Privacy policy
Last updated: 4 November 2026
At Espacio UMA we handle the data of those who book, give a gift or write to us with the same care we bring to the table, and only the data we need. Here we explain what data we process, for what purpose, for how long, who we share it with and how you can exercise your rights, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD; Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights).
1. Who the controller is
- Controller: UMA CONCEPT, S.L. (trade name: Espacio UMA)
- NIF (Spanish tax ID): B67124446
- Address: C/ Mallorca 275, bajos local 1A, 08008 Barcelona (Spain)
- Email: [email protected]
- Phone: +34 656 99 09 30
- Data protection officer: we do not have one, because our activity does not require it.
2. What data we process, for what purpose and on what legal basis
| Purpose | What data | Legal basis | How long we keep it |
|---|---|---|---|
| Managing your reservation (on the website, by phone or by email), confirming it, reminding you of it and applying the cancellation policy | Name, phone, email, date, time, number of guests and comments. To guarantee the reservation or pay for it in advance (for example, on special dates), card details are entered directly into the payment gateway of the reservation system | Performance of the contract (art. 6.1.b GDPR) | For as long as the reservation lasts. Afterwards, billing data, 6 years (art. 30 of the Código de Comercio, the Spanish Commercial Code); the rest, up to 2 years without a new reservation, blocked for possible claims before being erased (art. 32 LOPDGDD) |
| Preventing duplicate reservations (a check carried out by CoverManager with other restaurants in its system) | Name, phone, email and reservation details | Legitimate interest in preventing duplicate reservations and empty tables (art. 6.1.f GDPR); you can object | As long as needed to carry out that check, according to CoverManager’s criteria; you can ask us for the details at [email protected] |
| Allergies and intolerances you tell us about so we can adapt the menu | Health information you give us | Your explicit consent, which you give us when you tell us about the allergy or intolerance so that we adapt the menu; you can withdraw it whenever you wish (art. 9.2.a GDPR) | We use them only for that service; they remain as a note on the reservation for the period stated for reservation data, unless you ask us to erase them sooner |
| Gift cards (online purchase) | Name and email of the buyer and of the recipient of the card, chosen menu and card code | Performance of the contract (art. 6.1.b GDPR) | While the card is valid (8 months) and, afterwards, the period of accounting and tax obligations (6 years) |
| Replying to your messages by email or phone, and preparing quotes for groups, events, catering or private chef | Name, contact details and whatever you tell us | Your request: steps taken at your request prior to entering into a contract (art. 6.1.b GDPR) or our legitimate interest in replying to you (art. 6.1.f GDPR) | The time needed to deal with your request and, if no contract is concluded, up to 12 months after the last contact |
| Job applications (CV you send us by email) | The data in your CV and your message | Your consent when you send it to us (art. 6.1.a GDPR) | Up to 12 months for future recruitment processes, unless you ask us to erase it sooner |
| Marketing communications (only if you tick the box when booking or buying) | Name, email and phone | Your consent (art. 6.1.a GDPR); you can withdraw it in each message or by writing to us | Until you withdraw it |
| Measuring the use of the website and of our ads (Google Analytics, Google Ads, Meta) | Browsing and device data (cookies and identifiers), pages visited, clicks on phone, email or gift card and, if you book, a notification that a reservation has been made, with the number of guests, an estimated value and a reservation code (without name or contact details) | Your consent, which you give or refuse in the cookie notice (art. 6.1.a GDPR and art. 22.2 LSSI, the Spanish Information Society Services and Electronic Commerce Act) | As long as each cookie lasts (see the Cookie policy) |
| Complying with legal obligations (invoices, accounting, requests from the authorities) | Invoice and transaction data | Legal obligation (art. 6.1.c GDPR) | The periods set by law (Código de Comercio and tax legislation: up to 6 years) |
The data we ask you for is what is necessary for each purpose: if you do not provide it, we will not be able to make the reservation, issue the card or reply to you. If you give us another person’s data (for example, of the recipient of a gift card or of your companions), we ask you to tell them beforehand. If you receive a gift card, your name and email were given to us by the person giving it to you; we use them only to send you the card and manage its redemption.
We do not make automated decisions or create profiles with legal effects concerning you.
3. Who we share the data with
We do not sell data. We share it only with:
Providers that process it on our behalf (processors: under contract and following our instructions):
- CoverManager (Restaurant Booking & Distribution Services, S.L.U., Spain): reservation system and gift card shop, with its payment gateway. More information: https://www.covermanager.com/es/politica-de-privacidad
- Cloudflare, Inc. (United States): hosting and delivery of the website.
- Raiola Networks (Spain): email [email protected].
- Our accounting and tax adviser (Spain): accounting and tax obligations.
- Google Ireland Limited (Ireland), for Google Analytics, only if you accept analytics cookies.
Companies that also use the data for their own purposes, only if you accept marketing cookies or click on a video or a map:
- Google Ireland Limited (Ireland): Google Ads, YouTube and Google Maps, under Google’s terms.
- Meta Platforms Ireland Limited (Ireland): Meta pixel (except as explained about the reservation module in the Cookie policy). UMA and Meta are joint controllers for collecting that data and sending it to Meta; what Meta does afterwards is decided by Meta as controller. Agreement: https://www.facebook.com/legal/controller_addendum
According to the notice in the reservation module, CoverManager also uses the reservation data to detect duplicate reservations at other restaurants that use its system; for that purpose it decides on its own account (see the table in section 2).
We may also disclose data to public authorities, judges and courts when required by law.
If you visit our Instagram or Facebook pages, Meta and UMA are joint controllers for the processing of the data in those pages’ statistics (https://www.facebook.com/legal/terms/page_controller_addendum); Meta’s information is at https://www.facebook.com/privacy/policy
4. Transfers outside the European Economic Area
Some providers (Cloudflare, Google and Meta) may process data in the United States. These transfers are covered by the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023), for participating companies, and by the standard contractual clauses approved by the European Commission. You can ask us for a copy of these safeguards at [email protected].
5. Your rights
You can ask us at any time to:
- access your data;
- rectify it if it is inaccurate;
- erase it;
- object to our processing it, or ask us to restrict its processing;
- exercise your right to data portability for the data you gave us;
- withdraw your consent whenever you wish, without this affecting what was done before.
Write to us at [email protected] with the subject “Protección de datos” (Data protection), or by post to C/ Mallorca 275, bajos local 1A, 08008 Barcelona. We will reply within one month; if the request is complex, we may extend this by two further months and will tell you so within the first month. If there is any doubt about your identity, we may ask you to prove it.
If you believe we have not handled your request properly, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD) (Spanish Data Protection Agency; www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).
6. Minors
The website is not intended for children under 14, who must not give us personal data without the consent of their parents or guardians (art. 7 LOPDGDD).
7. Security
We apply technical and organisational measures to protect data, such as website encryption (HTTPS) and username and password access to the reservation and email systems. Our providers have their own security safeguards.
8. Changes
If we change this policy, we will publish the new version here with its date. See also the Legal notice and the Cookie policy.