Privacy Policy

Data controller

EL TRIBUT RESTAURANT, S.L., as the party responsible for the website, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, other applicable personal data protection legislation, and Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSICE), informs you that it has implemented the technical and organisational security measures necessary to guarantee and protect the confidentiality, integrity and availability of the data entered.

How we obtain data, what data we collect and why

The data we collect, how we obtain it and the purpose of the processing are as follows:

1. CV submission form ('Join the team' page):
Data required: name, email address, telephone number, areas of interest and CV.
Purpose: to include the applicant in current recruitment processes or in future processes for which the candidate may be suitable. For this selection, EL TRIBUT may ask the candidate to take psychometric or skills tests to check whether their profile meets the requirements of the vacancy; these may not be used for any other purpose.
Legal basis: the user's consent.
Retention: application data and CVs are kept for 90 days from submission and then deleted.
Security: to prevent abusive submissions, when an application is sent we store a derived code (hash) of your IP address together with the date, which allows us to limit the number of daily submissions from the same connection. This record is deleted automatically within the following days. Legal basis: the provider's legitimate interest in protecting the form.

2. Table booking ('Book a table' page) and, with your consent, keeping you informed of our news and offers:
Bookings are made in the Covermanager booking module embedded in the website. Covermanager provides this service to EL TRIBUT as a data processor.
Data required: first name, surname, email address, telephone number, the date, time and number of guests of the booking and, where applicable, any comments you give us.
Purpose: to manage your booking and communicate with you about it; and, only if you authorise it, to send you our news and offers.
Legal basis: performance of the booking you request (Article 6(1)(b) GDPR); for commercial communications, your consent.
Measurement: if you accept statistics or marketing cookies, when the booking is completed we send Google Analytics and Google Ads the date, time and number of guests of the booking and the identifier that Covermanager assigns to it, never your name or contact details (see the Cookie Policy).

3. Group and event booking requests (form on the 'Groups & Events' page):
Data required: name, email address, telephone number, company (optional), number of guests, date, time, type of event and the message you write to us.
Purpose: to respond to your request, prepare a proposal and, where applicable, manage the group or event booking.
Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) and your consent, which you give by ticking the box on the form.
Retention: request data is kept for 90 days from submission and then deleted.
Security: to prevent abusive submissions, when a request is sent we store a derived code (hash) of your IP address together with the date, which allows us to limit the number of daily submissions from the same connection. This record is deleted automatically within the following days. Legal basis: the provider's legitimate interest in protecting the form.
Recipients: Vercel (website hosting and receipt of the form) and Microsoft 365 (the email service through which the request is sent and in which we receive it), as data processors.

4. If you buy the gift card through our website (and, with your consent, to send you newsletters):
The purchase is made in the Covermanager purchase module embedded in the 'Gift Card' page; Covermanager provides this service to EL TRIBUT as a data processor.
Data required: the data requested in the purchase form (such as name, email address and telephone number) and payment details. Payment is processed by the payment gateway of the purchase module; EL TRIBUT neither receives nor stores your full card details.
Purpose: contracting our service / purchasing our product.
Legal basis: performance of the purchase contract (Article 6(1)(b) GDPR); for newsletters, your consent.

5. WhatsApp: its use is described in the 'WhatsApp' section of this policy.

6. Performance of the contractual relationship and related administrative, tax and accounting procedures required under current legislation:
Data required: first name and surname, telephone number, address, national ID number (DNI), email address and signature.
Purpose: internal commercial, tax and administrative management.
Legal basis: the data subject's consent and the contractual relationship.

7. Video surveillance: security of some premises.
Data required: image.
Purpose: security of people, property and facilities.
Legal basis: the provider's legitimate interest.

You may withdraw your consent at any time by sending a written request with the subject 'Unsubscribe' to the email address given above.

In accordance with the LSSICE, EL TRIBUT RESTAURANT, S.L. does not engage in SPAM and therefore does not send commercial communications by email that have not been previously requested or authorised by the User. Accordingly, in every communication received from the provider, the User may withdraw their express consent to receive our communications.

We will not process your personal data for any purpose other than those described, except where required by law or by court order. Your personal data will not be used for automated decision-making.

Failure to provide the personal data requested, or failure to accept this privacy policy, will make it impossible to fulfil the purposes described above.

Where there is a prior contractual relationship between the parties, the legal basis for fulfilling the administrative, tax and accounting obligations required under current legislation is the prior existence of the commercial relationship between the parties.

