Reservation privacy notice

Last updated: 8 August 2026

1. Data controller

Legal name：ONGLAI VALENCIA SOCIEDAD LIMITADA
NIF/CIF：B72754294
Registered address：Calle de Bèlgica 6, Piso 12, Puerta 36, 46021 València, Valencia, España
Contact Email：hola@xionghejia.es

Xiong He Jia is the trading name. The actual controller will be the person or legal entity identified in this section.

2. Data we process

First name, last name, optional title, Email, phone, language, restaurant, date, time, party size, reservation status, optional notes, special requirements volunteered by the guest and strictly necessary security records.

3. Purposes and legal bases

We use the data to receive, review, confirm, change or cancel a reservation, organise the table, send Email notifications and handle issues related to the visit. This is based on pre-contractual or contractual steps requested by the guest. We may also keep a necessary history to identify repeated reservations and new or returning guests, improve service and prepare internal statistics. This is proposed under legitimate interests and requires a documented balancing assessment before publication.

4. Internal classification and automated decisions

The internal view may show reservation and visit counts, preferred location and new or returning guest status. It does not automatically determine prices, offers, table assignment, acceptance or rejection and does not produce legal or similarly significant effects.

5. Email and required information

Email is required for online reservations and is used to acknowledge receipt, communicate confirmation, changes, reminders, rejection or cancellation and identify reservation history. First name, last name, Email, phone, restaurant, date, time and party size are required; without them we cannot process the request. Title, notes and special requirements are optional.

6. Retention

Each identifiable reservation and its necessary data is kept for 24 months from the scheduled visit date. The internal customer profile is kept for no more than 24 months from the latest reservation-related interaction. Special requirements are deleted no later than 7 days after the visit and, for cancelled or rejected bookings, when no longer needed. Security logs are kept for 12 months. Data is then deleted or irreversibly anonymised unless legal blocking is required for an obligation or claim.

7. Recipients and providers

Access is limited to authorised staff and necessary hosting, database, Email and technical maintenance providers acting under instructions, confidentiality and contractual safeguards. If analytics cookies are accepted, Google provides Google Analytics 4 to produce usage statistics; advertising features remain disabled. We do not sell data or disclose it for third-party advertising. We may provide necessary data to authorities where legally required.

8. International transfers

If a provider, including Google for optional analytics, processes data outside the European Economic Area, an adequacy decision, standard contractual clauses or another valid GDPR safeguard will be used.

9. Special requirements

Allergy, health or accessibility information is processed only when volunteered with separate explicit consent. It is used solely for the relevant visit, access is restricted and it is not included in general emails or reports. Consent may be withdrawn without affecting earlier lawful processing.

10. Marketing

Making a reservation does not add the guest to an advertising list. We currently send operational messages by Email only. Any future marketing will require a separate, voluntary, unchecked option and a free, simple opt-out.

11. Rights

Guests may request access, correction, deletion, portability, restriction or objection and may withdraw special-requirements consent by writing to the contact Email. We may request reasonable identity verification. A complaint may also be lodged with the Spanish Data Protection Agency (AEPD). AEPD

12. Security, accuracy and updates

We use access controls, protected accounts, backups, operation logs and deletion rules proportionate to the risk. Guests should provide accurate data and avoid unnecessary sensitive information about others. If purposes, providers or applicable rules change, this notice will be updated before the new processing begins.