Privacy policy

1. Data controller

Cafetería La Tacita — Calle del Foso 19, 28300 Aranjuez (Madrid), Spain. Phone: 919 48 63 68.
Registered name and tax ID: [PENDING].
Privacy contact email: [PENDING].

2. What we collect

Only what you type into the booking form:

• First and last name.
• Phone number.
• Email address.
• Number of guests, preferred date and time.
• Special requests, if you choose to fill them in.

We do not build profiles, run advertising or track you across sites. If you tell us about an allergy or intolerance in the requests field, we use it solely to prepare your table.

3. Why we use it, and on what basis

Purpose: to handle your booking request, contact you to confirm, change or cancel it, and look after you during service.

Lawful basis: your consent, given by ticking the box on the form (art. 6.1.a GDPR), and pre-contractual steps taken at your request (art. 6.1.b GDPR).

4. Who we share it with

Nobody, except where legally required and except the providers needed to run the service:

• Vercel Inc. (USA) — site hosting.
• The email provider we use to receive the booking notification and reply to you.

Both international transfers rely on the EU-US Data Privacy Framework.

5. How long we keep it

We keep the request for as long as needed to handle the booking and afterwards for the legal period applicable to claims. After that, it is deleted.

6. Your rights

You can request access, rectification, erasure, objection, restriction and portability of your data, and withdraw your consent at any time, by writing to us or calling 919 48 63 68.

If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency: www.aepd.es.

7. Other people's data, and minors

Please do not enter other people's details without their permission. This site is not aimed at children under fourteen; if you are under 14, do not use the form without your parents' or guardians' permission.

8. Security

We apply reasonable technical and organisational measures to protect your data against loss, alteration or unauthorised access. The form limits how many submissions a single device can make, to prevent abuse.