting obligations: the periods set by law where invoicing is involved.
• Measurement data: the retention periods of each tool, set out in the cookie policy.

Once those periods end, data is deleted or blocked until any resulting claims become time-barred.

Who else has access

Data is not disclosed to third parties except where the law requires it. Providers that supply necessary services do access data on the controller’s behalf, under a data processing agreement:

• The web hosting provider, which hosts the site and its database.
• The email provider, for handling the messages received.
• Google Ireland Limited, for the booking platform, the measurement tool and the embedded map.
• Microsoft Ireland Operations Limited, for the site usage analysis tool, if you allow it to load.

Transfers outside the European Union

Google and Microsoft may process data on servers located in the United States. Those transfers rely on the EU-US Data Privacy Framework, to which both are certified, and failing that on the standard contractual clauses approved by the European Commission. If you do not allow measurement or usage analysis cookies, those transfers do not take place by that route.

Your rights

You may exercise the following rights at any time:

• Access: to know what data about you is processed.
• Rectification: to correct data that is inaccurate.
• Erasure: to ask for data to be deleted once it is no longer needed.
• Objection: to object to processing based on legitimate interest.
• Restriction: to ask that data be kept but not used while a disagreement is resolved.
• Portability: to receive your data in a structured format.
• Withdrawal of consent: where processing relies on it, without affecting what was done beforehand.

Write to info@ellabriego.es stating which right you are exercising. Some identity check may be requested, purely to make sure data is not handed to somebody else. You will receive a reply within one month at most.

If you consider that your data has not been handled properly, you may complain to the Spanish Data Protection Agency, calle Jorge Juan 6, 28001 Madrid, or through its electronic portal at aepd.es. If you prefer, you can first write to the address above and try to settle it directly.

Children

This website is not aimed at children under 14 and no data is requested from them. If you notice that a child has provided data without the authorisation of their guardian, let us know and it will be deleted.

Security

The site is served encrypted over HTTPS and reasonable technical and organisational measures are applied to protect data: access limited to those who need it, software updates and backups. No system is infallible, but should a breach occur that poses a high risk to your rights, you will be informed and the supervisory authority will be notified.

Changes to this policy

This policy is reviewed when the processing, the providers or the applicable rules change. If a change affects something you consented to, you will be asked again. The version in force is always the one published here.

This is a translation provided for convenience. In the event of any discrepancy, the Spanish version prevails.