Privacy policy
How we process the personal data you provide through this website.
This is an English translation provided for information purposes. In the event of any discrepancy, the Spanish version shall prevail.
1. Data controller
- Controller
- La Choza
- Tax ID (CIF)
- B32297152
- Address
- Gran Via de les Corts Catalanes 300, Barcelona
- Phone
- +34 933 25 19 49
- info@lachoza.es
- Website
- lachoza.es
This policy applies to the processing of personal data carried out through this website, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
2. What data we process and why
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact and booking form | Name, email, phone number and the content of the message | To answer your enquiry or manage your booking request | Consent of the data subject (art. 6.1.a GDPR) | One year from the last communication, unless a different legal obligation applies |
| Communication by phone or email | Data voluntarily provided by the person | To respond to the request made | Consent or legitimate interest in serving the customer | One year from the last communication |
| Cookies and analytics | Browsing data and device identifiers | Operation of the website and, with prior consent, usage analysis | Consent, except for strictly necessary technical cookies | According to the periods set out in the cookie policy |
No automated decision-making or profiling with legal effects for users takes place. We do not request special categories of data: please do not include health information, allergies or other sensitive data in the forms; if you need to tell us about an allergy or intolerance, please do so directly with the staff at the restaurant or by phone.
3. Minors
The forms on this website are not aimed at children under fourteen. If we find that we have received data from a minor without the consent of their parent or guardian, we will delete it.
4. Recipients and data processors
We do not share personal data with third parties unless legally required to do so. The following providers are involved, acting as data processors or service providers under the corresponding contractual relationship:
- Hostinger International Ltd.: hosting of the website and associated email. Servers located in the European Union.
- Google Ireland Ltd.: embedded map services and, where applicable, fonts and analytics tools. This may involve international data transfers.
- Web maintenance and development providers engaged by the controller, with access limited to what is strictly necessary.
5. International transfers
Some of the services above may involve data transfers outside the European Economic Area. In such cases, the transfers are covered by adequacy decisions of the European Commission or by standard contractual clauses, together with any additional safeguards that may apply.
6. Your rights
You may exercise the following rights at any time:
- Access: find out what data of yours we process.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data when it is no longer needed.
- Objection: object to certain processing.
- Restriction: ask us to suspend processing while a complaint is being verified.
- Portability: receive your data in a structured, commonly used format.
- Withdraw consent at any time, without affecting the lawfulness of previous processing.
To exercise them, write to info@lachoza.es or to the postal address above, enclosing a copy of a document proving your identity and stating the right you wish to exercise. We will reply within one month at the latest.
If you believe the processing does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.
7. Data security
We apply appropriate technical and organisational measures to protect data against loss, misuse or unauthorised access, including encryption of communications with an SSL certificate, access control to the content management system and regular backups. No system is infallible, but we review these measures on an ongoing basis.
8. Changes to this policy
This policy may be updated to reflect changes in legislation or new website services. The version in force will always be the one published on this page.
Last updated: 1 September 2026