Privacy policy

1. Purpose

This Privacy Policy explains to people who visit our website (hereinafter, users or data subjects) how we collect, process and protect the personal data they choose to provide by any means, including forms, email, telephone and contracts, so that after reading it they can freely decide whether they want us to process their data. It also expands on the information previously provided in the privacy notices used when personal data are collected.
This policy is also intended to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the GDPR), and Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and the Guarantee of Digital Rights (hereinafter, the LOPDGDD).

2. Who is responsible for processing your personal data?

Identity / Entity: BEGIN RESTAURANTES, S.L.
Tax ID (CIF/NIF): B40626392
Postal address: Av. Cortes Valencianas, 50, 46015 Valencia, Spain
Email: rrhh@beginrestaurante.com
Business activity: Restaurant services
Website: beginrestaurante.com
Registration details: Registered in the Commercial Registry of Valencia, Volume 10754, Book 8034, Folio 132, Section 8, Page 190498, Entry 11.

3. What personal data will we process and how do we obtain them?

To carry out our business activity, we need to process personal data. They may be collected digitally, for example by email, online forms or questionnaires, through paper documents, or during in-person or telephone conversations. In every case, the data will be processed fairly, lawfully and transparently.
Our entity may process the following categories of data:

Identification data: first name and surname, national identity document or equivalent, image and handwritten or digital signature.
Contact data: telephone number, email and postal address.
Commercial data: booking history.
Accounting data: income and expenditure records and billing data.
Banking data: bank accounts and payment cards.
Transactions involving goods and services: bank transfers and direct debits, amounts and descriptions.
Financial data: payment terms and collection management.
Browsing data: time spent on our website, pages visited and demographic data such as age and sex.

Our entity will not collect special-category data, such as health data, ethnic origin, political opinions or religious beliefs. If processing such data becomes necessary, we will inform you and request your prior express consent.
The data requested will be adequate, relevant and limited to what is strictly necessary. They will be processed only by staff and/or collaborators authorised by our entity who have signed a confidentiality undertaking and agreed to comply with the security requirements necessary to guarantee the confidentiality, integrity and availability of the data and all other legal requirements established by the GDPR.
The data are provided by the data subject or their legal representative and will always be processed with prior express consent where consent is the applicable legal basis.
If a data subject does not provide the requested data, or provides incomplete or incorrect data, we may be unable to establish or maintain the relevant relationship.

The categories of data we may process about a person depend on the relationship they have with our entity, as described below:
Customers: We process identification, contact, commercial, accounting, banking, goods and services transaction, and financial data. They will be collected only if you provide them when booking a table or requesting an invoice.
Information requesters: Whether information is requested by telephone or in writing, for example by email or online form, we will request and process identification, contact and commercial data.
Suppliers and business partners: We process identification, contact, commercial, accounting, banking, goods and services transaction, and financial data. These data may be processed throughout every stage of the commercial relationship.
Job applicants: For this category, we process CV, identification and contact data and other data relating to professional or personal characteristics when an application is submitted by any means, including in person, by email or through online forms. These data may also be collected during recruitment interviews, either in person or by video call, and an application may reach us through a collaborator to whom we have delegated certain functions. For further information, see our Job Applicant Policy.
Social media users: We have profiles on different social media platforms and may process identification, contact and commercial data, as well as other data that the user enables to be viewed or shared with other platform users, including CV information on platforms such as LinkedIn. For further information, see our Social Media Policy.
Collaborators: We process identification, contact, commercial, accounting, banking, goods and services transaction, and financial data throughout every stage of the commercial relationship.
Complainants: We process identification and contact data and personal information about you or third parties that you choose to disclose in connection with the complaint submitted to us.
Reporting persons: Reports may be submitted anonymously through our internal reporting channel. You may also voluntarily provide identification and contact data and other personal information about yourself or third parties related to the report, in accordance with Spanish Law 2/2023 of 20 February on the protection of persons who report regulatory infringements and the fight against corruption. Further information is available in the terms of the Internal Reporting Channel.
Website users: When you visit our website, and only if you expressly authorise it, analytics data such as visit duration or pages viewed and demographic data such as sex, age, country or language may be collected. For further information, see our Cookie Policy.
Further information for data subjects: The information required by law will be made available in the relevant privacy notices included in the different data collection methods so that you can decide freely and expressly whether our entity may process the requested personal data.
Every category and type of personal data processed will be duly identified in the corresponding records of processing activities owned by our entity.

