Privacy Policy

1. Data Controller

The entity responsible for processing personal data on this website is:

• Corporate Name: Iglesias Bernal Restauración S.L.
• Trading Name: Bodeguita Iglesias
• Tax ID (CIF): B90270588
• Postal Address: Calle Antonia Díaz, 9, 41001 Seville, Spain
• Direct Phone: (+34) 954 22 53 85
• Official WhatsApp: (+34) 647 58 48 06

2. Data Protection Principles

In processing any personal data, we adhere strictly to the foundational principles of the GDPR:

• Lawfulness, fairness and transparency: Processing is always grounded on a recognized legal basis, with transparent communication to the user.
• Data minimization: This static website features no user registration forms or account databases. Only data strictly necessary for processing direct reservations and inquiries is processed.
• Storage limitation: Data is retained only for the duration required to fulfill the specific purpose for which it was gathered.
• Integrity and confidentiality: Appropriate technical and organizational measures safeguard data against unauthorized access or alteration.

3. Purposes and Legal Bases for Processing

Personal data is processed according to the following specific purposes and legal bases:

• Handling reservations and inquiries (via WhatsApp or phone call): When you contact us to check availability, book a table, or arrange a group menu, we process your telephone number and contact name to fulfill your request. Legal basis: Performance of a contract or pre-contractual measures taken at your request (Art. 6.1.b GDPR).
• Web server technical security: Our web server logs technical access data (IP addresses, user-agent headers, HTTP requests) to prevent cyberattacks, maintain server uptime, and detect abuse. Legal basis: Legitimate interest in network and information security (Art. 6.1.f GDPR and Recital 49).
• Aggregated analytics (Google Analytics 4): If you grant your consent through our cookie banner, aggregated and anonymized browsing metrics are processed via Consent Mode v2 without personal profiling. Legal basis: Explicit consent of the user (Art. 6.1.a GDPR).

4. Data Retention Periods

Server access logs are retained by our hosting provider for a maximum period of 30 days, after which they are automatically purged. Contact data related to direct reservations is retained only for the duration of the reservation management and the statutory limitation periods for legal obligations.

5. Recipients and Third-Party Processors

We work with trusted service providers who adhere to European privacy standards:

• Web Hosting: Webempresa Europa S.L., with hosting infrastructure and data centers located within the European Economic Area (EEA).
• Messaging Service (WhatsApp): Direct messaging occurs through WhatsApp Ireland Ltd. under their terms of service and end-to-end encryption architecture.
• Analytics Measurement: Google LLC / Google Ireland Limited (only if analytical cookies are accepted), certified under the EU-U.S. Data Privacy Framework.

6. Your Rights Under GDPR

You have the right to exercise your data protection rights at any time, free of charge:

• Access: Obtain confirmation on whether your personal data is being processed and receive a copy thereof.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure ("Right to be Forgotten"): Request deletion of your personal data when it is no longer needed.
• Restriction of processing: Request temporary suspension of processing under statutory conditions.
• Objection: Object to processing based on legitimate interest.
• Portability: Receive your personal data in a structured, commonly used machine-readable format.

To exercise your rights, please submit a written request accompanied by proof of identity to Iglesias Bernal Restauración S.L., Calle Antonia Díaz, 9, 41001 Seville, Spain, or via our official communication channels.

You also hold the right to lodge a complaint with the competent supervisory authority, the Spanish Data Protection Agency (AEPD), at www.aepd.es.