Privacy policy

Last updated: 27 October 2026

1. Who is responsible

Txakolina Cava Baja, S.L. · Tax ID (CIF) B75352252
Calle de Cava Baja 26, 28005 Madrid (Spain)
Phone: +34 914 85 53 30 · Email: txakolinacavabaja@gmail.com

2. What data we use, why, and on what legal basis

• Bookings. First name, surname, phone, email, number of guests, date, time and comments. We use them to manage your booking, send you the confirmation and reminders and look after you at the restaurant. Basis: performing the booking you ask for (Art. 6(1)(b) GDPR).
• Allergies and intolerances. If you tell us about them, we use them only to prepare your food safely. Basis: your explicit consent when you write them (Art. 9(2)(a) GDPR).
• Card guarantee. On some dates or for groups we ask for a card as a guarantee. Card details are handled by Stripe: we never see or store the card number. Basis: Art. 6(1)(b) GDPR.
• Where the booking came from. If you arrive from an ad or from a link with campaign parameters (for example gclid or utm), we store those parameters, the first page you visited and the website you came from together with the booking, to know which advertising works. We do not use cookies for this. Basis: our legitimate interest in measuring how well our advertising works (Art. 6(1)(f) GDPR); you can object by writing to us.
• Offers and news. If you tick the box, we send you marketing emails. You can unsubscribe from any of them. Basis: your consent (Art. 6(1)(a) GDPR).
• Feedback after your visit. We may send you an email to ask how it went. Basis: our legitimate interest (Art. 6(1)(f) GDPR); you can object from the email itself.
• Membership card (Club Txakolina). If you download it, we process the card details and your visits to give you its benefits. Basis: Art. 6(1)(b) GDPR.
• Enquiries. What you write to us by email, phone or WhatsApp, to answer you. Basis: your request (Art. 6(1)(b) GDPR) and our legitimate interest in replying (Art. 6(1)(f) GDPR).
• Browsing the website. Cookies and similar technologies, according to your choice: see the cookie policy.

3. How long we keep data

• Booking data, including where it came from: up to 2 years after your last visit; then it is deleted or anonymised.
• Allergies and intolerances: deleted together with the booking.
• Marketing emails: until you unsubscribe.
• Membership card: while you keep it active.
• Payment and invoicing data: for the periods required by law (up to 6 years).

4. Who helps us process it

We do not sell or pass on your data. These providers process it on our behalf, under contract:

• Supabase: booking database (servers in the EU, Ireland).
• Netlify: website hosting.
• Resend: booking emails.
• Brevo: marketing emails.
• Stripe: card guarantee.
• Google: Analytics, Ads and Maps, only if you accept them.
• Meta (WhatsApp): only if you choose to receive the confirmation on WhatsApp or write to us there.
• Apple and Google: only if you add the membership card to their digital wallet.

Some of them may process data outside the European Economic Area, for example in the United States. In that case the transfer relies on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses. We only disclose data to authorities when the law requires it.

5. Your rights

You can ask for access, rectification, erasure, objection, restriction and portability of your data, and withdraw any consent you have given at any time, by writing to txakolinacavabaja@gmail.com with the subject “Data protection”. We will reply within one month. If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

6. Security

We protect your data with technical and organisational measures: access only for the staff who need it, encrypted connections and providers with security guarantees.

7. Changes

If we change this policy, we will publish the new version here with its date.

This is a translation; the Spanish version prevails.