4. For what purposes will your data be processed?

In general, our entity processes personal data to establish and maintain relationships with different groups of people, including customers and suppliers. This also applies to people who proactively contact us through our online forms, by telephone, in person, by email or by post, including job applicants, information requesters, users of our website or blog and social media, and data subjects in general.
Depending on that relationship, your data are processed for different purposes, including but not limited to the following:
Customers: Your personal data will be processed to identify you; establish and maintain the pre-contractual and contractual relationship, including sending commercial communications through different channels; answer enquiries; carry out quality controls and commercial statistics; organise prize draws and award prizes; manage accounting and billing, transactions involving goods and services and collections; manage incidents, complaints and the exercise of rights; and fulfil any other purposes required to maintain that relationship, comply with applicable laws and pursue our legitimate interests.
Information requesters: We will process your personal data to respond to requests for general information, identify you, and send or provide quotations and information about goods and services in which you are interested, including commercial information related to the request in our verbal, written or digital response. We will also follow up through different channels to learn what decisions you have made regarding the commercial proposals sent to you.
Suppliers and business partners: Your personal data will be processed to maintain the commercial relationship, whether to request quotations, purchase goods or engage services, identify you, manage accounting, carry out transactions involving goods and services, and fulfil other purposes necessary to maintain the relationship and comply with our legal obligations and legitimate interests.
Job applicants: Your data will be processed to include you in our recruitment processes and candidate pool, identify you, contact you and inform you about vacancies, coordinate interviews and handle other matters related to your application. For further information, see our Job Applicant Policy.
Social media users: We will process your personal data to maintain the relationship as users of the same social media platform, identify and contact you, share news and process other personal data that you allow to be shared with other members of the platform. For further information, see our Social Media Policy.
Complainants: Personal data will be processed to identify you, manage your complaint, contact you about its status and comply with our legal obligations and legitimate interests.
Reporting persons: Personal data that you choose to provide in a report will be processed to register and manage the report and, unless it is anonymous, to identify and contact you, acknowledge receipt and keep you informed about our investigation within the periods and on the terms established in Spanish Law 2/2023 of 20 February. We may also process your data on the basis of our legitimate interests and whenever necessary to comply with other legal obligations. Further information is available in the terms of the Internal Reporting Channel.
Website users: Data may also be processed for different purposes, such as visit analysis, when you accept the installation of cookies while visiting our website. For further information, see our Cookie Policy.
Further information for data subjects: The information required by law will be made available in the relevant privacy notices included in the different data collection methods, such as forms, recorded messages and contracts, and in other documents made available to you, such as notices, invoices and legal notices, so that you can decide freely and expressly whether our entity may process the requested personal data.

If you do not provide the requested data, or provide incomplete or incorrect data, we may be unable to respond to your request, process a purchase or sale, or provide our services.
Data will not be subsequently processed for purposes other than those accepted by data subjects.
Processing purposes will be duly identified in our records of processing activities.

5. Why do we process your data?

Our entity processes your personal data on one or more of the following legal bases:

Your express, freely given, informed and unambiguous consent, after being informed when your data are collected and in greater detail through this Privacy Policy. After reading and accepting it, you may voluntarily authorise us to process your data for one or more purposes by selecting the boxes provided for that purpose on our online forms or by signing the privacy notices supplied whenever we request your personal data.
The performance of a contract to which you are a party or steps taken at your request before entering into a contract.
Compliance with a legal obligation applicable to our entity.
The legitimate interests pursued by our entity or a third party, provided those interests are not overridden by the interests or fundamental rights and freedoms of the data subject. Our entity has balanced these interests and always respects fundamental rights.

