Privacy Policy

This is a translation provided for information purposes only. In the event of any discrepancy, the Spanish version shall prevail.

1. Information for the user

Who is the controller responsible for processing your personal data?

INICIATIVAS DE LA CASITA DE MARI S.L. is the controller of the user's personal data and informs you that this data will be processed in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

What types of data do we request and process?

Depending on the form or the means by which your data is obtained, we always ask you for the minimum necessary to fulfil the purposes detailed in each case.

For what purposes do we process your personal data, and why?

Depending on the form through which we have obtained your personal data, we will process it confidentially to achieve the following purposes:

In the Contact form

  • Respond to enquiries or any kind of request made by the user through any of the means of contact made available on the controller's website. (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)
  • Send advertising commercial communications by e-mail, fax, SMS, MMS, social media or any other electronic or physical means, present or future, that makes it possible to send commercial communications. These communications will be sent by the controller and will relate to its products and services, or to those of its partners or suppliers with whom it has reached some promotional agreement. In this case, third parties will never have access to the personal data. (on the basis of the data subject's consent, Art. 6.1.a GDPR)
  • Carry out statistical analyses and market research. (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)

In the Newsletter form

  • Send newsletters, news, offers and online promotions. (on the basis of the data subject's consent, Art. 6.1.a GDPR)

In the Request a quotation form

  • Send commercial quotations for products and services. (for the performance of a contract or pre-contractual measures, Art. 6.1.b GDPR)
  • Send advertising commercial communications by e-mail, fax, SMS, MMS, social media or any other electronic or physical means, present or future, that makes it possible to send commercial communications. These communications will be sent by the controller and will relate to its products and services, or to those of its partners or suppliers with whom it has reached some promotional agreement. In this case, third parties will never have access to the personal data. (on the basis of the data subject's consent, Art. 6.1.a GDPR)

In the Online forum form

  • Take part in the online forums proposed by the controller. (on the basis of the data subject's consent, Art. 6.1.a GDPR)

In the Curriculum vitae (CV) form

  • Involve the data subject in staff selection processes and analyse the applicant's profile in order to select a candidate for the controller's vacant post. (on the basis of the data subject's consent, Art. 6.1.a GDPR)

In the Testimonial form

  • Moderate and publish on the website the user's experiences, opinions and suggestions about a product or service. (on the basis of the data subject's consent, Art. 6.1.a GDPR)

In the Comments form

  • Moderate and publish on the website opinions on a publication. (on the basis of the data subject's consent, Art. 6.1.a GDPR)

In the Ethics or whistleblowing channel form

  • Properly manage the ethics channel, processing any irregularities reported through it and deciding whether to open an investigation, in order to detect possible offences and prevent the imposition of any kind of liability, as well as to avoid any conduct contrary to the entity's internal or external rules. (for compliance with a legal obligation, Art. 6.1.c GDPR)

In the User registration form

  • Manage the user's account in order to provide personalised access to the website and to the interactive services it offers. (on the basis of the data subject's consent, Art. 6.1.a GDPR)

In the E-commerce form

  • Manage your online purchase or order, process the payment and proceed to its shipping or activation, in accordance with the general terms and conditions of contract. (for the performance of a contract or pre-contractual measures, Art. 6.1.b GDPR)
  • Manage, maintain, improve or develop the services provided. (for the performance of a contract or pre-contractual measures, Art. 6.1.b GDPR)
  • Carry out satisfaction and quality surveys. (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)

In the Loyalty card form

  • Manage the loyalty card if requested. (on the basis of the data subject's consent, Art. 6.1.a GDPR)
  • Send advertising commercial communications by e-mail, fax, SMS, MMS, social media or any other electronic or physical means, present or future, that makes it possible to send commercial communications. These communications will be sent by the controller and will relate to its products and services, or to those of its partners or suppliers with whom it has reached some promotional agreement. In this case, third parties will never have access to the personal data. (on the basis of the data subject's consent, Art. 6.1.a GDPR)
  • Carry out statistical analyses and market research. (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)

In the Membership enrolment form

  • Manage and process any request for information, including those aimed at becoming a member. Keep members informed of the actions we carry out. Dissemination of activities. (for the performance of a contract or pre-contractual measures, Art. 6.1.b GDPR)
  • Send advertising commercial communications by e-mail, fax, SMS, MMS, social media or any other electronic or physical means, present or future, that makes it possible to send commercial communications. These communications will be sent by the controller and will relate to its products and services, or to those of its partners or suppliers with whom it has reached some promotional agreement. In this case, third parties will never have access to the personal data. (on the basis of the data subject's consent, Art. 6.1.a GDPR)
  • Carry out statistical analyses and market research. (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)

