Privacy policy
Information on the processing of personal data, provided in accordance with articles 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation) and with Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights.
Controller
- Owner
- Montla S.L. · Restaurante Santa Anna
- Tax number (CIF)
- B67901439
- Commercial registry
- Registro Mercantil de Barcelona, volume 48122, folio 196, sheet B-573030, entry 1
- Registered address
- Carrer de Santa Anna 8, 08002 Barcelona
- Telephone
- 933 18 63 36
- Domain
- www.restaurantsantaanna.com
Data subjects may contact the controller at the email address given above on any matter concerning the processing of their data and in order to exercise their rights.
Table reservations made through the Website
The reservation form embedded in the Website is provided by resOS (Resos ApS, Denmark), which acts as a processor. The data entered — name, telephone number, email address, number of covers and, where applicable, any note the data subject adds — is recorded on that provider’s systems and is accessible to the controller.
Purpose: to manage and confirm the reservation and to communicate anything affecting it. Legal basis: performance of the reservation requested by the data subject, and steps taken at the data subject’s request prior to it, under article 6(1)(b) of the Regulation.
Providing identifying and contact details is necessary in order to manage the reservation. Where they are not provided, the reservation cannot be processed.
Reservations and enquiries by telephone
Where a reservation is made by telephone, a name and a contact number are recorded. The purpose and legal basis are those set out in the preceding section.
Website analytics
The Website uses Google Analytics to obtain aggregate statistical information about its use. The information obtained does not identify users. Legal basis: consent given through the cookie management system, which may be withdrawn at any time.
Advertising and conversion measurement
The controller advertises on Google Ads. Where the user consents, conversions attributable to those advertisements are recorded and audiences are used to show the advertisements again on other websites. Legal basis: consent, which may be withdrawn at any time.
No contact form and no marketing communications
The Website has no contact form and no subscription facility. Email addresses are not collected for the purpose of sending marketing communications, and none are sent.
Retention periods
Reservation data is retained for as long as is necessary to manage the reservation and thereafter for the limitation periods applicable to any liability arising from it. Data processed on the basis of consent is retained until that consent is withdrawn and, in any event, for the periods stated in the cookie policy.
Recipients
- resOS Resos ApS (Denmark). Processor. Provides the reservation form and hosts the data entered into it. resos.com/privacy-policy
- Google Google Ireland Limited (Ireland). Analytics, advertising and the map embedded on the home page and the reservation page. policies.google.com/privacy
- Cloudflare Cloudflare, Inc. (United States). Hosting of the Website. www.cloudflare.com/privacypolicy/
The providers listed act as processors and process the data only on the controller’s instructions, under the corresponding processing agreement.
No other disclosure of data is envisaged, save where required by law.
International transfers
Google and Cloudflare belong to groups whose parent companies are established in the United States. International transfers of data are made under the EU–US Data Privacy Framework and, failing that, under the standard contractual clauses approved by the European Commission.
Security measures
The controller applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with article 32 of the Regulation, and restricts access to the data to staff who need to know it. In the event of a security breach entailing a risk to the rights and freedoms of data subjects, the controller will proceed in accordance with articles 33 and 34 of the Regulation.
Rights of data subjects
Data subjects may exercise the rights of access, rectification, erasure, objection, restriction of processing and portability, and may withdraw any consent given, without affecting the lawfulness of processing carried out before withdrawal.
Exercising these rights is free of charge and is requested by writing to the email address given in the first section, together with evidence of the requester’s identity.
Data subjects may also lodge a complaint with the Spanish Data Protection Agency, at calle Jorge Juan 6, 28001 Madrid, and online at www.aepd.es.
Accuracy of the data
The data subject warrants that the data provided is true and relates to them, and undertakes to notify any change to it.
Children
The Website is not directed at anyone under fourteen years of age. Reservations for children below that age must be made by the person holding parental responsibility or guardianship.
Automated decision-making and profiling
No processing is carried out that involves automated decisions producing legal effects for the data subject, and no profiling is carried out. Data is neither disclosed nor sold to third parties for commercial purposes.
Data protection officer
The controller is not required to designate a data protection officer under article 37 of the Regulation and has not designated one. Communications should be addressed to the address given in the first section.
Cookies
The use of cookies and similar technologies, and the processing of the data obtained through them, is set out in the cookie policy.
Amendment of this policy
The controller may amend this policy to reflect regulatory change or changes to the processing carried out. The date of the last update appears at the foot of this page.
Last updated 2 September 2026.