Privacy policy

This is a translation for convenience. The Spanish version is the legally binding text. Read it in Spanish.

Who is the controller

Controller

NELIKO, S.L. (trade name: Deda's Gastro House)

Tax ID (NIF)

B24888323

Address

Calle Manuel Allende 19, ground floor A, 48010 Bilbao (Bizkaia), Spain

Registration

Commercial Registry of Bizkaia, sheet BI-86365, 1st entry

Email

[email protected]

Phone

+34 946 29 51 77

What data we process and why

Event enquiries (form on the Events page). We process your name, email, phone (optional), approximate date, number of guests and your message, together with the date sent and the form language. We use them to reply and prepare a quote. Legal basis: pre-contractual steps at your request (Art. 6.1.b GDPR). Name and email are required; without them we cannot reply. We keep them for 12 months from our last contact or, if the event is booked, for as long as the relationship lasts and then for the periods required by law (for example, tax law).

Email and phone. If you write to [email protected] or call us, we use your data to reply. Legal basis: your request (Art. 6.1.b GDPR) or our legitimate interest in answering whoever contacts us (Art. 6.1.f GDPR). Same retention period as event enquiries.

Bookings. Bookings are managed with CoverManager (Restaurant Booking & Distribution Services, S.L.U.), acting on our behalf. We process the data you enter when booking: name, contact details, date, time, number of guests and comments. Legal basis: handling what you ask for (Art. 6.1.b GDPR). We keep them as long as needed to manage the booking and then for the periods required by law.

Allergies and intolerances. If you tell us about an allergy or intolerance, we use it only to prepare your meal safely. Legal basis: your explicit consent when you tell us (Art. 9.2.a GDPR). We delete it when it is no longer needed for your visit or event.

Marketing communications (Deda's news, events and offers). We only send you marketing emails if:

• you have given your consent by ticking the box when booking, sending an enquiry or subscribing (Art. 6.1.a GDPR and Art. 21.1 LSSI-CE), or
• you are a customer and gave us your email when buying from us, in which case we may send you information about Deda's services similar to those you bought, unless you object (Art. 21.2 LSSI-CE). We give you the option to object when we collect your email and in every message.

We process your name, your email and, if you tell us, the kind of news you are interested in. You can unsubscribe at any time with the link in every email or by writing to [email protected]. We keep your data for this purpose until you unsubscribe; after that we keep only what is needed so that we do not write to you again.

Satisfaction surveys and reviews. After your visit we may email you to ask how it went or invite you to leave a review. Legal basis: our legitimate interest in improving our service (Art. 6.1.f GDPR) and, by email, Art. 21.2 LSSI-CE. You can object at any time and in every email.

Customer history and preferences. We keep the history of your bookings and visits (dates, number of guests, attendance or no-show) and the preferences you share with us (table, celebrations, tastes), to serve you better and manage no-shows. Legal basis: legitimate interest (Art. 6.1.f GDPR). If you give us your birthday to receive a treat, the basis is your consent. We keep this data while you are a customer and for no more than 3 years after your last visit.

Photos and videos. At the restaurant and at events we may take photos and videos for our website and social media. We only publish images in which you can be recognised if you consent (Art. 6.1.a GDPR); otherwise we discard them or make you unrecognisable. You can ask us to remove an image at any time.

Invoices and payments. If you pay or ask for an invoice, we process the data needed to charge and invoice you. Legal basis: legal obligation (Art. 6.1.c GDPR). We keep it for 6 years, as required by the Spanish Commercial Code and tax law. We do not store your full card details: the payment provider handles them.

Job applications. If you send us your CV, we use it to assess your application for current and future positions. Legal basis: your consent when you send it. We keep it for 12 months and then delete it.

Suppliers and business contacts. We process the contact details of people at our suppliers and partners to manage the relationship. Legal basis: the contract and our legitimate interest (Art. 6.1.b and 6.1.f GDPR).

CCTV. We have cameras for the safety of people and the premises. Legal basis: public and legitimate interest in security (Art. 22 LOPDGDD). Footage is deleted within one month at most, unless it must be handed to the authorities. There are information signs at the entrance.

Social media. If you message us on Instagram, we use your data to reply. Meta processes that data on its platform under its own policies.

Sale or reorganisation of the business. If the restaurant or NELIKO, S.L. is sold, merged or reorganised, your data may pass to the new owner so that it can keep serving you, with the same safeguards. Legal basis: legitimate interest (Art. 6.1.f GDPR). We will let you know beforehand.

Retention for legal defence. When each period ends, we may keep the data blocked, without using it, only to deal with possible claims and requests from authorities during the limitation periods (Art. 32 LOPDGDD).

Minors. This website is not aimed at children under 14. If you are under 14, do not send us data without your parents' or guardians' consent.

We do not take automated decisions about you.

Who else processes your data

We do not sell your data. We only share it with third parties when the law requires it. These providers process data on our behalf under a data processing agreement:

The following also process data on our behalf: Holded (invoicing and accounting), DISH (till and payment system) and our accounting, tax, employment and legal advisers.

If you click “Show map” on the Contact page, Google loads the map and receives technical data from your browser (such as your IP address). Google processes it as an independent controller under its own privacy policy .

Transfers outside the European Union

Some providers are US companies or may access data from there. In those cases the transfer is protected as follows:

• Supabase: database in the EU; technical support and usage logs may be processed outside it, under the European Commission's standard contractual clauses.
• Resend: certified under the EU-US Data Privacy Framework, with standard contractual clauses in its contract.
• Cloudflare: certified under the EU-US Data Privacy Framework; if that certification ceases to apply, standard contractual clauses apply.
• Google LLC (if you load the map or if we use Gmail for marketing emails): certified under the EU-US Data Privacy Framework.
• Mailchimp (Intuit Inc.), if we use it for marketing emails: certified under the EU-US Data Privacy Framework, with standard contractual clauses in its contract.

Your rights

You can ask us at any time for:

• Access: to know what data we hold about you.
• Rectification: to correct inaccurate data.
• Erasure: to delete it.
• Objection: to stop processing it, including for marketing.
• Restriction: to keep it without using it, for example while a complaint is resolved.
• Portability: to receive it in a common format.
• Withdrawal of consent at any time, without affecting earlier processing.

Write to [email protected] stating which right you want to exercise. If we have doubts about your identity, we may ask you to prove it. We reply within one month at most. If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).

Security

The website always uses an encrypted connection (HTTPS), and only restaurant staff who handle enquiries and bookings can see your data.

Cookies

Our website does not set its own cookies. What the map and the booking system do is explained in the cookie policy.

Changes to this policy

If we change it, we will publish the new version here with its update date.