Privacy policy

This English version is provided for convenience only. In the event of any discrepancy, the Spanish version shall prevail.

In compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), we provide you with the following information on the processing of your personal data.

1. Who is the controller of your data?

“La Taberna del Herrero” is the trade name under which the following companies operate as data controllers:

• Hostelería de Bulnes, S.L. — Tax ID (CIF) B39812425
• Hostelería de Bejes, S.L. — Tax ID (CIF) B39853643
• Hostelería de Pembes, S.L. — Tax ID (CIF) B19844414
• Hostelería de Mogrovejo, S.L. — Tax ID (CIF) B39796396

Contact details common to all of them:

• Address: Calle El Castro, 24 - Piso 1A, 39011 Santander (Cantabria)
• Email: latabernaoficina@gmail.com
• Telephone: 942 05 54 19
• Website: www.latabernadelherrero.es

You can contact us through any of these channels about anything related to your data. We are not required to appoint a data protection officer, so we will deal with your queries directly at the email address above.

2. What data do we collect through the website?

We only process the data you give us. In the contact form we collect:

• Name (required), so that we know who is writing to us and can address you.
• Email (required), to reply to you.
• Telephone (optional), in case it is quicker to reply that way.
• Subject (required): the reason for your enquiry.
• Chosen restaurant (optional), to send your message to the right establishment.
• Day and time and number of guests (required if you are asking to book a table; optional for any other enquiry), so that we can prepare your table or your celebration.
• Message (required): whatever you decide to write.

Required fields are marked in the form. If you do not fill them in, or if you do not tick the box accepting this policy, the form is not sent and we will not be able to help you.

With each message, our system also records the IP address it is sent from and the browser (user agent) of the device. These two items are collected solely as an anti-fraud and anti-spam measure, to detect automated submissions and abuse of the form; we do not use them to build profiles, measure audiences or for advertising. The legal basis is our legitimate interest in the security of the site (Article 6.1.f GDPR).

If you write to us from the English version of the website, we also note the language (English), only so that we can reply in it.

We also keep proof of your consent (the date and time you accepted this policy when sending the form), so that we can show that we informed you, as required by Article 7.1 GDPR.

As for cookies, this site only sets two first-party technical cookies: a session cookie and another that remembers your cookie choice. We do not use analytics or third-party cookies. You will find the details in our cookie policy.

3. For what purposes do we process your personal data?

• To answer your enquiries, requests or petitions and manage the service you ask us for.
• To process and manage bookings, celebrations, group menus and catering services, including preparing and following up quotes.
• To keep in touch with you as needed about that request, by email or by telephone.
• To issue the invoice and meet our accounting and tax obligations when you book a service.
• To prevent fraud, spam and abuse of the form, and to keep the site secure.
• To manage the job applications you send us.

We do not send marketing communications or newsletters. If we ever did, it would only be with your prior, express consent, and you could unsubscribe at any time.

4. How do we process your data on the online booking platform?

Our online booking platform lets you book a table directly at our restaurants. To do so we process:

• First name and surname, to identify the booking when you arrive.
• Email and telephone, to confirm your booking and let you know about any changes.
• Date and time of the booking, number of guests and chosen restaurant, to allocate the table and organise the service.
• Comments or special requests you wish to tell us about (a particular table, a celebration, accessibility, food allergies or intolerances).

The legal basis for processing this data is the performance of a contract and the taking of pre-contractual steps at your request (Article 6.1.b GDPR): without it we cannot book your table.

Special care is taken with food allergies and intolerances: they are health data and belong to the special categories of Article 9 GDPR. We only process them if you decide to tell us and tick the specific box next to the field, that is, with your explicit consent (Article 9.2.a GDPR). Their only purpose is to adapt the service in the kitchen and in the dining room so that you can eat safely: they are shared with the restaurant staff who prepare and serve your table and with no one else. Providing them is voluntary —you can book without mentioning them and tell us in person when you arrive— and you can withdraw that consent whenever you wish, without affecting the lawfulness of the earlier processing.

This information is not used to build profiles or for advertising, nor is it disclosed to third parties outside the service.

5. What is the legal basis for processing your data?

• Your consent (Article 6.1.a GDPR): sending the contact form requires ticking the box accepting this privacy policy first. That act constitutes your free, informed and unambiguous consent.
• Performance of a contract and pre-contractual steps (Article 6.1.b GDPR): bookings, quotes for groups and catering, and providing the service booked.
• Legitimate interest (Article 6.1.f GDPR): recording the IP address and browser to prevent fraud and spam, and to protect the security of the site and our systems.
• Compliance with a legal obligation (Article 6.1.c GDPR): invoicing, accounting and tax obligations, under tax and commercial law.
• Explicit consent (Article 9.2.a GDPR): health data, specifically the food allergies and intolerances you tell us about when booking.

You can withdraw your consent at any time by writing to us at latabernaoficina@gmail.com, without affecting the lawfulness of the processing carried out beforehand.

