In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Act 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), users of this website are informed about the processing of their personal data.
Data controller
The owner of this website and controller of the personal data is [TO BE COMPLETED: owner's name], with registered address at C. el Carretón, 4-7, 38550 Arafo, Santa Cruz de Tenerife, tax ID [TO BE COMPLETED: tax ID], and contact e-mail for data protection matters protecciondedatos@lacarretadelcarreton.com.
Principles applying to the processing
The personal data provided will be processed lawfully, fairly and transparently, and limited to what is strictly necessary for the purposes for which it is processed. The controller adopts the technical and organisational measures needed to guarantee the security, integrity and confidentiality of the data, preventing its alteration, loss, unauthorised processing or unauthorised access.
Personal data processed
Through this website and other communication channels, the controller may process, among others, the following data: identification data, postal and e-mail addresses, contact information, and commercial data relating to the services requested.
Specifically, the forms on this website collect the data you type into them:
- Contact and booking form: name, e-mail address, telephone number and the message you write to us.
- Catering quote form: name, e-mail address, telephone number, number of guests, date and place of the event, type of celebration, and a free-text field for allergies, timings and anything else we should know.
If you write to us by e-mail or call us, we will process the data you provide in that communication. The user warrants that the data provided is truthful, accurate, complete and up to date, and is responsible for any damage arising from a breach of this obligation. If the user provides third-party data, they declare that they have previously informed those people of the content of this policy and obtained their consent where necessary.
Purposes of the processing
- Responding to enquiries, requests for information or messages received.
- Handling quotes, bookings, contracts and the provision of the services requested.
- Maintaining the commercial and administrative relationship with customers and potential customers.
- Sending commercial or informative communications, where there is consent or a sufficient legal basis.
- Complying with the legal obligations applicable to the controller.
A booking requested through the form is not confirmed until you receive our reply.
Legal basis for the processing
- The consent of the data subject, where required.
- Performance of a contract or pre-contractual measures at the data subject's request.
- Compliance with a legal obligation.
- The legitimate interest of the controller, where applicable and in line with current legislation.
Data retention
Personal data will be kept for as long as necessary to fulfil the purpose for which it was collected and to address possible legal liabilities, unless the applicable legislation sets a different retention period.
Disclosure of data to third parties
Personal data will not be disclosed to third parties except where legally required. Where applicable, data may be disclosed to public authorities and tax, employment or judicial authorities. No international data transfers are planned.
The forms on this website are run with a technology provider acting as data processor, with access to the data solely in order to provide that service and under a contract in line with article 28 GDPR.
Data collected through forms
Personal data is collected, among other means, through the forms available on the website. In those forms the user must expressly accept this privacy policy by ticking the corresponding box, which is never pre-ticked. If the policy is not accepted, the form cannot be submitted.
Your rights
You may exercise, on the terms set out in current legislation, your rights of access, rectification, erasure, restriction of processing, objection and portability, and you may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
To exercise these rights you can contact the controller at protecciondedatos@lacarretadelcarreton.com or at C. el Carretón, 4-7, 38550 Arafo, Santa Cruz de Tenerife, writing «Protección de datos» in the subject line. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe the processing does not comply with the legislation.
Commercial communications
In accordance with Spanish Act 34/2002 on Information Society Services and Electronic Commerce, the controller will request the user's consent to send commercial communications by electronic means where legally required, and the user may object to receiving such communications at any time.
Cookies
This website uses data storage and retrieval devices («cookies») only where the user has given prior consent, as set out in the pop-up shown on first visit and on the terms detailed in the cookie policy.
Updates to this policy
This privacy policy may be updated to reflect changes in the legislation or in the controller's activity. Users are advised to review it periodically.
This English text is a translation provided for information. The Spanish version is the binding one: if there is any discrepancy, the Spanish version prevails.