In the Bookings form

  • Formalise bookings at the controller's establishment. (for the performance of a contract or pre-contractual measures, Art. 6.1.b GDPR)
  • Send advertising commercial communications by e-mail, fax, SMS, MMS, social media or any other electronic or physical means, present or future, to customers, making it possible to send commercial communications regarding products or services that are similar to those that were initially the subject of the contract with the customer (Art. 21.2 LSSI). (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)

In the Social Media form

  • Contact through Social Media in order to maintain a relationship between the User and the Controller, which may include the following operations:
    • Process your requests and enquiries.
    • Provide information on activities and events.
    • Provide information on products and/or services.
    • Interact through the official profiles.
    The user has a profile on the same social network and has decided to join the Controller's social network, thereby showing an interest in the information published there; therefore, when requesting to follow our official page, the user gives us their consent to the processing of their data. The User may at any time access the privacy policies of the social network itself, as well as configure their profile to safeguard their privacy. Once the User is a follower or has joined the Controller's social network, they may post on it comments, links, images, photographs or any other type of content supported by it. The User must, in all cases, be the owner of the content posted, hold the copyright and intellectual property rights, or have the consent of the third parties concerned.
    • Sending commercial communications relating to the activities of the companies of the Group, as well as companies outside the Group, with which commercial collaboration or intermediation agreements have been established.
    (on the basis of the data subject's consent, Art. 6.1.a GDPR)

In the Instant messaging form

  • Schedule appointments and meetings with the controller. (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)
  • Send advertising commercial communications by e-mail, fax, SMS, MMS, social media or any other electronic or physical means, present or future, to customers, making it possible to send commercial communications regarding products or services that are similar to those that were initially the subject of the contract with the customer (Art. 21.2 LSSI). (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)
  • Manage, maintain, improve or develop the services provided. (for the performance of a contract or pre-contractual measures, Art. 6.1.b GDPR)
  • Manage your online purchase or order, process the payment and proceed to its shipping or activation, in accordance with the general terms and conditions of contract. (for the performance of a contract or pre-contractual measures, Art. 6.1.b GDPR)
  • Send commercial quotations for products and services. (for the performance of a contract or pre-contractual measures, Art. 6.1.b GDPR)
  • Send advertising commercial communications by e-mail, fax, SMS, MMS, social media or any other electronic or physical means, present or future, that makes it possible to send commercial communications. These communications will be sent by the controller and will relate to its products and services, or to those of its partners or suppliers with whom it has reached some promotional agreement. In this case, third parties will never have access to the personal data. (on the basis of the data subject's consent, Art. 6.1.a GDPR)
  • Respond to enquiries or any kind of request made by the user through any of the means of contact made available on the controller's website. (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)

In the Video surveillance form

  • Purpose: Security and access control, employment monitoring and monitoring of internal activity. Legal basis: Public interest in security and access control, and the controller's legitimate interest based on Art. 20.3 of the Estatuto de los Trabajadores (Workers' Statute). Retention: A maximum of 30 days. (on the basis of the data subject's consent, Art. 6.1.a GDPR)

In the Images and recordings form

  • File of still and/or moving images. Includes publication in the media of the data controller or of third parties. (on the basis of the data subject's consent, Art. 6.1.a GDPR)

In the Customers and suppliers form

  • Commercial management with customers and suppliers. (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)

In the Advertising opt-out form

  • Data management to avoid sending commercial communications to those who have expressed their refusal or objection to receiving them. (for compliance with a legal obligation, Art. 6.1.c GDPR)

In the Commercial advertising form

  • Advertising management and commercial prospecting. Includes data from legitimate publicly accessible sources. (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)

In the Rights of data subjects form

  • Handle citizens' requests in the exercise of the rights established by the GDPR. (for compliance with a legal obligation, Art. 6.1.c GDPR)

In the Users of the controller's website, app and other platforms form

  • Identification data of the users who access the corporate website. (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)

In the Training, courses, workshops, activities or similar form

  • Management of the conditions of access and use. (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)

In the Wi-Fi Network Connection form

  • Carry out statistical analyses and market research. (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)
  • Carry out satisfaction and quality surveys. (on the basis of the controller's legitimate interest, Art. 6.1.f GDPR)

(on the basis of the data subject's consent, Art. 6.1.a GDPR)

In the Legal Representatives and Contact Persons form

  • Where you are the legal representative or contact person of any of the entities or persons with whom the Foundation deals, the controller will process your data in order to monitor the development of the intended relationship. (on the basis of the data subject's consent, Art. 6.1.a GDPR)

How long will we keep your personal data?

They will be kept for no longer than necessary to fulfil the purpose of the processing, or for as long as there are legal provisions requiring their custody, and when they are no longer necessary for that purpose, they will be deleted with appropriate security measures to guarantee the anonymisation of the data or its total destruction.

To whom do we disclose your personal data?

No disclosure of personal data to third parties is envisaged except, where necessary for the development and performance of the purposes of the processing, to our communications-related service providers, with whom the controller has entered into the confidentiality and data processor agreements required by the privacy legislation in force.

