Last updated: 31 July 2026
Version: 2026-07-31
1. Controller
The controller is María Pau Carbó Rodríguez, owner of Centre Cívic Clariana.
- Privacy contact: clarianacivic@gmail.com
- Telephone: +34 640 746 123
- Address: 2 Carrer de Sant Jaume, 08729 Castellet i la Gornal, Barcelona, Spain
Complete identifying information is available in the Legal Notice.
No Data Protection Officer has been appointed based on the current nature and scale of processing. This must be reassessed if activities change.
2. Who this policy applies to
This policy applies to booking requesters, group and event contacts, people contacting the restaurant by form, email, telephone or WhatsApp, people raising complaints or incidents and website visitors where minimum technical data are generated.
3. Data processed
Depending on the channel and request, the following may be processed:
- first name and surname;
- telephone number;
- optional email;
- requested date and time;
- party size;
- requested area: dining room, terrace or private room;
- booking or event type;
- comments and special requests;
- allergy or intolerance information, only when voluntarily provided;
- email, telephone and WhatsApp communications;
- information needed for incidents and complaints;
- submission date/time, request identifier and minimum security data.
No payment-card or banking data are requested because the website does not accept payments.
4. Purposes, legal bases and retention
A) Ordinary bookings
Purpose: receive the request, check availability, contact, confirm, reject or amend and provide the service.
Legal basis: steps requested before entering into the booking relationship and performance of that relationship.
Retention: during management and generally up to three months after the booking date, unless an incident, complaint or legal duty requires longer.
B) Groups, celebrations and events
Purpose: assess capacity and logistics, prepare the service, communicate, manage changes and handle incidents.
Legal basis: pre-contractual steps and performance.
Retention: preparation, service and closure and generally up to three months afterwards.
C) Email, telephone and WhatsApp
Purpose: manage the request through the chosen channel.
Legal basis: pre-contractual steps, performance or responding to the requested communication.
Retention: during management and according to periodic email and message reviews.
D) Comments and special requests
Purpose: deal with the booking-related request.
Legal basis: pre-contractual steps or performance.
Unnecessary or unauthorised third-party data must not be included.
E) Allergies and intolerances
This information may reveal health data and is optional.
Purpose: use the information only for that booking and the dietary needs communicated.
Legal basis: explicit consent.
Rules:
- separate unticked checkbox;
- required only when the field contains information;
- no advertising, profiling or permanent preference;
- access only for staff who need it;
- deletion after the service when there is no incident;
- temporary retention only where an incident or complaint exists.
Online communication does not replace telling restaurant staff directly on arrival.
F) Incidents and complaints
Purpose: reply, investigate, resolve and retain necessary evidence.
Legal basis: performance, legal obligation or legitimate interests in managing and defending claims.
Retention: handling and applicable legal periods, with restriction where required.
G) Website security
Purpose: protect the website, prevent abuse and detect errors.
Legal basis: legitimate interests.
Only minimum technical data will be processed. Comments or allergy information must not be included in unnecessary logs.
H) Marketing
Booking data are not currently used for advertising, promotions or newsletters. There is no marketing checkbox.
Any future marketing requires separate information and an optional unticked authorisation.
I) Profiling and automated decisions
No commercial profiling or legally significant automated decisions are carried out.
5. Required and optional data
Required:
- first name;
- surname;
- telephone;
- date;
- time;
- party size;
- requested area.
Optional:
- email;
- comments;
- allergies or intolerances.
Without required data, the request may not be processed.
6. Data source
Data come directly from the person through the form, email, telephone, WhatsApp, enquiries or complaints.
Anyone providing third-party data must have authority or another lawful basis. Third-party health data must not be provided without appropriate authority.
7. Recipients and providers
Data may be processed by:
- the owner;
- authorised restaurant staff;
- kitchen staff where allergy information is needed;
- hosting, database, email, messaging, maintenance and security providers;
- professional advisers;
- authorities where legally required.
Current or expected services include:
- website hosting and infrastructure provider (servers in the European Union);
- Google through Gmail and related services used by the business;
- WhatsApp Ireland Limited;
- an external development and maintenance provider acting under a data-processing agreement.
Data are not sold or disclosed for third-party advertising.
Full booking emails must be sent to clarianacivic@gmail.com. Technical providers should access real data only when strictly necessary.
8. International transfers
Some providers may process information outside the European Economic Area.
International transfers must rely on a recognised mechanism such as an adequacy decision, the EU–US Data Privacy Framework where applicable, standard contractual clauses or another lawful safeguard.
Additional information may be requested from clarianacivic@gmail.com.
9. Security
Proportionate measures include access control, individual credentials, device protection, updates, form validation and sanitisation, abuse limits, minimum logs, restricted allergy access, removal of permissions, incident handling and backup reviews.
Absolute security is not promised, but reasonable measures and risk reviews are required.
10. Retention and deletion
- Ordinary bookings: review and deletion at three months unless an incident exists.
- Allergy data: earlier deletion after the service and no incident.
- Emails and messages: periodic review.
- Backups: outside ordinary use and subject to the provider overwrite cycle.
- Legal duties or liabilities: restricted retention for the applicable period.
11. Rights
Individuals may exercise access, rectification, erasure, objection, restriction, portability and withdrawal of consent.
Contact: clarianacivic@gmail.com.
Withdrawal does not affect prior lawful processing.
A complaint may also be lodged with the Spanish Data Protection Agency.
12. Minors
The form is not specifically directed at minors. Bookings should preferably be made by an adult and unnecessary minor data must not be provided.
13. Changes
The policy will be updated if forms, services, purposes, providers, retention or law change.
14. Inactive functions
The website currently has:
- no online payments;
- no newsletter;
- no booking-data advertising;
- no loyalty programme;
- no commercial profiling;
- no online ordering or delivery;
- no direct user reviews;
- Instagram-only prize draws, not website forms.
Activating any of these requires a prior review.