Privacy policy

Who is responsible for your data

Owner

Como bake & brunch

Owner details being updated.

What data we process and why

• Bookings: name, email, phone, party size and the notes you add, to manage your booking and send you its confirmation and reminder. Legal basis: performance of the booking you ask for (GDPR art. 6.1.b).
• Allergies and dietary needs: only if you tell us, to serve you safely. As health data, we process it with your explicit consent (art. 9.2.a), which you can withdraw at any time.
• Visits and orders: what you ordered and paid, to keep the accounts and meet tax duties (art. 6.1.c), and to recognise you when you come back (legitimate interest, art. 6.1.f).
• News and offers: only if you ticked the box. Legal basis: your consent (art. 6.1.a; art. 21 LSSI). Every email has a one-click unsubscribe link.
• Reviews: if you rate your visit, your rating and comment. We only publish them if you allow it.

How long we keep it

Booking data for as long as the relationship lasts and then for the legally required periods. Sales and receipts are kept for tax and accounting purposes (4 years under the Spanish General Tax Law, 6 under the Commercial Code), without your name if you ask us to erase you. Marketing data until you withdraw consent.

Who processes it on our behalf

TableRooms (https://tablerooms.com) hosts this website and the booking system as data processor under a contract that complies with GDPR article 28. It uses email delivery, hosting and, when a deposit is paid, payment providers bound by the same obligations; if any of them processes data outside the European Economic Area, it does so with the standard contractual clauses approved by the European Commission. We do not sell your data or share it with third parties for their own purposes.

Your rights

You can request access, rectification, erasure, objection, restriction and portability of your data, and withdraw your consent, by writing to the restaurant. We will reply within one month. If you are not satisfied, you can complain to the Spanish Data Protection Agency (www.aepd.es).