This legal text provides details on how we collect and process your personal data through the use of our website https://casanisbistrot.com/, including any information you may provide through the site when booking a table or submitting your details via the form enabled for this purpose.

By providing us with your data, we inform you that our services are not available to individuals who are legally restricted from giving consent; therefore, by submitting the forms to us, you guarantee that you have sufficient capacity to grant consent.

Below, we inform you about the data protection policy of: Grupo Casanis (you can check the list of companies in annex I)

1. Data Controller.

Contact details of the controller:

Grupo Casanis, (you can check the list of companies in annex I), with registered address at: Avenida Ricardo Soriano 36, Edificio María III, 1ª Planta, Puerta 103 29601 Marbella Málaga and telephone: 952900450 / 952770592. We have a Data Protection Officer whom you can contact at the email: dpo@casanisgroup.eu

Grupo Casanis is the controller of your data. (Hereinafter referred to as us or our).

2. What data do we collect?

General Data Protection Regulation defines personal data as any information relating to an identified or identifiable natural person, meaning any information capable of identifying a person. This does not include anonymous or aggregated data.

Personal data that may be collected directly from the data subject will be treated confidentially and will be incorporated into the corresponding processing activities owned by Grupo Casanis.

On our website, we may process certain types of personal data, which may include:

• Identity data: first name and surname.
• Contact data: email and telephone number.

We do not collect any data relating to special categories of personal data (those revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and information about health, genetic, or biometric data).

If you are asked to provide personal data by law or under the terms of a contract between us and you refuse to provide it, we may not be able to perform the contract or provide the service, and you must notify us in advance.

3. How do we collect your personal data?

The means we use to collect personal data are:

• Through the form on our website, via our contact email, by phone, or postal mail, when you:
  • Request information about our services
  • Contract the provision of our services
  • Subscribe to any of our publications

To ensure the quality of our portal, we reserve the right to reject any registration request or to suspend or cancel a previously accepted registration if we consider that it does not meet these requirements or any other law or rule. If this happens, we will try to state the reasons for our decision, but we cannot commit to doing so in all cases.

• Through technology or automated interactions: on our site, we may automatically collect technical data about your equipment, browsing actions, and usage patterns. This data is collected through cookies or similar technologies. If you would like more information, you can check our cookie policy here.
• Through third parties:
  • Google: analytical data or search data. Outside the European Union.

4. Purpose and lawfulness of the use of your data.

The most common uses of your personal data are:

• For the formalisation of a contract between Grupo Casanis and you.
• When you give your consent to the processing of your data.
• When we need them to comply with a legal or regulatory obligation.
• When necessary for our legitimate interests or those of a third party.

Users may revoke their consent at any time by sending an email to dpo@casanisgroup.eu or by consulting the exercise of rights section below.

Below, we attach a table where you can consult the ways in which we will use your personal data and the lawfulness of its use, as well as knowing what type of personal data we will process. We may process some personal data for an additional legal reason, so if you need details regarding this, you can send an email to dpo@casanisgroup.eu

Commercial communications: you will only receive communications if:

• You requested information from us or made a purchase of a product or service with us.
• If you provided your data, accepting the corresponding box on our form.
• As long as you have not expressed your wish to stop receiving such communications.

We obtain your express consent before sending you any communication, and you may request at any time that we stop sending you communications via email at dpo@casanisgroup.eu

When you choose to stop receiving our communications, your personal data will still be stored as a result of the contract made by you in order to comply with legal requirements.

Purpose: we will only use your data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason, notifying you in advance so that you are informed of the legal reason for its processing and provided that the purpose is compatible with the original purpose.

5. How long will we keep your data?

They will be kept for the time necessary to fulfil the purpose for which they were collected and to determine any possible liabilities that could arise from said purpose and the data processing. The provisions of the various regulations regarding retention periods will apply, as applicable to this processing.

Data of subscribers by email or form: From the moment the user subscribes until they unsubscribe.

6. Minors.

Grupo Casanis does not authorise minors under 14 years of age to provide their personal data through the means enabled on this website (completion of web forms for service requests, contact, or by sending emails). Therefore, individuals who provide personal data using these means formally state that they are over 14 years of age, and Grupo Casanis is exempt from any liability for non-compliance with this requirement.

