Data Controller
| Manager | GRUPO MONTANA SEVILLA, Ltd. |
|---|---|
| National Insurance Number | B67658245 |
| Address | Calle San Pablo, 17, 41001 Sevilla (Spain) |
| info@cocteleriamontana.com | |
| Telephone | +34 611 735 002 |
A Data Protection Officer has not been appointed as the circumstances making their appointment mandatory pursuant to Article 37 of the GDPR.
Personal Data, Purposes, and Legal Bases
2.1. Reservation Management (Table and Flamenco Show)
| Data processed | Name, surname, email, telephone, reservation details (date, time, number of people). For the flamenco singing session, also the details required to process payment. Payment details are processed entirely by the external payment gateway; the Company does not access the full card number. |
|---|---|
| Purpose | Process reservations (for tables and flamenco singing sessions), issue confirmations, manage changes and cancellations. |
| Legal basis | Contract execution (Article 6.1.b GDPR) for the management of the booking. Legal obligation (Article 6.1.c GDPR) for invoicing and compliance with fiscal and accounting obligations. |
| Conservation | Contractual relationship duration + 4 years (tax obligations, General Tax Law), 5 years (civil actions statute of limitations, Civil Code), and 6 years (accounting and commercial documentation, Art. 30 Commercial Code). |
| Compulsory | Necessary to formalise the booking. Refusal to provide the details prevents completion of the process. |
2.2. WhatsApp Business Communications
We distinguish two purposes with different legal bases:
| Purpose | Legal basis |
|---|---|
| Customer service and booking management (responding to enquiries, confirming/modifying bookings) | Pre-contractual measures or performance of a contract (Art. 6.1.b GDPR) |
| Promotional communications (offers, events, news) | Express and revocable consent (Art. 6.1.a GDPR and Art. 21 LSSI-CE) |
- Meta Platforms Ireland Limited participates in the provision of the service in accordance with its conditions and the applicable processing terms and conditions.
- The messages are protected by end-to-end encryption.
- We will not send promotional communications without prior express consent.
- You can withdraw your consent for promotions at any time without affecting your booking management communications.
2.3. Web Analytics
| Data processed | IP address (anonymised), pages visited, browsing time, device type, browser, traffic source. |
|---|---|
| Purpose | Statistical analysis of Website usage to improve user experience. |
| Legal basis | Consent (Art. 6.1.a GDPR). Analytical cookies are only installed after express consent on the cookie banner. |
| Provider | Google LLC (United States) — Google Analytics 4. |
Protective measures Google Analytics 4 does not record or store individual IP addresses of users from the European Union. The IP address is only used to derive approximate location data and is discarded before it is recorded. Furthermore, Google Consent Mode v2 is used to adjust tag behaviour based on user consent.
2.4. Embedded Content (Google Maps)
| Data | IP address, browsing data. |
|---|---|
| Purpose | Show interactive establishment location. |
| Legal basis | Consent (Art. 6.1.a GDPR). The map is only loaded after user consent. |
| Provider | Google LLC (United States). |
2.5. Newsletters and commercial communications
| Data | Email, name (optional). |
|---|---|
| Purpose | Sending information about experiences, events, promotions, and news. |
| Legal basis | Express consent (Art. 6.1.a GDPR and Art. 21 LSSI-CE). Obtained via a separate, non-pre-ticked checkbox. |
| Conservation | Until consent is revoked. |
2.6. Contact Form
| Data | Name, email, message. |
|---|---|
| Purpose | Respond to user queries. |
| Legal basis | Consent (Art. 6.1.a GDPR). |
| Conservation | 1 year since last communication. |
2.7. Social media
| Data | Cookie identifiers, IP address, interaction data. |
|---|---|
| Purpose | Allow content sharing, display social media feeds. |
| Legal basis | Consent (Art. 6.1.a GDPR). Widgets are only loaded after consent for third-party cookies. |
| Suppliers | Meta Platforms Ireland Limited (Facebook, Instagram). |
2.8. Customer Reviews (Trustindex / Google)
| Data shown | Reviewer name, review text, rating, date (public data from Google Business Profile). |
|---|---|
| Purpose | Show verified customer reviews from Google to help the user make a decision. |
| Legal basis | Legitimate interest (Art. 6.1.f GDPR): opinions are data voluntarily published by users themselves on a public platform (Google). |
| Widget provider | Trustindex Ltd. (Hungary, EU). |
| Data source | Google Business Profile (Google LLC, USA). |
The reviews are displayed as they appear publicly on Google. The Company does not edit, modify, or select the reviews displayed by the widget. If an author wishes for their review not to appear on the Website, they can contact us at info@cocteleriamontana.com to manage your review directly on Google.
2.9. Advertising and conversion measurement (Google Ads, Meta Ads)
| Data processed | Advertising cookie identifiers, IP address, browsing data and ad interaction data. |
|---|---|
| Purpose | Display personalised adverts, measure the effectiveness of advertising campaigns (conversions), remarketing to users who have visited the Website. |
| Legal basis | Consent (Art. 6.1.a GDPR). Advertising tags are only activated after express consent in the cookie banner. |
| Suppliers | Google LLC (Google Ads, conversion linker) and Meta Platforms, Inc. (Meta Ads/Facebook Pixel). |
| Transfers | United States, under the EU-U.S. Data Privacy Framework (both providers are listed as active participants in the Data Privacy Framework as of the date of this Policy). |
First Information Layer in Forms
As per the recommendations of the Spanish Data Protection Agency (AEPD), data protection information is provided in layers:
- First layer (contextual) At each data collection point (booking forms, contact, newsletter), a summary is displayed showing the identity of the controller, the purpose, the legal basis, the forecast of disclosures or transfers, and a reference to the exercise of rights with a link to this Privacy Policy.
