Privacy policy

• Who handles your data: Grupo Amida Restaurantes 2025, S.L.U., the company behind the restaurants BàrBar, La Bodeguilla, Periplo Portixol, Bar Nicolás, Nura and Room Service.
• What for: to manage your booking and your visit, charge you, comply with the law and, only if you allow it, send you news and measure our advertising.
• Who we share it with: the providers that help us deliver the service (such as CoverManager, which manages bookings) and, if you accept advertising cookies, Google, Meta and OpenAI. We do not sell your data.
• Your rights: you can ask to access, correct or delete your data, or object, by writing to legal@grupoamida.com.

The details of each point are below.

• Controller: Grupo Amida Restaurantes 2025, S.L.U.
• Tax ID (NIF): B75868265
• Address: C/ Gremi de Cirurgians i Barbers, 25, A.3.2, 07009 Palma (Balearic Islands), Spain
• Email for anything about your data: legal@grupoamida.com

We do not have a data protection officer, as we are not required to. Questions about your data are handled by our administration team at the same email address.

Balikan Family 2025, S.L. (Tax ID B75868257), the group's parent company, runs the administration and accounting of Grupo Amida Restaurantes 2025, S.L.U. To do so it accesses billing data as a processor, only for that purpose.

When you book

Your first and last name, email, phone number, the date, time and party size, whether anyone at the table has allergies or intolerances (and which), your comments and whether you want to receive news. If you join the waiting list, also when the table would suit you. If the booking requires a guarantee, you enter your card on CoverManager's secure page: we never see the card number.

You can book on this website, through CoverManager's booking module, by phone or in person. If you book through another platform (for example, through Google), that platform passes on the details you gave it.

If you book for other people, make sure they are happy with it and tell them what this policy says.

When you visit

What you order and how you pay is recorded in our point-of-sale system (Ágora). The receipt does not carry your name; if you ask for a full invoice, it carries your tax details. If you pay by card, the card terminal sends it encrypted to the bank: we do not keep the card number.

In restaurants with security cameras, images of the signposted areas are kept for one month at most, unless they need to be kept as evidence of an incident (article 22 of the Spanish Data Protection Act, LOPDGDD).

When you write to us or call us

What you tell us and your contact details, so we can answer you.

When you browse the website

Technical data about your browser and your visit (IP address, device, pages, where you came from). Non-essential cookies are only used if you accept them; they are explained in the "Cookie policy".

Managing your booking

Creating it, confirming it, reminding you of it, changing or cancelling it, managing the waiting list and, if the booking requires it, the card guarantee and the charge for a no-show or late cancellation.

Basis: it is what you ask us for (performance of a contract or pre-contractual steps, art. 6.1.b GDPR).

Your allergies and intolerances

Only to prepare your food safely. This is health data: only the people who need it for the service see it, and we do not use it for anything else.

Basis: your explicit consent, which you give with the allergies tick box when booking on the website, or verbally if you book by phone (art. 9.2.a GDPR). You may choose not to give it, but then we cannot take them into account, and you can withdraw it at any time. If the allergies belong to someone else at the table, only tell us with their permission.

Charging and invoicing

Basis: complying with our tax and commercial obligations (art. 6.1.c GDPR).

Asking how it went

After your visit we may email you a link to a short Google survey so you can tell us how we looked after you. The survey contains no offers or advertising.

Basis: our legitimate interest in improving the service (art. 6.1.f GDPR). You can tell us you do not want more surveys from the survey itself or at legal@grupoamida.com.

Sending you news

By email or text message, only if you ticked the box when booking or asked us to. You can unsubscribe at any time with the link in each message or by writing to us. Booking never depends on accepting them.

Basis: your consent (art. 6.1.a GDPR).

Measuring the website and our advertising

With your consent in the cookie banner, we count visits and bookings that come from our ads on Google, Meta (Facebook and Instagram) and OpenAI (ChatGPT), to learn what works and who to show our ads to. Details are under "Advertising and measurement".

Basis: your consent (art. 6.1.a GDPR and art. 22.2 LSSI-CE).

Website and venue security

Protecting the website against abuse and, in venues with cameras, people and premises.

Basis: our legitimate interest (art. 6.1.f GDPR) and, for cameras, art. 22 of the Spanish Data Protection Act (LOPDGDD).

Answering your questions and requests

Basis: your request (art. 6.1.b GDPR) and our legal obligation to handle your rights (art. 6.1.c GDPR).

We do not make automated decisions that have legal effects on you or similarly significant effects.

Only if you accept analytics or advertising cookies in the banner. You can change your mind at any time under "Cookie settings" in the website footer.

