Data controller
The controller responsible for your personal data is:
- Owner : Trattoria Demo SL
- Tax ID : B00000000
- Address : Carrer de la Demostració, 1, 08000, Barcelona, Barcelona
- Email : info@trattoria-demo.example
What data we collect
We only collect the data strictly necessary to provide the services you request.
Table reservation
- Name to identify the reservation.
- Phone to contact you in case of changes.
- Optional notes.
- Date, time and number of guests.
- Email address (to send you the confirmation and the link to cancel the booking).
In the preferences step of the booking you may, if you wish, write each guest's allergies, intolerances, diet or pregnancy. This health data is processed with your explicit consent and only to prepare the service: the restaurant staff can see it and it appears in the confirmation email. It is deleted 30 days after the booking date. You can withdraw your consent at any time by writing to the contact address.
Emails after your booking
If the restaurant has them turned on, after booking it may send you these emails at the address you gave us, in the language you booked in:
- A reminder about 24 hours before, if you booked 24 hours or more in advance. It is part of the booking and still reaches you if you have unsubscribed from the other emails.
- A thank-you email the day after your visit, with a link to leave a review of the restaurant and another to unsubscribe from these emails.
- News from the restaurant, only if you tick the box when booking. We keep when you accepted and the exact text of the box. You can unsubscribe with the link in the thank-you email or by writing to the contact address.
- If the restaurant asks, the occasion you choose (for example, a birthday), so the restaurant knows.
If the restaurant has text messages turned on, the booking or order confirmation may also reach you by SMS at the phone number you gave us. Text messages are sent by Twilio, as a Biga provider.
Pickup order
- Name and phone to identify the order.
- Selected products and quantities.
- Expected pickup time.
- Optional notes.
- Email address (to send you the order confirmation).
Delivery order
- Name and phone.
- Delivery address.
- Selected products and quantities.
- Expected delivery time.
- Optional notes.
- Email address (to send you the order confirmation).
Anti-bot verification
We use Cloudflare Turnstile to prevent automated submissions.
Technical storage
We use the browser's localStorage to remember the selected language and the temporary order cart. We do not use analytics, tracking or advertising cookies. See the Cookie policy for details.
If you place a pickup or delivery order, we save the name, phone number and email you entered in your browser (biga-customer-…) so you don't have to type them again next time. They never leave your device and we don't save your notes. They stay until you delete them: in your browser settings, by clearing this website's data. If you use a shared computer or phone, we recommend deleting them when you finish. The confirmation summary is also kept in the browser session (sessionStorage) and is deleted when you close the tab.
How we use the data
We process your data exclusively to:
- Manage the reservation or order you made.
- Contact you if confirmation or notices are needed.
- Comply with legal obligations.
- Prevent fraudulent or automated use.
- If the restaurant has them turned on: reminding you of your booking, thanking you for your visit and, if you accepted, sending you news.
Legal basis
Processing is based on:
- Contract performance: the reservation or order requested.
- Compliance with legal obligations.
- Legitimate interest: protection against abusive automated use.
Who receives the data
We do not sell or share your data with third parties. It is only processed on our behalf by the providers that help us deliver the service, as data processors under contract (art. 28 GDPR):
- BIGATPV, S.L. (sole-shareholder company), “Biga” (tax ID B05673181): the management software the restaurant uses to handle bookings and orders. It uses the following providers as sub-processors.
- Supabase (database and server, in the European Union — Frankfurt, Germany).
- Vercel (hosting of this website).
- Resend (sending the confirmation and notice emails).
- Mapbox (home delivery only: locating the address to check that it is within the delivery area).
- Cloudflare (Turnstile anti-bot check on the forms).
- Twilio (only if the restaurant has text messages turned on: sending the confirmation by SMS; United States).
We may also have to disclose data to public authorities when required by law (for example, the Spanish Tax Agency).
International transfers
Some of these providers, or their sub-processors, may process data outside the European Economic Area. In those cases the transfer has an appropriate safeguard:
- Vercel, Resend, Cloudflare and Mapbox and, if the restaurant has text messages turned on, Twilio (United States): the European Commission's standard contractual clauses (Decision 2021/914) included in their data processing agreements and, where the company is certified, the EU-US Data Privacy Framework.
- Supabase: the data is stored in the EU, but technical support and some sub-providers may access it from outside; the same standard contractual clauses apply.
You can ask for more information about these safeguards by writing to info@trattoria-demo.example.
How long we keep the data
Data are kept for the minimum necessary period.
- Reservations and orders: up to 4 years.
- Anti-bot data: according to Cloudflare policy.
- LocalStorage: until you remove it from the browser.
User rights
You have the following rights over your personal data:
- Access.
- Rectification.
- Erasure.
- Objection.
- Restriction.
- Portability.
- Withdrawal of consent.
To exercise these rights, write to info@trattoria-demo.example.
If you believe the processing of your data does not comply with regulations, you have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).
Security measures
We apply reasonable technical and organisational measures to protect your data.
Policy changes
This policy may be updated due to legal, organisational or technical changes.
Last updated: 2026-05-20