Privacy Policy
1. Data Controller
- Controller: Martí Calzada i Muntané (Popaella)
- NIF: 45170625M
- Address: Camí de la Creu, 64 · 17530 Campdevànol (Girona)
- Email: paellas@barcelonapaellas.com
- Phone: 681 81 84 67
2. Purposes, legal bases, and retention
| Purpose | Legal basis (GDPR art. 6) | Retention |
|---|---|---|
| Address inquiries and budget requests (form, email, phone, WhatsApp) | Application of pre-contractual measures at the request of the data subject (art. 6.1.b) | 1 year from the last contact if there is no contracting |
| Manage the reservation, payment, and execution of the catering service | Execution of the contract (art. 6.1.b) | Duration of the relationship |
| Invoicing and compliance with tax and accounting obligations | Legal obligation (art. 6.1.c) | 6 years (Commercial Code) and 4 years for tax purposes |
| Management of allergies, intolerances, and special diets (health data) | Explicit consent of the data subject (art. 9.2.a) | Until the end of the event |
| Sending commercial communications about own services | Consent (art. 6.1.a) or legitimate interest in existing clients (art. 21.2 LSSICE) | Until revocation |
| Photography and video of the service for promotional purposes | Legitimate interest (art. 6.1.f), with prior right of opposition | Indefinite until opposition is exercised |
| Website security and analytics | Legitimate interest / consent according to the type of cookie | See the Cookie Policy |
3. Health data (allergies and intolerances)
When the client communicates allergies, intolerances, or dietary restrictions of the diners, this data is processed exclusively to adapt the service and ensure food safety. It is processed with limited access to strictly necessary personnel and is deleted once the event is over. It is not communicated to third parties except to collaborators who materially execute the service.
4. Recipients of the data
The data may be communicated to:
- Banking entities and payment gateways (BBVA / Redsys) for the management of collections.
- Tax and accounting advisory, for compliance with legal obligations.
- Hosting provider and management software (Odoo S.A., with servers in the European Union), as the data processor.
- External collaborators (chefs, service staff, logistics) strictly regarding the information necessary to execute the event.
- Public administrations and courts, when there is a legal obligation.
No data is transferred to third parties for commercial purposes.
5. International Transfers
If the user communicates with Popaella via WhatsApp, the processing of these communications is governed by the privacy policy of Meta Platforms Ireland Ltd. Similarly, the use of analytics services or social networks may involve transfers to third countries based on adequacy decisions or standard contractual clauses of the European Commission.
6. Rights of the data subjects
You can exercise the rights of access, rectification, deletion, limitation, opposition, portability and not to be subject to automated decisions, as well as withdraw the consent given, by writing to paellas@barcelonapaellas.com or to the indicated postal address, attaching a copy of an identification document.
If you believe that the processing does not comply with the regulations, you can file a complaint with the Spanish Agency for Data Protection (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid) or with the Catalan Data Protection Authority (apdcat.gencat.cat).
7. Security and accuracy of the data
The responsible party applies appropriate technical and organizational measures to ensure the security of the data and to prevent alteration, loss, or unauthorized access. The user guarantees that the data provided is accurate and up to date, and commits to communicate any changes.
8. Minors
This website is not directed at minors under 14 years of age. The owner does not knowingly collect data from minors without the consent of the holder of parental authority or guardianship.