Privacy Policy

1. Data controller

Chiringuito Los Troncos will act as the data controller for the personal data collected through this website. Reference address: Playa de Bolonia, Tarifa, Cádiz. Known contact phone number: +34 629 927 249. Privacy email: A specific privacy email address has not been provided. In the meantime, data subjects may use the venue's contact phone number.

The owner of the business must keep the identifying, tax and contact information required by applicable law updated at all times, including a valid email address for the handling of data protection rights requests.

2. Data processed and source

The website may process identification and contact data when a user interacts with forms, booking requests, WhatsApp communications, internal panel access or possible enquiries sent through any digital channel integrated into the site.

Minimal technical data may also be processed, such as IP address, browser, access date and time, selected language or internal panel activity logs, whenever they are necessary for operation, security or traceability of menu operations.

3. Purposes of processing

Data will be processed to handle bookings and enquiries, manage the relationship with customers and prospective customers, enable bilingual navigation, administer menu content, ensure the security of the private panel and keep evidence of internal changes to the gastronomic offer.

If electronic marketing communications are enabled in the future, they will only be sent where there is a sufficient legal basis, especially prior consent or a previous contractual relationship in accordance with applicable law.

4. Legal basis

The main legal basis will be the performance of pre-contractual or contractual measures when the user requests a reservation, information about availability, commercial attention or any process related to the restaurant service. Legitimate interest may also support security measures, fraud prevention, internal administration and traceability of menu changes.

When it is necessary to install non-essential cookies or load external content subject to consent, the legal basis will be the user’s explicit consent, which may be withdrawn at any time.

5. Data retention

Data will be kept for as long as needed to fulfil the purpose that motivated its collection and, afterwards, for the legal limitation periods that may apply. Internal panel audit logs may be retained for as long as necessary to evidence changes, incidents, internal responsibilities or organisational compliance.

6. Recipients and processors

No disclosures to third parties are expected except where required by law, by technological service provision or by operational necessity related to website operation, email, hosting or messaging services such as WhatsApp. In those cases, appropriate contractual safeguards and, when applicable, valid mechanisms for international transfers will be required.

7. Data subject rights

Data subjects may request access, rectification, erasure, objection, restriction of processing and portability where applicable, as well as withdraw any previously granted consent. They may also lodge a complaint with the Spanish Data Protection Agency if they believe their rights have been infringed.

Where there is no specific privacy email address, requests may be channelled through the venue’s contact phone number, without prejudice to the controller enabling additional channels for communication and response.

8. Security

Reasonable technical and organisational measures will be adopted to protect personal data against destruction, loss, alteration, unauthorised access or unlawful processing. Such measures will include access controls, change traceability, secure credential handling, permission reviews and internal procedures aimed at preserving the confidentiality, integrity and availability of information.