Last updated: 26 June 2026

Data controller

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), the user is informed of the following identifying details of the data controller:

Purpose of data processing

The personal data collected through the website will be processed for the following purposes, depending on the channel through which it is provided:

• Contact form and events form: to handle enquiries, requests for information and quote requests sent by the user; to manage the organisation of private events, company dinners, tastings and celebrations; and to maintain the communication necessary to provide the service.

• Table reservations: to manage the availability and confirmation of reservations at the restaurant. Reservations are processed through the external platform Restoo, to which the user is redirected when clicking the booking button.

• Browsing analysis: to obtain aggregated statistics on website usage, browsing behaviour and page performance for the purpose of improving the service.

No automated profiling is carried out, nor are individual decisions taken based solely on automated processing that produce legal effects on the user.

Legal basis for processing

The legal basis that legitimises the processing of the user’s personal data is as follows:

• Consent of the data subject (art. 6.1.a GDPR), given expressly when submitting the contact or events form, by ticking the acceptance box for this policy, as well as when accepting non-strictly necessary cookies through the consent banner.

• Performance of a contract or pre-contractual measures (art. 6.1.b GDPR), in cases where the user requests information for contracting a service (organising an event, booking a private hire of the space, etc.).

• Legitimate interest of the controller (art. 6.1.f GDPR) to respond to the user’s communications and maintain the minimum necessary commercial contact.

Data retention period

The personal data provided through the website forms will be kept for as long as the relationship with the user is maintained and, once it has ended, until the data subject requests its deletion, with a maximum period of one year from the last effective contact without activity.

Data relating to legal, tax or accounting obligations, where applicable, will be kept for the periods required by the applicable regulations.

Data processed for statistical purposes through Google Analytics 4 is retained in accordance with the periods configured in the tool and its policies.

Data recipients and transfers to third parties

The user’s personal data will not be transferred to third parties except by legal obligation. However, to provide certain website services, providers are used that may access the data as data processors:

• Google Ireland Limited, provider of the Google Analytics 4 and Google Tag Manager services, used for the website’s browsing analysis and tag management. Google Tag Manager acts as a tag container and does not itself collect identifiable personal data of the user. Google Analytics 4 does process data such as client identifiers, IP address (anonymised or truncated), browsing events, device and approximate location, in order to generate aggregated website usage statistics. These processing activities may involve international data transfers to the United States, covered by the EU-US Data Privacy Framework and the standard contractual clauses approved by the European Commission.

• Google Ireland Limited, in its capacity as provider of the Gmail email service, through which the communications sent via the website forms are received and stored.

• Restoo, an external platform to which the user is redirected to manage table reservations. When the user accesses that platform, their data processing is governed by the provider’s own terms and privacy policies, separate from Es Pati.

• Hosting provider, responsible for the technical hosting of the website, with servers located within the European Union.

User rights

The user may exercise at any time the following rights recognised by data protection regulations:

• Right to access to their personal data.

• Right to erasure of the data when it is no longer necessary.

• Right to rectification of inaccurate or incomplete data.

• Right to restriction of processing in the cases provided for by the regulations.

• Right to portability of the data in a structured, commonly used format.

• Right to object to processing for reasons relating to their particular situation.

• Right to withdraw consent given at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

• Right not to be subject to automated individual decisions with significant legal effects.

These rights may be exercised by sending a communication to espatimallorca@gmail.com, indicating «Data protection» in the subject of the message and attaching a copy of the applicant’s identity document.

The user also has the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es) if they consider that the processing of their data infringes the applicable regulations.

Data accuracy

The user guarantees the authenticity and accuracy of all data they provide through the website forms, undertaking to keep it up to date. They shall be solely responsible for any false or inaccurate statements they make and for any harm these may cause to the data controller or third parties.

Security measures

The data controller applies the appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with article 32 of the GDPR, preventing the loss, alteration or unauthorised access to the personal data processed.

Minors

The website is not directed at minors under fourteen years of age. If the sending of data by a minor without the consent of their parents or legal guardians is detected, such data will be deleted immediately.

Cookies

The website uses its own and third-party cookies for technical, analytical and browsing-experience improvement purposes. For detailed information about the cookies used, their purpose and how to manage them, please see the Cookie Policy.

Changes to the privacy policy

Es Pati reserves the right to modify this privacy policy to adapt it to legislative developments or changes in the processing carried out. In such cases, the changes will be announced on the website with reasonable notice before they take effect.