Privacy policy
Last updated: Monday 19 October 2026
1. Who is responsible for your data
- Owner: TBC
- Tax ID (NIF): TBC
- Address: Centro Comercial Al Kasar, Local 11, Bulevar Central de las Cañadas, 30849 Condado de Alhama, Alhama de Murcia (Murcia), España
- Email: bokaoreservations@gmail.com
- Phone: +34 646 86 25 51
2. What we collect
When you request a table on this website we process your name, mobile number, email address (if you give one), party size, date and time, seating preference, occasion and any notes you write. If your notes mention allergies or accessibility needs, we use that only to look after you on your visit.
We also record whether you opted in to messages about events and when you accepted this privacy policy. To prevent abuse, we keep a scrambled (hashed) identifier of your IP address for a few minutes; the IP address cannot be recovered from it.
If you contact us by WhatsApp, email or phone, we process the details you share in that conversation.
3. Why we use it and our legal basis
- Handling your booking request and contacting you to confirm it: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
- Allergy or health information you choose to include in your notes: your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time.
- Messages about events and special menus, only if you tick the box: your consent (Art. 6(1)(a) GDPR).
- Website security and abuse prevention, such as limiting automated submissions: our legitimate interest (Art. 6(1)(f) GDPR).
- Usage statistics with analytics cookies, only if you accept them: your consent (Art. 6(1)(a) GDPR and Art. 22.2 of Spain's LSSI-CE).
We do not make automated decisions or build profiles from your data.
4. How long we keep it
- Booking details: 12 months from the booking date, then deleted.
- Consent to messages: until you unsubscribe.
- Hashed IP identifier: 10 minutes.
- Technical server logs: as set by our hosting provider, for no more than 12 months.
5. Who we share it with
We never sell your data or pass it to third parties unless the law requires it. We use these processors, under the contracts required by Art. 28 GDPR:
- Our web hosting provider, which hosts this website and the booking records.
- Google (Gmail), which runs the reservations inbox that receives requests.
- WhatsApp (Meta), only if you choose to contact us on WhatsApp.
- Google Analytics, only if you accept analytics cookies.
Some of these providers may process data outside the European Economic Area. Where they do, transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.
6. Your rights
You can ask to access, correct, delete, restrict or move your data, object to its use, and withdraw consent at any time by emailing bokaoreservations@gmail.com or writing to the address above. We may ask you to confirm your identity.
If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
7. Children
The booking form is for people aged 14 and over, in line with Art. 7 of Spain's LOPDGDD. If you are younger, please ask an adult to book for you.
8. Security
We use appropriate technical and organisational measures: an encrypted connection (HTTPS), restricted access to booking records, protection against automated submissions and limited retention.
9. Changes
We may update this policy. The date of the latest version is shown at the top of this page.
