Privacy policy

1. Data controller

ELIAN RESTAURANT PROYECTOS LA YERRA SL (hereinafter, the CONTROLLER) is the controller of the user's personal data and informs the user that these data will be processed in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), and any other legislation in force on the subject.

Controller's contact details:

• Name: ELIAN RESTAURANT PROYECTOS LA YERRA SL
• Postal address: Avenida Ramón y Cajal, 22, Bajos, 43001 Tarragona
• E-mail: hola@proyectoslayerra.com

2. Purposes of processing

Personal data collected through the website will be processed for the following purposes:

• Managing the commercial, contractual and/or pre-contractual relationship with the user.
• Handling orders, applications, enquiries or any other type of request made by the user through the means of contact made available to them.
• Providing and invoicing the products or services contracted.
• Sending commercial and advertising communications by e-mail, SMS, social networks or any other electronic or physical means, present or future, relating to products and services of the CONTROLLER or its partners, provided that the user has given their express consent. In this case, third parties will never have access to the personal data.
• Sending the website's newsletter to those who have subscribed.
• Carrying out statistical and service quality studies using pseudonymised or aggregated data.
• Complying with the legal obligations applicable to the CONTROLLER.

3. Legal basis for processing (lawfulness)

The legal basis for processing the data is, as the case may be (Art. 6(1) GDPR):

• Performance of a contract or taking of pre-contractual steps at the request of the data subject (Art. 6(1)(b) GDPR), for the provision of services and the handling of orders, payments, deliveries and after-sales service.
• Compliance with a legal obligation applicable to the CONTROLLER (Art. 6(1)(c) GDPR), in particular those arising from tax, accounting and consumer protection legislation.
• Consent of the data subject (Art. 6(1)(a) GDPR), for the sending of commercial communications, newsletter subscriptions or the use of non-technical cookies. Consent may be withdrawn at any time, without affecting the lawfulness of prior processing.
• Legitimate interest of the CONTROLLER (Art. 6(1)(f) GDPR), for maintaining the security of the network and information systems, preventing fraud and improving services. This interest has been duly weighed against the rights and freedoms of the data subject.

The prospective offer of products and services is based on the consent requested from you, and the withdrawal of this consent shall in no case affect the performance of the contract.

4. Categories of data processed

The CONTROLLER processes only identification and contact data provided by the user themselves (first name, surname, DNI/NIF, postal address, e-mail address, telephone number), browsing data (IP address, device identifiers, pages visited) and, where applicable, financial and transaction data necessary for invoicing and payment collection. No special categories of data are processed (data concerning health, ideology, religion, racial origin or sexual orientation) within the meaning of Article 9 of the GDPR.

5. Retention period

Personal data will be kept for as long as necessary to fulfil the purpose for which they were collected and to determine any possible liabilities that may arise from that purpose and from the processing of the data. In particular:

• Data relating to the contractual relationship will be kept for the term of the contract and, once it has ended, for the periods provided for by law in order to address any possible liabilities (in general, 6 years under the Spanish Commercial Code for accounting and commercial data, and the periods provided for in tax legislation).
• Data processed on the basis of consent will be kept until the data subject requests their erasure or withdraws that consent.
• Browsing and cookie data are kept in accordance with the Cookie Policy.

Once these periods have elapsed, the data will be erased or, where applicable, blocked in accordance with Article 32 of the LOPDGDD, by means of appropriate security measures.

6. Recipients and disclosure of data

As a general rule, data will not be disclosed to third parties, except where required by law. In particular, they may be disclosed to the competent Public Authorities, the State Security Forces and Corps, Judges and Courts, and banks for payment collection purposes.

For the provision of services strictly necessary for carrying out its activity, the CONTROLLER may share data with processors (hosting providers, payment gateways, e-mail marketing services, courier services, accountancy and administrative agencies, etc.), with whom it has signed the corresponding data processing agreements in accordance with Article 28 of the GDPR.

7. International transfers

The CONTROLLER does not carry out international transfers of data outside the European Economic Area, except for those arising from the use of services from technology providers (analytics, hosting, social networks) that may store data in the USA or other countries. In such cases, these transfers are made on the basis of adequacy decisions of the European Commission, the EU-US Data Privacy Framework or, failing that, the Standard Contractual Clauses approved by the European Commission, together with additional safeguards, so as to ensure a level of protection equivalent to that required by the GDPR.

