Layered information · GDPR
Privacy policy
Informative translation · the Spanish version prevails
Technical and regulatory review: 14 September 2026Controller and contact
The controller is the operator identified in this document. Privacy requests are received through the dedicated address shown below.
Browsing and security
The host may process IP address, date, requested URL, technical identifiers and device data to deliver content, prevent abuse and investigate incidents. The legal basis is legitimate interest in a secure, available service, subject to a documented balancing test.
The server writes no access logs. Its technical log (errors and security events, which may include the IP address of an attempt to reach the cockpit) is kept for 30 days and then removed automatically. DECAJOLI S.L. does not export or extend them unless an incident, claim or legal duty justifies keeping a copy for the strictly necessary period.
External map
Google Maps stays blocked until a visitor expressly asks to display it. The legal basis for that load is your consent (Article 6(1)(a) GDPR). You may choose not to click: the address, phone and directions link remain available.
From that moment Google LLC, in the United States, may receive the IP address, browser and other technical data and process them under its own terms. That disclosure is an international transfer covered by the EU-US Data Privacy Framework. Directions open the requested external service directly. Armonia stores that choice in no cookie: the map is blocked again on the next visit.
Measurement and advertising · not active
The Google tag, Google Analytics 4 and Google Ads conversion measurement are not active in this version. Armonia therefore sends these services no browsing events, advertising identifiers or conversions.
If activated, they will be used to measure aggregated site usage and, where applicable, attribute clicks on “Book” to campaigns. Analytics and advertising categories will remain blocked by default until an express choice is made. Rejecting will be as easy as accepting, and consent can later be withdrawn through a permanent settings link.
Private cockpit
Authorised administrators’ account identifiers and actions are processed for authentication, permissions, menu protection and traceability. A session expires after 30 days at most, and always after 24 hours without activity.
Audit records are kept for 24 months and then erased or anonymised. The account is kept for as long as the relationship with that administrator lasts.
Online booking
When a table is booked online, the name, email address, phone number, date, time, number of guests, booking language, status and, where written, a free-text request of up to 280 characters are processed. The purpose is to manage the booking: confirm it, change it, cancel it and send a reminder the day before.
The legal basis is performance of the contract and pre-contractual steps requested (Article 6(1)(b) GDPR). Prevention of repeated no-shows relies on legitimate interest (Article 6(1)(f)) and uses an irreversible cryptographic fingerprint of the email address or phone number. Booking never requires accepting marketing messages.
Data is processed on behalf of DECAJOLI S.L. by Steeve Guille, a natural person trading under the business name “Easy Studio”, Deigné 123, 4920 Aywaille, Belgium, company and VAT number BE 1039.713.702, acting as processor. The server and database are hosted by Hetzner Online GmbH in Falkenstein (Saxony, Germany). Emails are sent through Sendinblue SAS, trading as Brevo, 17 rue Salneuve, 75017 Paris, France; that provider measures when messages are opened by means of a tracking image and rewrites the links in the message, including the personal booking management link, which therefore passes through it. The module installs no cookie and no browser storage, and embeds no tracker.
Identifying data is erased or anonymised thirty days after the service. The no-show fingerprint expires after twelve months. The rights described below are exercised with the controller, at the address given in this document.
Providing the name, email address and phone number is necessary to manage the booking: without them it cannot be confirmed. You may object to the processing based on legitimate interest and complain to the Spanish Data Protection Agency.
Recipients and transfers
The site, its database and its logs are hosted by Easy Studio, Steeve Guille (Belgique), serveur Hetzner Online GmbH, in Union européenne (Falkenstein, Allemagne). The database and administrative authentication are provided by Easy Studio, PostgreSQL sur le même serveur, in Union européenne (Falkenstein, Allemagne). These providers act as processors, under an Article 28 GDPR contract, and process the data only on the controller’s instructions.
Google LLC receives data only when the map is displayed or directions are opened, as explained above. Outside that case the public site discloses no data to third parties, sells no personal data, builds no advertising profile and takes no automated decision producing legal effects.
No data protection officer has been appointed: the processing does not fall within the cases of Article 37 GDPR. Requests are received at the email address given at the top of this document.
Rights
You may request access, rectification, erasure, objection, restriction and portability where applicable, and withdraw consent without retroactive effect. Identity will be checked proportionately and a response is generally provided within one month.
You may complain to the Spanish Data Protection Agency or contact the controller first to seek a resolution.
The data requested by the booking form, when the service is active, is necessary to manage the table: without it the booking cannot be confirmed. No other part of the public site asks for personal data.