Reservation privacy notice
Last updated: 25 July 2026
1. Data controller
Legal name：Xiong He Jia
NIF/CIF：To be completed
Registered address：To be completed
Privacy Email：hola@xionghejia.es
Xiong He Jia is the trading name. The actual controller will be the person or legal entity identified in this section.
2. Data we process
First name, last name, optional title, Email, phone, language, restaurant, date, time, party size, reservation status, optional notes, special requirements volunteered by the guest and strictly necessary security records.
3. Purposes and legal bases
We use the data to receive, review, confirm, change or cancel a reservation, organise the table, send Email notifications and handle issues related to the visit. This is based on pre-contractual or contractual steps requested by the guest. We may also keep a necessary history to identify repeated reservations and new or returning guests, improve service and prepare internal statistics. This is proposed under legitimate interests and requires a documented balancing assessment before publication.
4. Internal classification and automated decisions
The internal view may show reservation and visit counts, preferred location and new or returning guest status. It does not automatically determine prices, offers, table assignment, acceptance or rejection and does not produce legal or similarly significant effects.
5. Email and required information
Email is required for online reservations and is used to acknowledge receipt, communicate confirmation, changes, reminders, rejection or cancellation and identify reservation history. First name, last name, Email, phone, restaurant, date, time and party size are required; without them we cannot process the request. Title, notes and special requirements are optional.
6. Retention
Each identifiable reservation and its necessary data is kept for 24 months from the scheduled visit date. The internal customer profile is kept for no more than 24 months from the latest reservation-related interaction. Special requirements are deleted no later than 7 days after the visit and, for cancelled or rejected bookings, when no longer needed. Security logs are kept for 12 months. Data is then deleted or irreversibly anonymised unless legal blocking is required for an obligation or claim.
7. Recipients and providers
Access is limited to authorised staff and necessary hosting, database, Email and technical maintenance providers acting under instructions, confidentiality and contractual safeguards. We do not sell data or disclose it for third-party advertising. We may provide necessary data to authorities where legally required.
8. International transfers
If a provider processes data outside the European Economic Area, an adequacy decision, standard contractual clauses or another valid safeguard will be used. Final providers, locations and safeguards must be added before publication.
9. Special requirements
Allergy, health or accessibility information is processed only when volunteered with separate explicit consent. It is used solely for the relevant visit, access is restricted and it is not included in general emails or reports. Consent may be withdrawn without affecting earlier lawful processing.
10. Marketing
Making a reservation does not add the guest to an advertising list. We currently send operational messages by Email only. Any future marketing will require a separate, voluntary, unchecked option and a free, simple opt-out.
11. Rights
Guests may request access, correction, deletion, portability, restriction or objection and may withdraw special-requirements consent by writing to the privacy Email. We may request reasonable identity verification. A complaint may also be lodged with the Spanish Data Protection Agency (AEPD). AEPD
12. Security, accuracy and updates
We use access controls, protected accounts, backups, operation logs and deletion rules proportionate to the risk. Guests should provide accurate data and avoid unnecessary sensitive information about others. If purposes, providers or applicable rules change, this notice will be updated before the new processing begins.