- Second layer (this page): Comprehensive and detailed information on all data processing.
The first-layer information relating to the specific processing is displayed on each data collection form.
International Data Transfers
Certain service providers used by the Website are established in the United States. Data transfers to such providers are covered, depending on the specific provider and service, by the following safeguards:
- Adequacy décision EU-U.S. Data Privacy Framework, approved by the European Commission on 10 July 2023, for certified providers within said framework.
- Adequate guarantees Standard Contractual Clauses approved by the European Commission, where the supplier is not certified under the DPF or as supplementary guarantee.
The interested party may request additional information on the guarantees applicable to transfers by contacting info@cocteleriamontana.com.
Data Recipients
5.1. Service providers
| Provider | Service | Role | Location |
|---|---|---|---|
| TuriTop S.L. | Flamenco singing session and ticket booth bookings | Processor (Article 28 GDPR) | Spain/EU |
| CoverManager | Table reservations | Processor (Article 28 GDPR) | Spain/EU |
| BBVA, S.A. | Virtual POS (Point of Sale) payment processing | Independent payment data controller | EU |
| Google Ireland Limited / Google LLC | Analytics, Maps, Ads | Responsible or in charge according to service and configuration | Ireland / USA. |
| Meta Platforms Ireland Limited / Meta Platforms, Inc. | WhatsApp Business, Meta Ads, social widgets | Responsible or in charge according to service and configuration | Ireland / USA. |
| Web company | Web hosting | Data Controller | EU |
| Trustindex Ltd. | Google Reviews Widget | Technology provider / manager or responsible person as configured | Hungary / EU |
The providers acting as data processors have signed the corresponding contracts in accordance with the Article 28 of the GDPR. Those acting as independent controllers have their own privacy policies.
The concrete classification of each supplier as a data controller, independent controller, or joint controller will depend on the service used, the configuration applied, and the applicable contractual terms of each supplier.
5.2. Other recipients
- Public authorities When there is a legal obligation (Tax Agency, Courts, etc.).
- Financial institutions To process returns when applicable.
We do not sell, rent or offer personal data to third parties for their own commercial purposes.
Retention Periods
| Data type | Term |
|---|---|
| Contractual data, reservations, invoices, and accounting vouchers | During the contractual relationship and, subsequently, during the applicable statutory periods: 4 years for tax purposes (General Tax Law), 5 years for potential civil actions (Civil Code) and 6 years for accounting and commercial documentation (Art. 30 Commercial Code). |
| Enquiries and contact | 1 year since last communication |
| Marketing consent | Until further notice |
| Analytics cookies | Maximum 14 months (according to GA4 configuration) |
| Server logs | In accordance with the hosting security policy (technically necessary period) |
Once the deadlines have passed, the data is securely deleted or irreversibly anonymised.
Rights of the Data Subject
You can exercise the following rights recognized in the GDPR:
- Access Obtain confirmation of whether we process your data and a copy of it.
- Correction correct inaccurate or incomplete data.
- Suppression request deletion when no longer required.
- Limitation Request a temporary suspension of treatment.
- Portability receive structured data and transmit it.
- Opposition Object to treatment based on legitimate interest.
- Revocation withdraw consent at any time.
- No automated decisions not be subject to automated decisions with legal effects.
Procedure
- E-mail: info@cocteleriamontana.com Subject: Exercising Rights — Data Protection.
- Royal Mail GRUPO MONTANA SEVILLA, S.L., Calle San Pablo, 17, 41001 Sevilla (Spain).
- Requirements Clearly state the right to be exercised and specify in relation to which data or processing. Where there are reasonable doubts concerning the identity of the applicant, additional documentation may be requested to verify it.
- Response timeframe: Maximum 1 month (extendable to 2 months in complex cases, with prior notification).
Right to claim
If you believe the treatment does not comply with regulations, you can lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es. We invite you to contact us first to resolve any issues amicably.
Data Security
We have implemented technical and organisational measures in accordance with Article 32 of the GDPR:
- SSL/TLS encryption on all communications.
- IP anonymisation in analytics tools.
- Restricted access to personal data (authorised personnel only).
- Agency agreements with all suppliers acting as agents.
- Periodic backups.
- Security monitoring and vulnerability detection.
In the event of a personal data security breach which is likely to result in a risk to the rights and freedoms of natural persons, the Spanish Data Protection Agency, when appropriate, without undue delay and, if possible, within a maximum period of 72 hours since it has been recorded, in accordance with the Article 33 of the GDPR. When a breach is likely to result in a high risk to the individuals concerned, they will be notified in accordance with Article 34 of the GDPR.
Children's data protection
In relation to the collection of personal data via the Website:
- The hiring of services and use of forms are aimed at Over 18s.
- Children under 14 years old must not provide personal data without the consent of their parents, guardians or legal representativesArt. 7 LOPDGDD).
- If we detect data from minors collected without valid consent, we will proceed with its deletion.
Regarding the attendance of minors at flamenco singing sessions, please consult the Terms and Conditions of Sale.
Automated decisions and profiling
No automated decisions are made, nor is profiling carried out which has legal effects or similarly significantly affects the user.
Modifications
This Policy may be updated to accommodate legislative changes or new treatments. Significant changes will be communicated via the Website. The date of the last update is shown at the beginning of the document.