6. Who do we share your personal data with?

We do not sell your data or pass it on to third parties for commercial purposes. It is accessed only by the following data processors, with whom we have signed the contract required by Article 28 GDPR:

• Web hosting: Hostinger International Ltd. (Lithuania), with servers in the European Union. It hosts the site and the messages received through the form.
• Email: Google Ireland Ltd. (Ireland), the mailbox where we receive the notice of each message and booking confirmations. This may involve international transfers to the United States, covered by the adequacy decision on the EU-US Data Privacy Framework adopted by the European Commission.

In addition, and only where there is a legal obligation or it is essential to provide the service, we disclose data to:

• The Spanish Tax Agency (Agencia Estatal de Administración Tributaria) and our tax and accounting advisers, for invoicing and tax returns.
• Banks and financial institutions, to collect payment for the service provided.
• The Spanish police and security forces (Fuerzas y Cuerpos de Seguridad del Estado), judges and courts, where legally required or to bring or defend claims.

7. How long do we keep your personal data?

• Contact form messages: 12 months from the last communication, after which they are deleted. The associated IP address and browser are deleted together with the message.
• Bookings: for as long as needed to provide the service and, afterwards, for as long as any liability may arise. Health data (allergies and intolerances) is deleted once the service has been provided, unless you ask us to keep it for future visits.
• Invoicing and accounting data: for the legal retention periods under tax law (four years, under the Spanish General Tax Law) and commercial law (six years, under the Spanish Commercial Code).
• CVs: one year from receipt; after that period we securely destroy them.

In all cases we keep the data for as long as there is a legal obligation to do so or for as long as liability arising from the processing may be claimed, taking into account the limitation period for legal action.

8. What rights do you have and how can you exercise them?

The law grants you the following rights:

• Access: to know whether we process your data and obtain a copy of it.
• Rectification: to correct inaccurate data or complete incomplete data.
• Erasure: to ask us to delete it when it is no longer needed or you withdraw your consent.
• Objection: to object to processing based on our legitimate interest.
• Restriction of processing: to ask us to keep it without using it in certain cases.
• Portability: to receive your data in a structured, commonly used and machine-readable format, or to have us send it to the controller you indicate.
• Withdrawal of consent: to revoke it at any time, without retroactive effect on processing already carried out.

To exercise them, email us at latabernaoficina@gmail.com or send a letter to Calle El Castro, 24 - Piso 1A, 39011 Santander (Cantabria), stating the right you are exercising and enclosing a copy of your ID card or equivalent document if we have reasonable doubts about your identity. If you prefer, you can use the forms published by the Spanish Data Protection Agency, or ask us for them.

We will reply within one month at most from your request. If the matter is particularly complex, that period may be extended by two further months, and we would tell you so within the first month, explaining why.

If you consider that we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid): www.aepd.es.

If any of your data changes, please let us know so that we can keep it up to date.

9. What security measures do we apply?

We have adopted appropriate technical and organisational measures to prevent the loss, misuse, alteration, unauthorised access and theft of your data, in line with the state of the art: encrypted HTTPS connection across the whole site, restricted password-protected access to the messages received, spam filtering on the form, backups and data processing agreements with our suppliers, who are bound to the same level of confidentiality as we are.

We do not make automated decisions or build profiles with your data.

10. Do we include personal data of third parties?

No: as a general rule we only process data provided by the data subjects themselves. If you give us another person's data —for example, when booking on behalf of someone else or listing the guests of a group—, you must inform them beforehand and have their consent. Otherwise, you release us from any liability for failing to meet this requirement.

11. Do we process data of minors?

This site is not aimed at minors. Under Article 7 of the LOPDGDD, consent to the processing of data by digital means is only valid from the age of 14: if you are under that age, do not use the contact form or the booking platform without the authorisation of your parent or guardian, who must make the request on your behalf.

Bookings and service contracts (celebrations, groups, catering) must always be made by adults. If we find that we have received data from a child under 14 without the authorisation of the person with parental authority or guardianship, we will delete it immediately.

12. Do we communicate by electronic means?

Yes, but only to manage your request and through the contact details you have given us: the reply to your enquiry, the confirmation of a booking, sending a quote or notices related to that service.

Any commercial or informational communication about events and news would only be sent if you have authorised us beforehand and expressly, and you may revoke that authorisation at any time.

13. What about our social media?

We have social media profiles to keep in touch with you and build a community of followers. If you follow us, interact with our posts or send us a private message, we will process the data the social network itself shows us, for as long as you maintain that relationship with us.

Please bear in mind that each network has its own terms and privacy policies, over which we have no control. Any rectification of your data, or restriction of the information and posts on your profile, must be managed from your account settings on the social network itself.

• Instagram — see the Instagram privacy policy.
• Facebook — see the Facebook privacy policy.

14. What do we do with the CVs you send us?

If you send us your application, we process your data to organise selection processes, invite you to an interview and assess your profile. The legal basis is your unambiguous consent, given when you send us your CV.

By accepting this policy you authorise us to share your application among the companies that make up the group, solely to include you in their selection processes. Once one year has passed since we received your CV, we will securely destroy it, unless you ask us to delete it sooner or authorise us to keep it for longer.

15. Can we change this privacy policy?

Yes. We reserve the right to change or adapt this privacy policy when the applicable law or the way we process your data changes. We recommend that you review it whenever you are about to give us information through the website; the date of the last update appears at the bottom of this page.

Last updated: 13 August 2026