Data retention period

Your data will be kept for as long as necessary for the purpose for which it was collected, where required by law or by court order, and for as long as you do not withdraw your consent or until you exercise your right to erasure, to object or to restriction of processing. However, we will keep your data for the periods laid down by the applicable provisions.

Job application data (CV submission form), CVs included, and group request data are kept for 90 days from submission and then deleted. Data collected by Google Analytics and Google Ads is kept as set out in the Cookie Policy.

Recipients of disclosures and transfers

EL TRIBUT RESTAURANT, S.L. will provide information to the law enforcement authorities under a court order or where required by a legal provision. The information provided will be limited to what the provider holds at that time.

EL TRIBUT RESTAURANT, S.L. will make international data transfers by using the following tools, which are necessary for its activity and may store your data:

Google Analytics 4 and Google Ads (Google Ireland Limited, Ireland, and Google LLC, United States): only if you accept statistics or marketing cookies in the cookie banner, for website usage statistics, measuring advertising results (conversion measurement) and remarketing, with Google Signals enabled. Google receives visit and device data (including the IP address), the completed booking data described in item 2 (date, time, number of guests and booking identifier) and, with Google Signals, the cross-device behaviour of people who are signed in to Google with ad personalisation turned on. No data is sent to Google Analytics or Google Ads before you give your consent. Google LLC is certified under the EU-U.S. Data Privacy Framework, approved by the European Commission. Full information, including how to withdraw your consent, is available in the Cookie Policy.

Vercel (Vercel Inc., United States), as a data processor: hosting of this website and running the functions that receive the website's forms (group requests and job applications), in the European Union region of Frankfurt (Germany). CVs are stored in a private Vercel Blob store in a European Union region. Vercel's data processing agreement includes the European Commission's standard contractual clauses.

Microsoft 365 (Microsoft), as a data processor: email, through which the website's forms (group requests and job applications) are sent to our mailbox and in which we receive the messages you send us. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework.

Covermanager, as a data processor: table booking and gift card sales system, through the modules embedded in the website (see items 2 and 4).

Cookiebot (Usercentrics A/S, Denmark), as a data processor: manages the cookie banner and records your choice. To display the banner, Cookiebot receives your IP address and technical browser data.

Sanity (Sanity AS, Norway, and Sanity US Inc., United States), as a data processor: the website's content management system (menu and blog). Blog images are loaded from its servers, so Sanity receives your IP address and technical browser data when you view those pages. For transfers outside the European Economic Area, Sanity applies the European Commission's standard contractual clauses.

Processing of data by the entities mentioned above, and by any other tool that the provider uses as a data processor, is governed by a data processing agreement between the provider and that company.

In addition, some parts of the website are loaded directly from other companies' servers, which receive data from your browser without going through the cookie banner. These companies process that data in accordance with their own privacy policies. Details are given in the 'Third-party services embedded in the website' section of the Cookie Policy.

Google Fonts and Google Maps (Google Ireland Limited, Ireland, and Google LLC, United States): the website's fonts are loaded from Google Fonts when any page is opened, before any choice is made in the cookie banner, and the home page and the 'Getting here' page include a Google Maps map. Google receives your IP address and technical browser data and, in the case of the map, also the address of the page; Google Maps may set or read its own cookies. Google may process this data in the United States.

Covermanager: table bookings and gift card purchases are made in Covermanager modules embedded in the website. Covermanager receives the data you enter in them, your IP address and technical browser data, and may set or read its own cookies.

Meta (Facebook): the Covermanager booking module loads a Meta pixel, configured and controlled by Covermanager, not by this website. This pixel sends Meta the IP address and technical browser data with a notification that the module has been visited and, when a booking is completed, a booking notification, outside our cookie banner.

Rights of data subjects

As a User and data subject, you may exercise the following rights before EL TRIBUT RESTAURANT, S.L. by sending a letter to the postal address given at the top of this policy or an email to rgpd@eltribut.com, with the subject line 'DATA PROTECTION: DATA SUBJECT RIGHTS'.

• – Right of access: allows the data subject to know and obtain information about their personal data being processed.
• – Right to rectification: allows errors to be corrected and inaccurate or incomplete data to be amended.
• – Right to erasure: allows inadequate or excessive data to be erased.
• – Right to object: the data subject's right to have their personal data not processed, or to have the processing stopped.
• – Restriction of processing: involves marking the personal data held in order to restrict its future processing, for the establishment, exercise or defence of legal claims.
• – Data portability: providing the data subject with the data being processed so that they can transmit it to another controller without hindrance.
• – Right not to be subject to automated individual decision-making (including profiling): the right not to be subject to a decision based on automated processing that produces legal effects or similarly significantly affects you.