If the user is under 14 years of age, consent from a parent, guardian or legal representative is required. Users are solely responsible for the accuracy of the data they submit.

6. Data retention

Personal data will be retained while we maintain a relationship with you and for as long as necessary to fulfil the purpose for which they were collected. Once that relationship has ended, data will be blocked where retention is necessary until the applicable limitation periods expire, solely for complaints or legal proceedings and to comply with our legal obligations. Examples include:

Data subjects	Area	Legal basis	Retention period
Customers Suppliers	Accounting	Article 30.1 of the Spanish Commercial Code	6 years from the date of the last entry.
Customers Suppliers	Tax	Article 66 of Spanish General Tax Law 58/2003	General period: 4 years. Where losses are incurred during the financial year: 10 years. Invoices: 5 years.
Employees	Employment	Article 21 of Royal Legislative Decree 5/2000 on labour and social security infringements	4 years.
Job applicants	Employment	Employment Relations Guide	1 year.
Employees	Occupational risk prevention	Article 4.3 of Royal Legislative Decree 5/2000 on labour and social security infringements	5 years.
Customers Suppliers Visitors Job applicants Employees	Video surveillance	Article 22.3 of the LOPDGDD	1 month.
Reporting persons Affected persons	Internal Reporting Channel	Articles 26.2, 32.3 and 32.4 of Spanish Law 2/2023.	If the reported events have been investigated, retention will not exceed 10 years. Data will be retained only for the time strictly necessary to decide whether to open an investigation. If the information provided is shown to be false, it must be deleted immediately unless the falsehood could constitute a criminal offence, in which case it will be retained for the time necessary to conduct judicial proceedings. If no investigation is opened within 3 months after receipt of the report, the data must be deleted.
Job applicants	Job applications	Employment Relations Guide of the Spanish Data Protection Agency	1 year.

7. Profiling

We do not create profiles or make automated decisions using your personal data. If we do so in the future, you will be informed and your prior authorisation will be requested.
You also have the right to object to this type of processing at any time by writing to contacto@beginrestaurante.com.

8. Data disclosure

As a general rule, our entity does not disclose personal data to third parties, although disclosure may sometimes be necessary.

If you are a customer or supplier, your personal data may be disclosed to third parties where required by law, such as the Spanish Tax Agency, or to entities necessary to provide our services or pay invoices, such as banks. For home delivery, your data may be disclosed to companies collaborating with our entity where necessary to deliver your order.

Your personal data as a customer or supplier may also be processed by certain providers to whom we delegate some of our obligations, such as accounting advisers. Every provider has entered into a data processing agreement under which it undertakes to comply with the same security measures implemented by our entity and with the duty of secrecy and confidentiality concerning the personal data processed, among other personal data protection obligations.

If you are a job applicant, your data will not be disclosed to third parties unless we are legally required to do so.

If you are an information requester or a user of our website, your data will not be disclosed to third parties unless we are legally required to do so.

We may disclose personal data to judges, courts, public prosecutors and/or competent public authorities in connection with potential claims where legally required.

9. International data transfers

If data are transferred to third parties located outside the European Economic Area, we will inform you and request your prior express consent where consent is required.

10. Security measures

Our entity has implemented all technical and organisational measures necessary to protect the personal data processed and prevent their loss, theft or unauthorised use.

These measures have been designed according to the types of data processed and the purposes of processing. They are periodically reviewed through internal compliance controls and external audits.

