Privacy Policy

1. Who we are

The website canbestiarestaurant.com is operated for Can Bestia restaurant by Can Bestia S.L, the controller responsible for the personal data described in this policy.

Registered or legal address: Carretera San Juan, km 19,
07810 Sant Joan de Labritja,
Ibiza, Balearic Islands, Spain
Privacy contact: contact@canbestiarestaurant.com

2. Personal data we collect

Reservation requests

When you submit the reservation form, we receive your name, email address, telephone number, requested date and time, number of guests, and any message or notes you choose to provide.

Technical and security information

Our hosting and security services may process limited technical information such as IP address, request time, browser or device information, referrer, server logs, and anti-abuse signals. Cloudflare Turnstile processes signals needed to distinguish people from automated traffic. It does not receive the contents of the reservation form from our code.

Please do not include special-category or unnecessary sensitive personal information in the message field.

3. Why we use personal data

• To review and respond to reservation requests.
• To communicate about availability, changes, questions, or confirmation of a table.
• To maintain the security and reliable operation of the website and reservation form.
• To establish, exercise, or defend legal claims and comply with legal obligations where applicable.

Submitting the form sends a reservation request; it does not by itself confirm a booking.

4. Legal bases

Reservation data is generally processed because it is necessary to take steps at your request before entering into a service arrangement and, where a reservation is confirmed, to perform that arrangement. Security and basic website administration may be based on our legitimate interests in preventing abuse and operating a safe service. We may also process information where necessary to meet a legal obligation. Where consent is specifically requested for a separate purpose, you may withdraw it at any time without affecting earlier lawful processing.

5. How long we keep data

Reservation data is retained only for as long as reasonably necessary to manage the reservation, related communications, and any applicable legal or administrative obligations. Data that is no longer required is deleted or anonymised.

Technical logs and anti-spam information are retained according to the relevant hosting and security providers' operational retention periods, subject to the controller's configuration and contracts.

6. Security

We use proportionate technical and organisational measures intended to protect personal data, including encrypted HTTPS transport, server-side form validation, input sanitisation, a hidden anti-spam field, Cloudflare Turnstile verification, and restricted handling of reservation emails. No internet service can guarantee absolute security.

7. Service providers and recipients

Data may be processed by providers that support the website, including ROMARG for web and email hosting and Cloudflare for Turnstile anti-abuse protection. Google Fonts is loaded to provide the site's typography; requesting those files can disclose technical request information such as an IP address to Google. Reservation details are delivered to the restaurant's designated email inbox.

We do not disclose reservation data for third-party advertising based on the current website implementation. We may disclose information where required by law or necessary to protect legal rights.

8. Cloudflare Turnstile

The reservation form uses Cloudflare Turnstile as a strictly necessary security measure. Turnstile evaluates technical signals such as IP address, user-agent, browser characteristics, TLS information, site key, and origin to identify automated abuse. Cloudflare describes these signals as limited to providing and improving bot detection and states that Turnstile does not read form entries or other page input.

For further detail, see the Cloudflare Turnstile Privacy Addendum.

9. International transfers

Some service providers may process personal data outside the European Economic Area. Where this occurs, appropriate safeguards required by applicable data-protection law are relied upon where necessary. The safeguards used depend on the provider, destination, and circumstances of the processing.

10. Your data-protection rights

Subject to the conditions and limits in applicable law, you may request access to your personal data, correction of inaccurate or incomplete data, erasure, restriction of processing, or portability where applicable. You may object to processing based on legitimate interests and withdraw consent where processing relies on consent.

To exercise a right, contact contact@canbestiarestaurant.com. We may need reasonable information to verify your identity. You also have the right to complain to the competent supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD).

11. Cookies and similar technologies

The current site contains no analytics or advertising trackers and its own code does not create cookies or use localStorage or sessionStorage. It uses Cloudflare Turnstile for essential security and remotely served Google Fonts. See our Cookie Policy for the current technical audit and browser-control information.

12. Updates and contact

We may update this policy when the website, providers, or legal requirements change. The revised date will be shown at the top of this page. Questions about this policy should be sent to contact@canbestiarestaurant.com.