This policy explains in simple terms what personal data we process when you visit the website, book a table, buy from our online shop or send us an enquiry, what we use it for and what rights you have. We comply with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Data controller

Controller: Balenco 2018, S.L.
Tax ID (NIF): B55727952
Registered office: Carrer Mossèn Ritort i Faus, 27, principal 2, 43002 Tarragona (Spain)
Restaurant: El Terrat by Quach, Carrer de Pons d’Icart, 19, 43004 Tarragona
Email: info@elterratrestaurant.com
Telephone: +34 977 24 84 85

We have not appointed a data protection officer. For any question about your data, email us at info@elterratrestaurant.com.

2. What data we process, why and for how long

We only process the data needed for each purpose. Without the required details for a booking or an order, we cannot manage it.

Table bookings

Data: name, telephone, email, date, number of guests and any comments you wish to add. They are collected on the restaurant’s behalf by the BookingTable booking system embedded in the website (elterrat.bookingtable.cat).
Purpose: to manage your booking and contact you if necessary.
Legal basis: performance of a contract or of pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
Allergies and other health data: only if you tell us about them, and solely to serve you safely, with your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time.
Retention: for as long as needed to manage the booking and then for the periods during which liability claims may be brought.

Online shop orders and gift vouchers

Data: name, email, telephone, billing address, order details and, if you request an invoice, your company’s tax ID and details. Card payments are made through secure payment gateways: we never see or store your card number.
Purpose: to manage your order and its payment, send you the confirmation and the gift vouchers, keep track of their use, manage collection, withdrawals and the guarantee, and issue invoices.
Legal basis: performance of the purchase contract (Art. 6(1)(b) GDPR) and compliance with legal accounting and tax obligations (Art. 6(1)(c) GDPR).
Retention: order and invoice data, for the legally required periods: 6 years under Article 30 of the Spanish Commercial Code.

Customer account

Data: if you create an account (‘My account’) when placing an order, your login details and the data saved in it.
Purpose: to let you access your account and your orders.
Legal basis: provision of the account service you request (Art. 6(1)(b) GDPR).
Retention: until you delete the account or ask us to do so; order data, for the legal periods stated above.

Enquiries by email or telephone

Data: whatever you give us, such as your name, your contact details and your enquiry.
Purpose: to reply to you.
Legal basis: your request and our legitimate interest in dealing with it (Art. 6(1)(f) GDPR).
Retention: until your enquiry is resolved and then for the periods during which liability claims may be brought.

Statistics and advertising measurement

Data: browsing data (pages visited, how you reached the website, campaign, device) and identifiers linked to cookies.
Purpose: to understand how the website is used so that we can improve it (Google Analytics 4 and Jetpack and WooCommerce statistics); to know how people who place an order reached the website (WooCommerce order attribution); and to measure the effectiveness of our ads and show ads to people who have already visited us (Google Ads conversion tracking and remarketing).
Legal basis: your consent only (Art. 6(1)(a) GDPR and Art. 22(2) LSSI), which you can withdraw at any time. More information in our Cookie policy.
Retention: the lifetime of each cookie stated in the Cookie policy, or until you withdraw your consent.

Website security

Data: technical server logs, such as your IP address and browser type.
Purpose: to protect the website and detect misuse and errors.
Legal basis: our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR).
Retention: a short period; the logs are kept by our web hosting provider.

3. Third-party content embedded in the website

Some pages load content from other providers. To display it, your browser connects to their servers, which receive your IP address:

Google Fonts: the website’s fonts are loaded from Google servers.
OpenStreetMap: the map on the bookings page is loaded from servers of the OpenStreetMap Foundation (United Kingdom).
BookingTable: the booking system embedded in the bookings page.

We do this on the basis of our legitimate interest in displaying the website correctly and offering you online booking (Art. 6(1)(f) GDPR).

4. Recipients of data

We do not sell your data. We only share it when necessary for these purposes or when required by law:

our web hosting provider;
BookingTable, for bookings;
Redsys and our bank (virtual POS), and WooPayments, operated with Stripe, for payments;
Automattic, for the Jetpack and WooCommerce services;
Google, for Google Analytics, Google Ads and Google Fonts;
the tax authorities and the courts, when required by law.

5. International transfers

Some providers are located outside the European Economic Area:

Google LLC, Automattic Inc. and Stripe, Inc. (United States): transfers are based on the EU–US Data Privacy Framework and/or the European Commission’s standard contractual clauses.
OpenStreetMap Foundation (United Kingdom): the United Kingdom is covered by a European Commission adequacy decision.

6. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, without affecting any processing carried out before. Email us at info@elterratrestaurant.com stating which right you wish to exercise and giving details that allow us to identify you. We will reply within one month, which may be extended in complex cases.

If you believe that we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

7. Minors

Our services are not aimed at children under 14. If you are under 14, please ask your parents or guardians to make the booking or purchase for you.

8. Security

We apply appropriate technical and organisational measures to protect your data against loss, unauthorised access or misuse; for example, the website uses an encrypted connection (HTTPS).

9. Changes to this policy

We may update this policy to reflect changes in the law or in our services. The version in force is always the one published on this page.

Last updated: October 2026

Privacy policy