Privacy policy

When you book a table, the one who decides what is done with your data is the restaurant you book with. It is the data controller, and it is the first place to take any complaint.

Resvity is the company that makes the software the restaurant uses. We act as a data processor: we process your data only to provide the service to the restaurant and following its instructions, never on our own account. This relationship is governed by a processing agreement under article 28 of the GDPR that we sign with each restaurant.

Resvity is based in Lleida. For any data protection matter, including the provider’s full registration details, write to hola@resvity.com and we will provide them in writing.

You give us all of this data when you make the booking, either on the restaurant’s booking page or by phone while someone at the restaurant takes it down. We do not buy data from anyone or take it from any other source.

If you arrive without a booking, the restaurant only records how many of you there are and which table you sit at. That record carries no name and no phone number.

A note such as «nut allergy» or «gluten free» is health data, and the GDPR protects it more strongly than the rest (article 9). That is why:

• It only exists if you write it. Neither the booking page nor the restaurant asks you for it.
• Writing it amounts to explicitly consenting to the restaurant using it to prepare your meal.
• It is used for that and nothing else: not for profiling and not to decide anything about you.
• You can ask for it to be deleted at any time, without losing the booking.

Some restaurants run a loyalty programme, and in that case the booking page offers you the chance to join. It is voluntary: if you don’t tick it, the booking goes ahead just the same and nothing changes.

• Joining means consenting to the restaurant writing to you with its offers and news. The legal basis is that consent (article 6.1.a of the GDPR) and nothing else.
• The restaurant keeps your name, phone and email while you are in the programme, and sees how many times you have visited, to know who has reached the reward it has set.
• It is the restaurant that writes to you, not Resvity. Resvity does not send you marketing of its own and does not offer your data to any other restaurant.
• You can leave whenever you like by telling the restaurant, and withdrawing consent does not affect anything sent before.

Leaving the programme does not cancel any booking or delete your visit history, which the restaurant still needs in order to look after you.

With very few people, and always because it is needed:

• With the restaurant you book with, which needs it to look after you. A restaurant never sees another restaurant’s guests.
• With Resvity, as data processor, to run the software and support it.
• With the providers that host the servers, also as processors and under the same article 28 agreement. We will tell you in writing who they are if you ask.
• With public authorities or the courts, if the law requires it.

We do not sell your data, do not pass it to advertisers and do not use it to advertise other restaurants to you.

Resvity makes no international transfers of data. If it ever had to, this policy would say so beforehand, together with the safeguards under chapter V of the GDPR relied on.

Bookings and the related history are kept while the restaurant has the service and while they help it look after you. If the restaurant leaves Resvity, it has thirty days to take a copy and then the data is deleted from our systems. When a booking is no longer useful, it is kept without name or phone, so covers can still be counted without knowing whose they were.

If you ask for deletion earlier, it is deleted earlier, unless the restaurant must keep something because of a legal obligation, such as accounting.

The GDPR gives you these rights, and exercising them is free:

• Access (art. 15): to know what data about you exists and get a copy.
• Rectification (art. 16): to correct anything inaccurate, for example a phone number taken down wrongly.
• Erasure (art. 17): to ask for it to be deleted when it is no longer needed.
• Restriction (art. 18): to ask for it not to be used while a complaint is resolved.
• Portability (art. 20): to take away the data you gave, in a machine-readable format.
• Objection (art. 21): to object to processing based on legitimate interest, such as recording no-shows.
• Withdrawing consent at any time, without affecting anything done before it was withdrawn.

To exercise them, write to the restaurant you booked with. If it is easier, write to us at hola@resvity.com and we will pass it on to the restaurant, which is the one that must answer. The deadline for a reply is one month.

If you believe they have not been respected, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. In Catalonia, if the restaurant is a public-sector body, the competent authority is the APDCAT.

There are none. Resvity keeps a guest’s booking history and shows it to the restaurant as it is, but it does not calculate any likelihood of you not turning up and makes no automated decision about you. If it ever did, this policy would say so beforehand, with the logic involved and its consequences.

The booking page uses no tracking cookies, no third-party analytics and no social media pixels. Nor does this website. That is why we don’t ask you to accept anything when you arrive. The only cookie that may be stored is the language you choose, which holds nothing else.

We apply the technical and organisational measures of article 32 of the GDPR and review them when the infrastructure changes. Two can be checked from outside: no restaurant ever sees another restaurant’s data, and neither the booking page nor this website loads tracking cookies, third-party analytics or social media pixels. Details of encryption, backups and access control are provided in writing to anyone who asks, and form part of the processing agreement each restaurant signs.

If there were a security breach that put you at risk, the restaurant must notify the AEPD within 72 hours and you without undue delay.

If we change this policy, we will update the date at the top and, if the change is significant, the restaurant will let you know. The terms of service are on the terms page. This text also exists in Catalan and Spanish; the three versions say the same thing.