Privacy policy
This policy describes how La Quisquillosa Playa processes the personal data of people who visit this website or contact the restaurant, in compliance with Regulation (EU) 2016/679 General Data Protection Regulation (GDPR) and Spanish Organic Act 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).
Data controller
The controller for the processing of the personal data collected through this website is the owner of the establishment identified in the legal notice.
- Controller
- Jorge Cabezas Catalán (self-employed)
- Spanish tax ID (NIF)
- 44651787R
- Trading name
- La Quisquillosa Playa
- Address
- Calle San Millán 5, 6.º C, 29013 Málaga, Málaga, Spain
- laquisquillosaplaya@gmail.com
- Phone
- +34614441588
Categories of data we process
Depending on how the user interacts with the site and the establishment, we may process the following categories of data:
- Navigation data
- IP address, user agent, date and time of the visit, pages consulted, browser language and approximate country. Processed by our hosting provider as a data processor.
- Language preference
- The language manually selected by the user, stored in the technical cookie lq-lang described in the cookie policy.
- Reservation data (future service)
- When a reservation form is enabled: name, phone or email, desired date and time, number of diners, and special requests from the user (allergies, intolerances, celebrations).
- Communication data
- Data contained in messages the user sends us by email, WhatsApp or telephone: name, contact and the content of the message.
Purposes of processing
We process the data for the following purposes, never using it for purposes incompatible with those for which it was collected (purpose limitation principle, article 5.1.b GDPR):
- To ensure the technical operation of the site, its security and the prevention of fraudulent or abusive activity.
- To remember the user’s language preference between visits.
- To handle reservation requests, communicate with users to confirm, modify or cancel them and provide the booked service.
- To respond to enquiries, suggestions or complaints sent to us.
- To comply with the controller’s legal obligations, in particular tax and accounting requirements.
Legal basis for processing
Each processing operation relies on a specific legal basis under article 6 GDPR:
- Navigation data
- Legitimate interest of the controller in ensuring the security of the network and information (article 6.1.f GDPR), following the corresponding balancing test.
- Language cookie
- Provision of a service expressly requested by the user (article 6.1.b GDPR); the cookie is exempt from the consent requirement under section 4.1.b of the Spanish DPA (AEPD) Guide on the use of cookies (July 2023).
- Reservation handling
- Implementation of pre-contractual measures at the data subject’s request and, where applicable, performance of the catering service contract (article 6.1.b GDPR).
- Health data (allergies and intolerances)
- Explicit consent of the data subject for the processing of special categories of data (articles 6.1.a and 9.2.a GDPR).
- Communications by email or other channels
- Consent of the data subject when initiating the communication (article 6.1.a GDPR).
- Legal obligations
- Compliance with legal obligations applicable to the controller (article 6.1.c GDPR).
Retention periods
We retain personal data for as long as necessary to fulfil the purpose for which it was collected and to handle any potential liabilities:
- Navigation data
- Up to 12 months from the visit, unless retention is needed to investigate a security incident.
- Language cookie
- Up to 1 year from the last visit; the user can delete it at any time from their browser.
- Reservation data
- 1 year from the date of service, unless it forms part of accounting or tax documents, in which case it is retained for the legally required period (4 years, article 66 of Spanish Act 58/2003 on Taxation).
- Communications
- Until the query is resolved and a further 1 year, unless needed to evidence compliance with legal obligations.
Recipients and data processors
We do not share personal data with third parties for commercial purposes. Only service providers strictly needed to operate the site and run the business will access the data, under the corresponding data processing agreements pursuant to article 28 GDPR:
- Vercel Inc. (United States)
- Website hosting. Data processor. Certified under the EU-US Data Privacy Framework (European Commission Adequacy Decision of 10 July 2023) and supported by the Standard Contractual Clauses approved by Decision (EU) 2021/914.
- Google Ireland Ltd. / Google LLC (United States) — Google Maps
- Only if the user consents to loading the interactive map. At that point a connection is established with Google, which acts as an independent controller under its own privacy policy. Without prior consent, no data is transmitted to Google.
- Meta Platforms Ireland Ltd. / WhatsApp
- Only if the user clicks the WhatsApp reservation button; at that point they leave this site and the WhatsApp/Meta privacy policy applies.
- Telecommunications operators
- If the user calls the published phone number; the applicable sector-specific regulation applies.
- Tax and accounting advisor
- For compliance with legal obligations relating to invoicing, tax and accounting, to the extent the data forms part of documents subject to those obligations.
International data transfers
Hosting the site may involve storing or processing data on servers located outside the European Economic Area, specifically in the United States through Vercel Inc. Likewise, if the user consents to loading the interactive map, their connection data (including their IP address) is communicated to Google LLC in the United States. Both entities are certified under the EU-US Data Privacy Framework and, additionally, the transfers are covered by the European Commission’s Standard Contractual Clauses. No other international data transfers take place.
Rights of the data subject
As a data subject, data protection law grants you the following rights, which you may exercise free of charge at any time:
- Access
- Obtain confirmation of whether we process personal data concerning you and, where applicable, a copy of such data (article 15 GDPR).
- Rectification
- Request the correction of inaccurate or incomplete data (article 16 GDPR).
- Erasure ("right to be forgotten")
- Request the erasure of data when it is no longer needed for the purpose collected, you withdraw consent or other grounds under article 17 GDPR apply.
- Restriction
- Request the restriction of processing in the cases set out in article 18 GDPR.
- Portability
- Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller (article 20 GDPR).
- Objection
- Object to the processing of your data on grounds relating to your particular situation (article 21 GDPR).
- Automated decisions
- Not to be subject to a decision based solely on automated processing, including profiling (article 22 GDPR). We do not carry out such processing.
- Withdrawal of consent
- Where processing is based on your consent, withdraw it at any time without affecting the lawfulness of prior processing.
How to exercise your rights
You may exercise any of the above rights by sending a request to laquisquillosaplaya@gmail.com or by post to Calle San Millán 5, 6.º C, 29013 Málaga, indicating the right you wish to exercise and attaching a copy of your ID document or equivalent proof of identity. We will reply within one month of receipt of the request, extendable by a further two months in cases of particular complexity or a high number of requests, with prior notice to the data subject (article 12.3 GDPR).
If you believe that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid; www.aepd.es; e-office sedeagpd.gob.es), without prejudice to any other administrative or judicial remedy.
Minors
This site is not directed to children under 14 years of age, nor does it knowingly collect data from minors of such age without the consent of the holders of parental authority or guardianship (article 7 LOPDGDD). Should we detect inadvertent processing of data of a child under 14 without the required consent, we will erase it immediately.
Automated decisions and profiling
We do not carry out processing based on automated decisions with legal effects on the data subject, nor do we engage in profiling. Nor do we share data with third parties for advertising purposes.
Security measures
We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing (article 32 GDPR), including TLS encryption of communications, access controls to systems, and training of personnel with access to personal data. Should a security breach occur that entails a risk to the rights and freedoms of individuals, we will notify the Spanish Data Protection Agency and, where applicable, the affected persons, in accordance with articles 33 and 34 GDPR.
Changes to this policy
This policy may be updated to reflect regulatory changes, new site functionality or changes in the controller’s organisation. The date of the latest version appears at the top of the document. In the event of substantial changes, we will communicate them prominently on the site.