• Analytics (Google Analytics 4): counts visits, pages and booking steps (without your name, email or phone). When a booking is confirmed, we also record it from our server with your browser's identifier, so that bookings confirmed later are not lost. Google keeps this data for 14 months.
• Google Ads advertising: when you book, Google receives the conversion with a booking number and, to attribute it to an ad, your email and phone number scrambled with an irreversible hash (SHA-256) before they leave your browser ("enhanced conversions"). With advertising cookies, Google also builds lists of website visitors so we can show them our ads.
• Meta (Facebook and Instagram): its pixel records visits and bookings and, when a booking is confirmed, we also send it from our server (Conversions API) with your IP address, your browser and its cookies (_fbp, _fbc), without your name, email or phone number. This is how we measure and improve our campaigns.
• OpenAI (ChatGPT): its pixel records bookings that come from our ads on ChatGPT and, when a booking is confirmed, we also send it from our server with your IP address, your browser and its cookies (__obref, __oppref), without your name, email or phone number. Bar Nicolás does not use it.

We do not upload customer lists to any advertising platform.

If you do not accept, Google Analytics and Google Ads may receive cookieless pings without identifiers (Google's "consent mode"), which are only used to estimate overall figures. Meta and OpenAI receive nothing.

With Google and Meta we are joint controllers for collecting this data through their tag or pixel on our website; what they then do with it for their advertising services is their sole responsibility. Meta governs this in its Controller Addendum and Google in its Controller-Controller Data Protection Terms. For enhanced conversions, Google processes the hashed email and phone number on our behalf, as a processor. OpenAI Ireland Limited acts as an independent controller under its Conversion Terms.

You can read their policies at policies.google.com/privacy, facebook.com/privacy/policy and openai.com/policies/privacy-policy.

With the providers we need to serve you. They handle your data on our behalf (processors), under a contract that stops them using it for anything else:

• CoverManager (Restaurant Booking & Distribution Services, S.L., Spain): bookings, the waiting list, the card guarantee, booking notifications, surveys and your opt-in to news.
• Ágora (Spain): the restaurants' point-of-sale system.
• Banca March, Banco Sabadell and Revolut: the card terminals. For their own payment and fraud-prevention obligations they act as independent controllers.
• Google (Google Workspace): the email we use to answer you.
• Vercel (USA): hosting for this website and for the server that handles bookings.
• Wistia, Inc. (USA): serves the website's videos; it receives your browser's IP address when they load. It sets no cookies.
• Sanity (Sanity AS, Norway, and its delivery network): stores and serves the website's texts and images; it receives your IP address when images load.
• Google Cloud (server in Madrid, EU): the tagging server that measurement goes through, if you accept it.
• Our internal management dashboard, which reads bookings from CoverManager for the restaurants' operations and statistics.
• Balikan Family 2025, S.L.: the group's administration and accounting.

And, only if you accept the relevant cookies, Google, Meta and OpenAI, as explained above.

We will also disclose your data to public authorities, courts or law enforcement when the law requires it. We never sell your data.

Some providers (Google, Meta, OpenAI, Vercel, Wistia and Cloudflare, the latter for OpenAI's pixel) are based in the United States or may process data there. They do so with the safeguards required by the GDPR: the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for participating companies and, otherwise, the European Commission's standard contractual clauses. Wherever possible, we choose servers in the EU.

• Bookings: up to 24 months after the booking date, to look after you if you come back and to handle any claim.
• Allergies and intolerances: up to 30 days after your visit, in case anything comes up; after that we delete it from the booking.
• Receipts and invoices: six years, as required by the Spanish Commercial Code (art. 30), and whatever tax law requires.
• News: until you unsubscribe.
• Analytics: 14 months in Google Analytics.
• Camera footage: one month at most, unless it is needed as evidence of an offence.
• Enquiries: as long as needed to answer you and, afterwards, the period for any claim.

After that, we delete the data or make it anonymous.

You can ask us at any time for:

• Access: to know whether we handle your data and which.
• Rectification: to correct anything that is wrong.
• Erasure: to delete it.
• Objection: to stop using it (for example, for surveys).
• Restriction: to keep it without using it while something is resolved.
• Portability: to receive it in a format you can take elsewhere.
• Withdrawal of consent (news, cookies, allergies), without affecting what was done before.

Write to us at legal@grupoamida.com or by post to the address above, telling us what you are asking for. If we cannot tell it is you, we will ask you to prove your identity. We answer within one month at most (two more months if the request is complex, and we will let you know).

If you ask us to delete your data, we also delete it in CoverManager and in the news mailing.

If you think we have not handled your rights properly, you can complain to the Spanish Data Protection Agency: aepd.es.

You must be at least 14 to book. If we learn that we have received data from a child under 14 without their parents' or guardians' permission, we delete it.

We protect your data with appropriate technical and organisational measures: encrypted connections, personal accounts with two-factor authentication where possible, least-privilege access and backups. If a security breach put your data at risk, we would report it to the Spanish Data Protection Agency within 72 hours and, if the risk is high, to you as well.

If we change how we handle your data, we will update this page and its date. If the change is significant, we will let you know.