How we handle your data

Who is responsible for your data

What we collect and why

• If you book: your name, your phone number, the day, the time, how many of you there are and anything you tell us in the notes. It is used to keep your table and to let you know if there is any problem.
• If you order: the same, plus what you ordered and which table it is for or what time you will collect it. It is used to prepare it and to charge you at the restaurant.
• If you press “Notify me when the restaurant confirms”: your browser’s notification subscription, which is a technical address and two encryption keys. It is used only to send you a notification when the restaurant confirms, cancels or changes that booking. The notification travels end-to-end encrypted through your browser’s notification service (Apple, Google or Mozilla) and carries the restaurant’s name, the day, the time and the number of guests: never your name, your phone number or your notes.
• “My bookings”: this device stores in its own memory the reference of your bookings (identifier, day, time and number of guests) so that you can see them in “My bookings”; it does not leave the device except to ask the restaurant for its current status, and it is deleted automatically one month after the booking.
• If you turn on any notification in “Notification settings”: your browser’s notification subscription (a technical address and two encryption keys), the language of the website and which notifications you have chosen: your bookings, special days and opening hours, or news from the restaurant. It is used only to send you the type of notification you have turned on. That subscription does not carry your name or your phone number. With “My bookings” turned on, the new bookings you make from this phone are linked automatically to the booking notifications described above.

There is no advertising, no tracking, and we do not use your data to profile you. Nor do we combine it with anything else. The notifications you choose in “Notification settings” are the only exception, and they only arrive if you turn them on.

On what legal basis

Because you ask us to: handling a booking or an order is what is needed to serve you. If you don’t give us your name and phone number we cannot keep your table, and there is no other purpose behind it.

In legal terms: performance of a contract, or steps taken at your request before entering into one (Article 6(1)(b) GDPR).

Booking notifications are different: they are only switched on if you press the button, and you can stop receiving them whenever you like, by blocking this website’s notifications in your browser or by writing to us.

In legal terms: your consent (Article 6(1)(a) GDPR), which you give by pressing the button and can withdraw at any time.

The notifications you choose in “Notification settings” are commercial communications from the restaurant — a special day, a change of opening hours, “paella today”. We only send them if you turn on each type separately, and you can stop receiving them whenever you like by turning the switch off in “Notification settings”, by blocking this website’s notifications in your browser or by writing to us.

In legal terms: your consent for each type of notification (Article 6(1)(a) GDPR and Article 21 of Spanish Law 34/2002 on information society services), which you give by turning on each switch and can withdraw at any time.

If you tell us about an allergy

The notes field is free text and you can tell us whatever you like there. If you write down an allergy or an intolerance, that is health data and it is more strongly protected than the rest. If you tell us about an allergy or an intolerance, we use it only to prepare your food safely and it is deleted along with the rest of the booking.

You don’t have to tell us here. If you prefer, tell us when you arrive or over the phone and it won’t be written down anywhere.

How long we keep it

• Bookings: 365 days from the day of the booking, after which they are deleted.
• Orders: 90 days for the name and phone number. After that they are removed from the order and only the dishes and the amount remain, which do not say who you were.
• Booking notifications: until the day of the booking has passed; then they are deleted.
• Notifications you choose: until you turn all three off, or until 12 months pass without you changing anything; then they are deleted. If your browser’s notification service tells us the subscription no longer exists, it is deleted straight away.

Who else sees it

Nobody buys it or receives it for their own purposes. Only so that this works, it is handled by Marian Vasilof, who develops and maintains this application on behalf of the restaurant, without using the data for any purpose of their own, and by the services that host the application.

• Vercel, to host and serve the website — United States, under the EU-US Data Privacy Framework, under which it is certified.
• Neon, to store bookings and orders — Frankfurt (Germany), within the European Union.
• Resend, to send us the notification of a new booking, without your name or phone number — United States, under the EU Standard Contractual Clauses and the EU-US Data Privacy Framework, under which it is certified.
• If the restaurant uses its own calendar (Google, Apple…) to organize service, your booking's name, day, time and number of diners may appear in it. This is not our service: the restaurant chooses and manages it.

If you would like to see in writing the safeguards under which your data leaves the European Union, ask us and we will send them to you.

What you can do

You can ask us to:

• · see what we hold about you
• · correct it if it is wrong
• · delete it
• · stop using it while we review it, or object to our using it
• · take it elsewhere in a readable file

Writing to hola@casa-aurora.invalid or calling +34 600 000 200 is enough, and you don’t have to give any reason.

If you think we have not handled it properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).

Cookies

We do not use tracking or analytics cookies, so you won’t see any banner asking for your consent. The only things stored on your phone are what the app needs to work: your basket while you order and whether you prefer light or dark mode. They stay on your device and go nowhere.