8. Automated decisions and profiling

The CONTROLLER does not take automated decisions, including profiling, that produce legal effects for the user or similarly significantly affect them.

9. Rights of data subjects

The user may exercise, at any time, the rights granted to them under the GDPR and the LOPDGDD:

• Access: to know which data are being processed and the characteristics of the processing.
• Rectification: to request the modification of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): to request the deletion of data when they are no longer necessary for the purpose for which they were collected.
• Objection: to object to the processing of data on grounds relating to their particular situation.
• Restriction of processing: to request that processing be restricted to mere storage where certain circumstances apply.
• Portability: to receive the data in a structured, commonly used and machine-readable format, or to request their transmission to another controller.
• Withdrawal of consent given, at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Not to be subject to individual automated decisions, including profiling.

To exercise these rights, the user may write to the CONTROLLER at the postal address Avenida Ramón y Cajal, 22, Bajos, 43001 Tarragona, or by e-mail at hola@proyectoslayerra.com, enclosing a copy of their DNI or equivalent document proving their identity. The request will be dealt with within a maximum of one month, which may be extended by two further months depending on the complexity or number of requests.

Furthermore, if the user considers that the processing of their data does not comply with the legislation, they have the right to lodge a complaint with the supervisory authority: the Spanish Data Protection Agency (Agencia Española de Protección de Datos) (www.aepd.es), C/ Jorge Juan, 6, 28001-Madrid. Before doing so, they may contact the CONTROLLER to try to resolve the matter.

10. Source of the data

The personal data processed come directly from the data subject through the website's contact, registration and/or purchase forms, or through communications by e-mail, telephone or other channels provided for this purpose. No data from publicly accessible sources, or disclosed by third parties without the prior consent of the data subject, are processed.

11. Mandatory or optional nature of the information provided by the user

By ticking the corresponding boxes and entering data in the fields marked with an asterisk (*) on the forms, users expressly, freely and unequivocally accept that their data are necessary for the provider to deal with their request, the inclusion of data in the remaining fields being voluntary. Refusal to provide the data identified as mandatory may prevent or hinder the provision of the service requested.

The user guarantees that the personal data provided to the CONTROLLER are true and is responsible for notifying any changes to them. The CONTROLLER reserves the right to exclude from the registered services any user who has provided false data, without prejudice to any other legal action that may be appropriate.

12. Minors

In accordance with Article 7 of the LOPDGDD, only persons over 14 years of age may give their consent to the processing of their personal data. In the case of minors under 14, the consent of their parents, guardians or legal representatives is required. The CONTROLLER reserves the right to verify such consent by appropriate means.

13. Social networks

The CONTROLLER may have a presence on social networks. The processing of the data of users who become followers on social networks (and/or make any link or connection through them) shall be governed by the terms of use, privacy policies and access rules of the social network concerned in each case, as well as by this Privacy Policy. The CONTROLLER will process their data for the purposes of properly managing its presence on the social network and informing them of activities, products or services, and for any other purpose permitted by the social network's rules.

14. Security measures

In accordance with the personal data protection legislation in force, the CONTROLLER complies with all the provisions of the GDPR and the LOPDGDD for the processing of the personal data for which it is responsible, and manifestly with the principles described in Article 5 of the GDPR, under which data are processed lawfully, fairly and in a transparent manner in relation to the data subject and are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

The CONTROLLER guarantees that it has implemented appropriate technical and organisational measures (Art. 32 GDPR) to ensure a level of security appropriate to the risk, including, among others, the pseudonymisation and encryption of personal data where appropriate, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, the ability to restore availability and access to data in the event of a physical or technical incident, and a process for regularly testing, assessing and evaluating the effectiveness of those measures.

15. Changes to this policy

The CONTROLLER reserves the right to modify this Privacy Policy in order to adapt it to new legislation, case law or interpretations of the Spanish Data Protection Agency. In such cases, the changes made will be announced on this page reasonably in advance of their implementation.

Last updated: 4 November 2026