As a User, you have the right to withdraw the consent you have given at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

You also have the right to lodge a complaint with the supervisory authority if you consider that your data protection rights may have been infringed (www.aepd.es).

Security measures

The data you provide to us will be treated confidentially. The provider has adopted all the technical and organisational measures and levels of protection necessary to guarantee the security of data processing and to prevent its alteration, loss, theft, processing or unauthorised access, taking into account the state of the art and the nature of the data stored. It is also guaranteed that processing and recording in files, programs, systems or equipment, premises and centres meet the integrity and security requirements and conditions established by current legislation.

Language

The language applicable to this privacy policy is Spanish. Therefore, in the event of any discrepancy between the versions provided in other languages, the Spanish version shall prevail.

Social networks

Please note that EL TRIBUT RESTAURANT, S.L. may have a presence on social networks. The processing of data of people who follow the official pages of EL TRIBUT RESTAURANT, S.L. on social networks (and/or make any link or connection through social networks) shall be governed by this section, as well as by the terms of use, privacy policies and access rules of the social network concerned in each case, previously accepted by the user.

EL TRIBUT RESTAURANT, S.L. will process your data in order to manage its presence on the social network properly, to inform you of the provider's activities, products or services, and for any other purpose permitted by the social networks' rules.

The publication of the following content is prohibited:

• – Content that is allegedly unlawful under national, EU or international law, or that carries out allegedly unlawful activities or breaches the principles of good faith.
• – Content that infringes people's fundamental rights, is discourteous on the network, is offensive or may generate negative opinions among our users or third parties and, in general, any content that EL TRIBUT RESTAURANT, S.L. considers inappropriate.
• – And, in general, content that breaches the principles of legality, honesty, responsibility, protection of human dignity, protection of minors, protection of public order, protection of privacy, consumer protection and intellectual and industrial property rights.

EL TRIBUT RESTAURANT, S.L. also reserves the right to remove from the website or from its corporate social network, without prior notice, any content it considers inappropriate.

In any event, if you send personal information through the social network, EL TRIBUT RESTAURANT, S.L. shall not be liable for the security measures applicable to that platform; Users who wish to know them should consult the specific terms of the network in question.

WhatsApp

The processing of data of people who send an enquiry through the WhatsApp of EL TRIBUT RESTAURANT, S.L. shall be governed by this section, as well as by the terms of use, privacy policies and access rules of the application concerned in each case, previously accepted by the user.

EL TRIBUT RESTAURANT, S.L. will process your data in order to handle your enquiry properly and for any other purpose relating to the administrative management of the service. Your data is shared with WhatsApp Ireland Limited, whose technical security measures guarantee the confidentiality, integrity and availability of your information, as stated in its own privacy policy. No other disclosures are foreseen, except where required by law or by court order.

Your data will be kept for as long as necessary for the purpose for which it was obtained and, once it is no longer needed, it will be duly blocked, archived and kept for the period established by law.

The use of the WhatsApp of EL TRIBUT RESTAURANT, S.L. is prohibited for sending content other than that necessary to answer the enquiry, content that is unlawful under national or international law, content that infringes people's fundamental rights and, in general, content that breaches the principles of legality, honesty, responsibility, protection of privacy, consumer protection and intellectual and industrial property rights.

Changes to this Privacy Policy

EL TRIBUT RESTAURANT, S.L. reserves the right to amend this policy to adapt it to new legislation or case law.

Revocability

The consent given, both for the processing and for the disclosure of data subjects' data, may be revoked at any time by notifying EL TRIBUT RESTAURANT, S.L. under the terms set out in this Policy for the exercise of rights. Such revocation shall in no case have retroactive effect.

Consent to cookies is withdrawn by reopening the cookie banner, using the 'Cookie settings' button at the foot of every page or the one immediately below.

Cookie settings

Legislation

As a general rule, relations between EL TRIBUT RESTAURANT, S.L. and the Users of its online services on this website are subject to Spanish law and jurisdiction, to which the parties expressly submit, and the Courts and Tribunals of Barcelona shall have jurisdiction to resolve all disputes arising from or relating to their use.