GDPR &
Data Protection

What GDPR means for you

The General Data Protection Regulation gives people in the European Economic Area rights and protections when organisations use their personal data. It requires data use to be lawful, fair, transparent, limited to a clear purpose, and no more extensive than necessary.

For this website, the controller is Can Bestia S.L, at Carretera San Juan, km 19, 07810 Sant Joan de Labritja, Ibiza, Balearic Islands, Spain. Privacy requests should be sent to contact@canbestiarestaurant.com.

Information used for reservations

We process the details you enter in the reservation form: name, email, telephone, requested date and time, number of guests, and optional message or notes. We use these details to assess availability, contact you, answer questions, and, where possible, confirm and manage your table.

We also process limited technical information needed to operate and secure the service. Cloudflare Turnstile evaluates anti-bot signals, while ROMARG may maintain ordinary hosting and security logs.

Lawful and limited processing

Reservation handling is generally necessary to take steps at your request before providing restaurant services and to manage a confirmed reservation. Website security may rely on the restaurant's legitimate interest in preventing spam, fraud, and disruption. Information may also be retained or disclosed when a legal obligation applies.

We aim to collect only the details needed for those purposes. The message field is optional, and guests should avoid including unnecessary sensitive information.

Retention and protection

Reservation data is retained only for as long as reasonably necessary to manage the reservation, related communications, and any applicable legal or administrative obligations. Data that is no longer required is deleted or anonymised.

Security measures in the current system include HTTPS, server-side validation and sanitisation, an anti-spam honeypot, Cloudflare Turnstile, and controlled email delivery. Access to reservation communications should be limited to people who need it for restaurant operations.

Your rights

Access

You may ask whether we process your personal data and request a copy together with information about how it is used.

Rectification

You may ask us to correct inaccurate information or complete information that is incomplete.

Erasure

You may request deletion where the data is no longer needed, processing is unlawful, or another legal ground applies. This right can be limited where retention is legally required or needed for legal claims.

Restriction

In certain circumstances, you may ask us to store information without otherwise using it while an issue about accuracy or lawful processing is resolved.

Objection

You may object to processing based on legitimate interests for reasons related to your situation. We must then assess whether compelling legitimate grounds require processing to continue.

Data portability

Where processing is automated and based on consent or a contract, you may have the right to receive data you provided in a structured, commonly used, machine-readable format.

Withdrawal of consent

If a particular activity relies on your consent, you may withdraw that consent at any time. Withdrawal does not make earlier processing unlawful.

How to make a request

Email contact@canbestiarestaurant.com and describe the right you want to exercise. Include enough information to identify the relevant reservation, but do not send unnecessary identity documents. We may request proportionate evidence of identity when needed to protect your data from unauthorised disclosure.

Requests are normally handled without undue delay and, in principle, within one month, subject to the extensions and exceptions permitted by GDPR. Exercising your rights is normally free, although the law permits limited action for manifestly unfounded or excessive requests.

Complaints

If you believe your information has been handled unlawfully, please contact us so we can investigate. You may also lodge a complaint with the supervisory authority where you live, work, or where the issue occurred. In Spain, the authority is the Agencia Española de Protección de Datos (AEPD).

More information

For details about recipients, international transfers, website technologies, and policy updates, read the Privacy Policy and Cookie Policy.