Privacy policy
Last updated: October 2026
This policy explains what personal data we process at Restaurante Aralar through the website restaurantearalar.eu, by telephone and by email, what we use it for, who receives it and what rights you have, in accordance with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights. How the website uses cookies is explained in the cookie policy.
Data controller
- Controller: SOCIEDAD HOSTELERA EHIZTARI SL (Restaurante Aralar)
- Tax ID (CIF): B95323655
- Address: Ibáñez de Bilbao, 16, 48001 Bilbao (Bizkaia)
- Telephone: 944 230 952 · 944 230 963
- Email: aralar2004@gmail.com
What data we process and why
When you visit the website. This website has no forms, no user accounts and no tool that identifies you. Your browser sends the server some technical data with every request: your IP address, the date and time, the page requested, the page you came from and the type of browser and operating system. Our hosting provider records them in order to serve the website and to protect it against attacks and misuse. Legal basis: our legitimate interest in keeping the website secure (art. 6.1.f GDPR).
When you call or write to us. Bookings and enquiries reach us by telephone and by email. We use the data you give us (your name, your telephone number or email, the day and time, the number of guests and whatever you tell us) to deal with your enquiry or booking, and to organise events, business lunches or orders if you ask us to. Legal basis: taking steps at your request before entering into a contract or, if you are already a customer, performing the contract (art. 6.1.b GDPR).
We do not use your data to send you advertising, to take automated decisions or to build profiles.
Who receives your data
We do not pass your data on to third parties, except where the law requires it. It is received, only on our behalf and following our instructions, by our web hosting provider and by the provider of our email, which is Google (Gmail service). If that provider processes data outside the European Union, it does so with the safeguards the GDPR requires.
How long we keep it
We keep booking requests and correspondence for as long as necessary to deal with them and, afterwards, blocked for the limitation periods of any liabilities that may arise, including those the law requires for tax and accounting purposes. Server logs are kept for a short time.
Your rights
You can ask us at any time for access to your data, for its rectification or erasure, for the restriction of its processing, for portability of the data you have given us, or object to our processing it. To exercise any of these rights, write to aralar2004@gmail.com or to the postal address given above. We may ask you to prove your identity.
If you believe we have not processed your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es (opens in a new tab)).
Security
The website is served only over an encrypted connection (HTTPS), and only the people who need your data to deal with your request have access to it.