11. Your rights

As the holder of your personal data, acting on your own behalf or through your legal representative, you may contact our entity at any time to exercise your personal data protection rights.
These rights are explained below:

Right of access:
You have the right to ask us at any time for the following information:

Whether or not we are processing your personal data.
The purposes of processing and the categories of personal data concerned.
The source of the data where you did not provide them.
The recipients or categories of recipients to whom the data have been or will be disclosed, including recipients in third countries or international organisations.
Information about appropriate safeguards relating to transfers to a third country or international organisation, where applicable.
The envisaged retention period or, if that is not possible, the criteria used to determine it.
The existence of automated decision-making, including profiling, meaningful information about the logic involved, and the significance and envisaged consequences of such processing.
A copy of the personal data being processed.

Right to rectification:
You may ask us to rectify inaccurate personal data and complete incomplete data.

Right to object:
You may object to processing where the data are incorrect or processing is no longer necessary. If you are a reported or affected person under Spanish Law 2/2023, you may not exercise the right to object because legitimate grounds for processing are presumed to exist, unless proven otherwise, under Article 31.4 of that law.

Right to erasure:
You may ask us to erase your data where:

The data are no longer necessary for the purposes for which they were collected or processed.
You have not consented to the processing of your data.
You have exercised the right to object.
The data have been unlawfully processed.
The data must be erased to comply with a legal obligation.

Right to restriction of processing:
You may request restriction in one or more of the following cases:

You contest the accuracy of the data, for a period enabling the controller to verify their accuracy.
The processing is unlawful and you oppose erasure and request restriction instead.
We no longer need the data for processing, but you require them to establish, exercise or defend legal claims.
You have objected under Article 21(1) of the GDPR while it is verified whether the legitimate grounds of the controller override yours.

Right to data portability:
You have the right to receive data concerning you in a structured, commonly used and machine-readable format and transmit those data to another controller.

Right not to be subject to automated decisions:
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

How to exercise your rights:
To exercise any right, write to BEGIN RESTAURANTES, S.L. at Av. Cortes Valencianas, 50, 46015 Valencia, Spain, or email contacto@beginrestaurante.com, stating which rights you wish to exercise. If you act on behalf of another person, you must provide evidence of your authority.

If you wish to submit a suggestion or enquiry concerning personal data processing, you may contact our data protection consultants:
BUSINESS ADAPTER, S.L.
Ronda Guglielmo Marconi, 11, 26, Parque Tecnológico, 46980 Paterna, Valencia, Spain.
Data subject enquiry form

You have the right to lodge a complaint with the Spanish Data Protection Agency at C/ Jorge Juan, 6, 28001 Madrid, Spain, or through www.aepd.es.

12. Commitment to personal data protection

Scope

Our commitment to personal data protection is binding on every department and employee of our entity and on third parties acting on our behalf.

Purpose

We have established procedures for processing personal data in accordance with European and Spanish data protection legislation.

Principles

We process data lawfully, fairly and transparently and apply data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.

Special categories of data

Our entity prohibits the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic or biometric data, health data or data concerning sexual orientation, except where legally permitted and with the prior consent of the data subject where required.

Rights of data subjects

Our entity will handle and respond to requests to exercise rights as quickly and diligently as possible.

Records of processing, impact assessments and security measures

Our entity maintains records of processing activities and analyses processing purposes, categories of data subjects and data, recipients, international transfers and retention periods to assess processing risks and implement the security measures necessary to guarantee the confidentiality, integrity and availability of personal data.

For each processing activity, we assess whether a Data Protection Impact Assessment is necessary and whether a Data Protection Officer must be appointed. Where required, the person appointed will have sufficient knowledge and experience under applicable law.

Monitoring

We receive external advice on these matters and monitor publications from competent supervisory authorities and other European and Spanish organisations concerned with data protection law to ensure continued compliance.

13. Updates to this policy

Our entity reserves the right to amend this Policy without prior notice. We therefore recommend reviewing it whenever you visit our website.

Last updated on 6 October 2023.