Providers involved in the website

The following providers are involved in the operation of this website:

  • Vercel Inc. (United States): hosting of the website; it technically processes browsing requests and the submission of forms.
  • Resend, Inc. (United States): sending the content of the forms by e-mail to the relevant restaurant.
  • Google Ireland Ltd.: corporate e-mail (Google Workspace), in which messages are received and handled and, only if the user accepts it in the cookie panel, Google Analytics, Google Ads and Google Maps.
  • Consultancy X3 S.L.: cookie consent management tool (PD Cookie Consent), which is loaded from its servers.
  • TheFork (La Fourchette SAS): table booking widget; the booking data is processed in accordance with TheFork's privacy policy.

Third-party data provided by the User

Should the USER provide personal data of third parties for any purpose, the USER guarantees that he or she has previously informed the data subjects and obtained their consent to the communication of their data to the Controller.

The USER guarantees that the data subjects are of legal age and that the information provided is accurate and truthful.

The Controller may verify the consent of those data subjects by means of an initial e-mail with non-commercial content in which verification of the consent given on their behalf by the USER will be requested.

Should any liability arise from a breach of these conditions by the USER, the USER shall answer for the consequences of that breach.

Do we carry out international transfers?

In accordance with Article 44 of the GDPR, authorisation of an international transfer of data to a country that has not been declared to offer an adequate level of protection may only be granted if sufficient safeguards are obtained. Thus, it may be granted if the controller provides a written contract, concluded between the data exporter and the data importer, setting out the necessary safeguards for respect of the protection of the data subjects and guaranteeing the exercise of their rights.

The controller may use the services of providers that have servers or offices in other places and, therefore, such transfers may take place. To consult the updated list of providers, please contact the controller or write to administracion@grupolavasca.com.

What are your rights?

The rights available to the user are:

  • The right to withdraw consent at any time.
  • The right of access, rectification, portability and erasure of your data, and of restriction of or objection to its processing.
  • The right to lodge a complaint with the supervisory authority (www.aepd.es) if you consider that the processing does not comply with the legislation in force.

Contact details for exercising your rights:
INICIATIVAS DE LA CASITA DE MARI S.L. C/ Bonaire, 19 - 07012 Palma (Illes Balears). E-mail: administracion@grupovasco.es

You can download the rights request form (PDF, in Spanish), complete it and send it to the postal address or e-mail address indicated.

2. Mandatory or optional nature of the information provided by the user

By ticking the relevant boxes and entering data in the fields marked with an asterisk (*) in the contact form or presented in download forms, users expressly, freely and unequivocally accept that their data is necessary for the provider to deal with their request, the inclusion of data in the remaining fields being voluntary. The user guarantees that the personal data provided to the controller is truthful and is responsible for notifying any change to it.

The controller informs you that all the data requested through the website is mandatory, as it is necessary for the provision of an optimal service to the user. If not all the data is provided, there is no guarantee that the information and services provided will be fully adapted to your needs.

If, by any means, you provide us with personal data of other persons, the controller warns that you must do so with their consent and having informed them beforehand of the matters contained in this Privacy Policy. Likewise, the controller undertakes to provide any third party whose data you give us with the relevant information, in accordance with Article 14 of the General Data Protection Regulation (GDPR).

3. Security measures

In accordance with the data protection legislation in force, the controller is complying with all the provisions of the GDPR and the LOPDGDD for the processing of the personal data for which it is responsible, and manifestly with the principles set out in Article 5 of the GDPR, under which data is processed lawfully, fairly and transparently in relation to the data subject, and is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.

The controller guarantees that it has implemented appropriate technical and organisational policies to apply the security measures established by the GDPR and the LOPDGDD in order to protect the rights and freedoms of users, and has provided them with the appropriate information so that they can exercise them.

International data transfers

In the course of providing its services, some of the providers used by the data controller may be located outside the European Economic Area (EEA) or may carry out data processing from third countries.

In such cases, the controller guarantees that these international data transfers are carried out in compliance with Regulation (EU) 2016/679 (GDPR), applying appropriate safeguards for the protection of personal data, such as the execution of Standard Contractual Clauses approved by the European Commission, the existence of European Commission adequacy decisions or other legal safeguards recognised by the applicable legislation.

The user may request additional information on the specific safeguards applied to each international transfer by contacting the data controller at administracion@grupolavasca.com.

For more information on the privacy safeguards, you may contact the controller through INICIATIVAS DE LA CASITA DE MARI S.L. C/ Bonaire, 19 - 07012 Palma (Illes Balears). E-mail: administracion@grupovasco.es

4. Validity

This privacy policy has been in force since 1 October 2026.

The controller reserves the right to amend this policy to adapt it to future legislative or case-law developments that may apply, or for other technical, operational, commercial, corporate or other reasons. If, as a result of the changes, users' rights are affected, the controller undertakes to inform them of the reasons.

Last updated: 8 October 2026