Privacy policy

This page explains what personal data is processed through this website, for what purpose, for how long, who else sees it, and what you can require at any time. Regulation (EU) 2016/679 and Spanish Organic Law 3/2018 apply.

Who the controller is

Controller: MD NORA, S.L. (La Piratería)
Spanish tax number (CIF): B44941045
Address: C/ Pacífico, 23, local 4, 29004 Málaga, Spain
Email: mdnora.malaga@gmail.com
Telephone: +34 641 47 14 13

No data protection officer has been appointed, because the activity does not require one. For anything concerning your data, the email address above is the channel.

What data is processed and why

Table bookings

Bookings are made through a CoverManager form, the reservation platform the restaurant uses. It collects your name, telephone, email, date, time, number of guests and any comment you add, such as an allergy or a preference for the terrace. This is used to manage the booking, confirm it and let you know if a problem comes up.

The legal basis is performance of the contract or of the pre-contractual dealings that the booking itself constitutes, under Article 6(1)(b) of the Regulation. Without that data the table cannot be booked. CoverManager processes it on the restaurant’s behalf, under a data processing agreement.

WhatsApp enquiries

The WhatsApp button opens a conversation in your own app. If you write, we process your number, the name you display and the content of the messages, in order to assist you. The legal basis is your consent in starting the conversation and the legitimate interest in answering those who ask, Articles 6(1)(a) and 6(1)(f).

Worth knowing: WhatsApp is a Meta service and messages travel through its infrastructure, under its own terms and privacy policy. If you would rather not use it, the telephone number and email address are above.

Bookings and enquiries by telephone

When you call, we process your name, your telephone number and the details of what you order or ask about. The legal basis is performance of a contract or of pre-contractual dealings, Article 6(1)(b). Calls are not recorded.

Enquiries by email

If you write to the address above, we process the data you provide and the content of your message in order to reply. Legal basis: Articles 6(1)(a) and 6(1)(f).

Website measurement and analysis

With your permission, third-party tools record visits and site use. The legal basis is your consent, Article 6(1)(a), which you can withdraw at any time. The detail is in the cookie policy. Without that permission they are not activated.

First-party audience measurement

In addition to the above, the site runs its own counter that uses no cookies and stores nothing in your browser, and that works even if you reject the cookie notice. It records the page viewed, the domain you arrive from, the device type, the browser language, the load time and whether you press the phone number, WhatsApp or the booking button.

Your IP address is never stored. So as not to count you twice on the same day, a cryptographic digest is computed using a random key that changes every night and is not kept, which makes it impossible to link you to the previous day. Individual records are turned into counters every night and destroyed after two days; the counters are kept for a maximum of 25 months.

The processing is carried out solely on the restaurant behalf, no third party is involved, the data never leaves this server, it is not cross-referenced with any other processing and it cannot be used to follow you across other websites. The legal basis is the legitimate interest in understanding how the site itself is used, Article 6(1)(f), and it meets the conditions of the audience-measurement exemption set out by the Spanish Data Protection Agency.

What is not done

No newsletters or marketing messages are sent: there is no mailing list.
No profiling and no automated decision-making about anyone.
Data is not sold or transferred to third parties for their own purposes.
No special category data is requested. If you mention an allergy when booking, it is used only to look after you and is not kept longer than necessary.

How long data is kept

Bookings: as long as needed to manage them, plus a reasonable period afterwards to deal with issues or complaints.
Conversations and enquiries: for the duration of the exchange and a sensible period afterwards.
Tax and accounting obligations: the periods set by law where invoicing is involved.
Measurement data: the retention periods of each tool, set out in the cookie policy.

Once those periods end, data is deleted or blocked until any resulting claims become time-barred.

Who else has access

Data is not disclosed to third parties except where the law requires it. Providers that supply necessary services do access data on the controller’s behalf, under a data processing agreement:

The web hosting provider, which hosts the site and its database.
CoverManager, which provides the online booking service.
The email provider, for handling the messages received.
Google Ireland Limited, for the measurement tool and the embedded map, if you allow them to load.
Microsoft Ireland Operations Limited, for the site usage analysis tool, if you allow it to load.

Transfers outside the European Union

Google and Microsoft may process data on servers located in the United States. Those transfers rely on the EU-US Data Privacy Framework, to which both are certified, and failing that on the standard contractual clauses approved by the European Commission. If you do not allow measurement or usage analysis cookies, those transfers do not take place by that route.

Your rights

You may exercise the following rights at any time:

Access: to know what data about you is processed.
Rectification: to correct data that is inaccurate.
Erasure: to ask for data to be deleted once it is no longer needed.
Objection: to object to processing based on legitimate interest.
Restriction: to ask that data be kept but not used while a disagreement is resolved.
Portability: to receive your data in a structured format.
Withdrawal of consent: where processing relies on it, without affecting what was done beforehand.

Write to mdnora.malaga@gmail.com stating which right you are exercising. Some identity check may be requested, purely to make sure data is not handed to somebody else. You will receive a reply within one month at most.

If you consider that your data has not been handled properly, you may complain to the Spanish Data Protection Agency, calle Jorge Juan 6, 28001 Madrid, or through its electronic portal at aepd.es. If you prefer, you can first write to the address above and try to settle it directly.

Children

This website is not aimed at children under 14 and no data is requested from them. If you notice that a child has provided data without the authorisation of their guardian, let us know and it will be deleted.

Security

The site is served encrypted over HTTPS and reasonable technical and organisational measures are applied to protect data: access limited to those who need it, software updates and backups. No system is infallible, but should a breach occur that poses a high risk to your rights, you will be informed and the supervisory authority will be notified.

Changes to this policy

This policy is reviewed when the processing, the providers or the applicable rules change. If a change affects something you consented to, you will be asked again. The version in force is always the one published here.

This is a translation provided for convenience. In the event of any discrepancy, the Spanish version prevails.