If your child, who is under the established age limit, has provided personal information to Grupo Casanis, please contact us to request the exercise of their applicable rights.

In cases where the services offered by Grupo Casanis are intended for minors under 14 years of age, means will be enabled to obtain the authorisation of the minor’s parents or legal guardians.

7. Exercise of Data Protection Rights:

How to exercise these rights? Users may send a communication to the registered address of Grupo Casanis or email address dpo@casanisgroup.eu, including in both cases a photocopy of their ID card or another similar identification document, to request the exercise of the following rights:

• Access to your personal data: you can ask Grupo Casanis if it is using your personal data.
• To request its rectification, if they are incorrect, or to exercise the right to erasure regarding them.
• To request the restriction of processing; in this case, they will only be kept by Grupo Casanis for the exercise or defence of claims.
• To object to their processing: Grupo Casanis will stop processing the data in the way you indicate, unless for legitimate reasons or for the exercise or defence of possible claims, they must continue to be processed.
• To data portability: in case you want your data to be processed by another firm, Grupo Casanis will facilitate the portability of your data to the new controller.

You can use the templates made available to you by the Spanish Data Protection Agency to exercise your previous rights: Here

Complaining to the AEPD DPO: if you consider there is a problem with the way Grupo Casanis is treating your data, you can direct your complaints beforehand to the Data Protection Officer, who will mediate for the correct resolution of the conflict:

• DPO Email: dpo@casanisgroup.eu
• Address: Avenida Ricardo Soriano 36, Edificio María III, 1ª Planta, Puerta 103 29601, Marbella Málaga.
• If it is not possible to resolve the conflict, you can always go to the corresponding control authority, which in Spain is: Spanish Data Protection Agency.

We will request specific information to help us confirm your identity and guarantee your right to access your personal data (or to exercise any of the other rights mentioned above). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

We will resolve all requests within the indicated legal timeframe of one month. However, it may take us longer than a month if your request is particularly complex. In this case, we will notify you and keep you updated.

8. Data communication: provision of services.

It is possible that, in the performance of our work, we may need the help of third parties, who will only process the data to provide the contracted service, and with whom we have the corresponding measures in place to guarantee your rights:

• Service providers who provide IT and system administration services.
• Professional advisors including lawyers, auditors, and insurers who provide banking, legal, insurance, and accounting consulting services.

All processors to whom we transfer your data will respect the security of your personal data and will treat it in accordance with the GDPR.

We only allow such processors to process your data for specified purposes and in accordance with our instructions. However, in compliance with transparency, you can request a list of these companies that provide services to us by sending an email to: dpo@casanisgroup.eu

9. Data Security.

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal data to those employees, contractors, agents, and other third parties who have a business need to know such data. They will only process your personal data on our instructions and are subject to a duty of confidentiality.

We have implemented procedures to deal with any suspected personal data breach and will notify you and the Supervisory Authority of a breach where we are legally required to do so, as regulated in articles 33 and 34 of the GDPR.

ANNEX I

CASABUBU S.L. CIF: B-92486695, Registered in the Mercantile Registry of Malaga, on January 26, 2004, in Volume 3447, Book 2359, Folio 86, Sheet MA-67288, 1st Registration

RESTOPLAGE MARBELLA S.L. CIF: B-93433365, Registered in the Mercantile Registry of Malaga, on February 18, 2019, in Volume 5446, Book 4353, Folio 176, Sheet MA-130582, 6th Registration

MZL Holding, S.L. CIF: B-93686194 Registered in the Mercantile Registry of Malaga, on May 14, 2019, Volume 5838, Book 4745, Folio 62, Section 8, Sheet MA150728, Registration A 1.

BBCG MARBELLA S.L. CIF: B-93715852, Registered in the Mercantile Registry of Malaga, Volume 5894, Book 4801, Folio 166, Section 8, Sheet MA153327, I/A 1

MYCO MILANO, S.L.U. CIF: B-09674326 Registered in the Mercantile Registry of Malaga, on February 10, 2022, Volume 6127, Book 5034, Folio 58, Section 8, Sheet MA165398, Registration A 1.