Privacy Policy

1. Data Controller

The entity responsible for processing the personal data collected through the booking system is the restaurant where you make the reservation (hereinafter, the "Restaurant"), whose identification and contact details are shown on its booking page and in the confirmation email. Qomanda, the booking management software developed and operated by ALTURE DIGITAL SL, acts as person in charge of treatment on behalf of the Restaurant, in accordance with Article 28 of the GDPR, and processes the data only following its instructions.

2. What data we process and for what purpose

• Reservation details (Name, phone number, email, number of guests, date, time, comments): to manage your reservation, contact you about it, and send you the confirmation/reminder. Legal basis: performance of the reservation (contract) and legitimate interest of the Restaurant.
• Allergies and intolerances (If you provide them): These are special category data (health) and are only processed to fulfill your request during the service, with your explicit consent when you provide them. You can choose not to provide them.
• Commercial communications: only if you give your specific consent, to send you news or offers from the Restaurant.

3. Conservation

We retain your data for as long as necessary to manage your booking and customer history, and subsequently block it for applicable legal periods. Allergy data is kept only as long as necessary for the service.

4. Recipients and sub-responsible parties

We do not sell or share your data with third parties except where legally required. To provide the service, we rely on the following providers, who act as sub-processors, subject to a contract pursuant to Article 28 of the GDPR and documented instructions:

• Supabase — database and authentication. Hosting in the European Union (Frankfurt, Germany).
• Vercel — Hosting and execution of the application. Processing in the European region (Frankfurt).
• Resend — Sending transactional emails (confirmation, reminder, cancellation). Provider based in the USA.
• Stripe — Payment processing, only when the Restaurant uses credit card guarantees or deposits. US-based provider.

International transfers: Suppliers located outside the European Economic Area process data protected by the Standard Contractual Clauses approved by the European Commission and by complementary security measures. The bulk of the data (reservations, customers and configuration) is stored on servers located in the European Union.

In addition, your booking details are accessible to authorized staff of the Restaurant itself, who are responsible for the processing.

5. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, as well as withdraw your consent at any time, by contacting the Restaurant using the contact details provided on its booking page or in the confirmation email. You can also file a complaint with the Spanish Data Protection Agency (aepd.es).

6. Security

We apply appropriate technical and organizational measures to protect your data (encryption in transit, access control by restaurant and backups).