Privacy policy

Data controller

The controller is SALOMON 1965 HOSPITALITY HOLDING, S.L., NIF B-72979404, with registered address at Paseo de Gracia, 98, 3.º 1.ª, 08008 Barcelona. You may send communications regarding data protection to that address, indicating ‘Data protection – Arraval’.

This information applies to this website and to the restaurant's processing activities indicated below. External services, such as TheFork, also provide their own privacy information for processing activities for which they are responsible.

Data processed and source

When requesting pages and documents, the server and infrastructure providers receive the technical data necessary to respond and protect the service, such as IP address, date and time, requested URL, browser information and incident logs. Private management uses authentication and session data, technical identifiers and safeguards against access attempts.

The form contains name, email address and message. In the currently prepared version, sending it to the server is not enabled: the content is validated and a draft may be generated in your browser, but it is not sent to the controller from that form. Before enabling a submission destination, its processing information must be completed. Do not include health data, identity documents or other sensitive data in the general message.

If you authorise analytics, Google Analytics may receive identifiers and technical browsing data. If you authorise TheFork to open and make a reservation, that platform requests the necessary data and provides them to the restaurant where relevant to managing the reservation. No data are extracted from those platforms merely by visiting this website.

Purposes and legal bases

Providing the website, administering menus and preventing improper access are based on the legitimate interest in maintaining an operational and secure service, Article 6(1)(f) GDPR, with the measures and limits necessary for that purpose.

Responding to a request related to a reservation or requested service is based on taking pre-contractual steps or performing the requested relationship, Article 6(1)(b) GDPR. General enquiries, if received through an enabled channel, are handled on the legitimate interest in responding, without using their content for unsolicited advertising. The form in this version does not yet make that submission.

Optional analytics are based on consent, Article 6(1)(a) GDPR and Article 22.2 LSSI. Connecting the external widget requires the authorisation explained in the cookie policy; that technical authorisation does not mean accepting other processing unrelated to the stated purpose. Reservation data are processed to provide the requested service and in accordance with the information presented during the reservation.

Compliance with applicable legal obligations is based on Article 6(1)(c) GDPR. This implementation does not use behavioural advertising tags or automated decisions that produce legal or similarly significant effects on visitors.

Whether data are necessary

Public browsing does not require a user account. You may reject analytics and external resources without losing access to information and menus. The relevant minimum data are required to process a reservation or respond to a request; failure to provide them may prevent that request from being addressed, but does not justify requiring unnecessary information.

The password and session controls of /gestion are used only for persons authorised to manage documents. Do not share those credentials.

Recipients and services used

The controller's authorised persons and technical providers necessary for hosting, database, PDF storage, support and security may access data. The project is prepared for Manus-managed hosting, database and storage. The controller must confirm the contracting entity, processor terms, location and sub-processors before launch.

Google provides the optional analytics service. TheFork provides the reservation system that opens with authorisation. These services may carry out their own processing in accordance with their applicable information and terms; it is not assumed that all their processing is carried out exclusively on behalf of the restaurant. The technical information for each integration is expanded upon in the cookie policy.

Data may also be communicated to authorities or entities where there is a legal obligation. This implementation does not envisage communicating the content of enquiries for third-party advertising.

International transfers

Hosting services and Google and TheFork integrations may involve access to or processing outside the European Economic Area. It is not stated that all data remain in the European Union or that a specific certification or contract exists that has not been verified.

Before launch, the controller must confirm the destinations and mechanisms actually applicable and complete this information: an adequacy decision where it covers the recipient and processing, or appropriate safeguards, such as standard contractual clauses and the necessary supplementary measures. Mere acceptance of cookies does not replace these obligations. The applicable information and safeguards may be requested from the controller through its contact channels.

Retention periods

Enquiries received through an enabled channel are retained for the time necessary to respond and resolve the request; afterwards, where appropriate, they will be kept blocked for the limitation periods applicable to liabilities and legal obligations. Reservation data are retained to provide the service and, where applicable, to meet the resulting legal obligations, in accordance with the periods reported through the relevant channel.

Your cookie choice is stored in your browser for a maximum of 180 days. Google Analytics cookies have a configured duration of up to 180 days, but that period does not by itself describe the retention of reports or data in the Google Analytics account: the controller must confirm that configuration before launch. The management session has a maximum duration of eight hours.

Technical logs are retained for a period proportionate to the continuity and security of the service and the investigation of incidents, subject to the provider's limits and periods that the controller must validate before going into production. No automatic deletion of infrastructure logs beyond this application's control is stated.

Your rights and how to exercise them

Under the terms provided by the GDPR, you may request access, rectification, erasure, restriction, portability and objection. Where processing is based on consent, you may withdraw it without affecting the lawfulness of prior processing. For optional cookies, you may directly use the website's Privacy control.

You may exercise your rights by writing to the controller at Paseo de Gracia, 98, 3.º 1.ª, 08008 Barcelona, indicating ‘Data protection – Arraval’, the right you wish to exercise and a means of response. Additional identity information will only be requested where there are reasonable doubts and in a proportionate manner.

The request will be addressed without undue delay and, as a general rule, within one month. Where the GDPR allows the period to be extended due to the complexity or number of requests, you will be informed of the extension and its reasons within the first month. You may lodge a complaint with the Spanish Data Protection Agency if you consider that the processing infringes your rights.

Security and changes to this policy

Access controls, protected sessions and technical measures designed to prevent improper access are applied. No measure can promise absolute security; the measures will be reviewed and incidents managed in accordance with applicable obligations.

The policy will be updated when the website's functions, recipients or purposes change. New processing that requires consent will not be activated merely by changing the text. You may also consult the legal notice and the cookie policy.