Privacy policy

Welcome to the privacy policy of RESTAURANTE TXISPA. Hereinafter, where indicated, the Restaurant refers to the data controller whose contact details for all matters relating to the protection of your personal data are:

• Address at Barrio San Juan 45 – 48291 – Atxondo, Vizcaya.
• Email info@txispa.com

The Privacy Policy of this site aims to comply with the duty of information and transparency established in Article 12 of EU Regulation 2016/679 on the protection of personal data. Likewise, in cases where the duty of information has been carried out by means of basic information called “first layer” in accordance with the provisions of article 11 of Organic Law 3/2018 on the protection of personal data and guarantee of digital rights, this privacy policy corresponds to the additional information considered as “second layer” where the additional elements required in articles 13 and 14 of the EU Regulation 2016/679 on the protection of personal data are described.

1.- The meaning of personal data “personal data” is defined as any information relating to an identified or identifiable natural person. This means any person who can be identified directly or indirectly by reference to an identifier such as a name, identification number, location data, online identifiers (e.g. IP addresses – if they can be used to identify that person) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. In short, this includes data which either by itself or with other data in our possession or at our disposal can be used to identify you.

2.- Processing of personal data and purposes The operations or set of operations carried out on your personal data are identified by processing. The Restaurant provides you with detailed information on the processing of your personal data below: – Management of reservations. In order to manage bookings, we may collect personal data from individuals through the booking application forms or gift cards on the TXISPA.COM website, or they may also come from the THEFORK booking management platform to which the restaurant is a member. We may store the data you provide us with by telephone or email if you use these means to make a reservation. This processing is legitimised by the contractual relationship that is established when requesting a reservation. • Job applicants. In selection processes we may collect data from the CVs sent to us. This processing is legitimised by the pre-contractual relationship that may arise. • Address book. We may collect contact details in order to include them in our address book. The groups that may be in the address book are: people who work for suppliers and providers to maintain commercial and business relations, people who are interested in the activities or services of the Restaurant, people who are included in our address book to maintain relations of mutual interest, such as journalists, public relations, etc. In all these cases, the basis for the processing is legitimate interest. The personal data we collect from diners or those who invite them as a gift are those necessary to manage the booking and include name and surname, email, telephone, language, postcode where possible and country of origin. Where necessary, health data related to the safety of the food to be eaten may be collected. The personal data we collect in job applications are the identification data and those included in the applicant’s curriculum vitae for the purpose of managing job vacancies. For the rest of the groups that are included in the contact agenda, the data collected are identification data such as name and surname, e-mail address and, where appropriate, the name of the organisation to which they belong.

3.- Disclosure of your personal data to third parties We may disclose your personal data to the following organisations: To companies that provide services to us and help us operate our business. For example, sometimes a third party may have access to your personal data in order to support our information technology or to handle mailings on our behalf. We have an appropriate processor agreement in place with these third parties.

To our legal advisers and other professional advisers and auditors;

As necessary to comply with a legal requirement for tax administration, for the administration of justice, to protect vital interests or to protect the security or integrity of our databases. The Restaurant receives personal data from citizens from all over the world, but does not plan to communicate this data to countries outside Spain.

4.- Social networks With regard to the social networks TWITTER, FACEBOOK, INSTAGRAM and YOUTUBE whose origin is in the USA, the Restaurant does not communicate personal data to any of these applications. The Restaurant uses social networks for its promotional activities and as a channel of communication for events, news, news, etc. The Restaurant does not guarantee and is not responsible for the legality, reliability, usefulness, accuracy and timeliness of the content of such websites or their privacy practices. Please note that before providing your personal information to these external websites, please be aware that their data protection compliance differs from ours. The user of social networks should be aware that the

data is managed under your responsibility. Comments, photographs or any information that a user includes in comments, on the wall, in publications, or any other space that social networks have are made under the legal conditions and privacy policies of these social networks and the Restaurant is completely unrelated to them.

Your rights under data protection legislation You have various rights under data protection laws. These may include (as applicable): – anyone has the right to know and obtain information about whether or not we at the Restaurant are processing personal data concerning you; – the right to request access to personal data, which means knowing what data we hold about you; – the right of rectification, including the right to require us to correct inaccurate personal data; – the right to request restriction of processing concerning you or to object to the processing of your personal data, – the right to request erasure of your personal data where it is no longer necessary for the purposes for which it was collected; – the right to object to the processing of your data where you have not given your prior consent and there are no compelling legitimate grounds or the defence of any claims; – the right to data portability, including obtaining personal data in a commonly used machine-readable form in certain circumstances, provided that the processing is automated; – the right to withdraw your consent to any processing for which you have previously given such consent. Please note that some of these rights may have restrictions on their execution in the event of legal or other constraints. The maximum time to provide you with a response will be 30 days. You may request your rights by writing to the email address provided for this purpose or by making any enquiries about your rights using the contact channels identified in the introduction. In order to process the request for rights it will be necessary to verify the identity of the applicant and verify that he/she is the owner of the data, so in this communication you must include name, surname, specific request of the request, the address to which you wish to be notified of the response. If necessary, we may ask you for a copy of a document that proves your identity. If you wish, we can send you an appropriate form to help you complete your rights request in accordance with the provisions of Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights. In the event that you need your rights to be protected, you may contact the corresponding supervisory authority or the Spanish Data Protection Agency whose website is www.aepd.es and whose postal address is Calle Jorge Juan 6 in Madrid, post code 28001.

6.- How long will we keep your data? We will keep the data until the legal periods established for its conservation expire, if there is a legal obligation to maintain it, or if there is no such legal period, until the interested party requests its deletion.

7.- Data secrecy and security We treat your data with the utmost respect and use all the security means at our disposal to protect them. We undertake to use and treat your personal data respecting their confidentiality and to use them in accordance with the legitimate purpose, as well as to comply with the obligation to store them and adapt all measures to prevent alteration, loss, unauthorised processing or access, in accordance with the provisions of current data protection regulations. Our website has a security protocol that ensures that your data travels in an integral and secure manner.

8.-Changes to the privacy policy The restaurant reserves the right to make changes to this policy without prior notice in order to comply with new legislation or jurisprudence or to adapt it to the needs of the organisation.

9.- Doubts and questions about this policy We will answer any questions you may have. If you have questions about this policy or if you have privacy issues in relation to your rights, you can contact us at info@txispa.com. Although most questions and issues relating to rights can be handled quickly, complex requests may require more research and time. In such cases, you will be informed regarding the question asked or the nature of the problem within a maximum of thirty days.