Privacy Policy

1. Data controller

• Business: Ritmo y Fusión
• Address: Carrer de Blai 28, Poble Sec, 08004 Barcelona, Spain
• Email: [email protected]
• Phone: +34 934 207 149

2. What we collect, and why

We only collect what you give us:

• Bookings: name, email, phone, date, time, number of guests, occasion, dietary preferences, allergies, message and language. Purpose: to manage and confirm your booking. Legal basis: performance of the contract and pre-contractual steps.
• Allergies and dietary preferences: this field is optional and may reveal health data. We use it solely to prepare your service in the dining room and the kitchen, and we process it with your explicit consent, given by filling it in. If you would rather not write it here, tell us by phone or on arrival.
• Prize draws: name, email and Instagram handle, to manage your entry and contact the winner. Legal basis: your consent, given by ticking the box.
• News and offers: a separate box, always optional. Ticking it is required neither to book nor to enter a draw, and you can withdraw that consent at any time.
• Chat: the messages you exchange with us and the detected language, so that we can reply.

3. Cookies and measurement

The site sets no measurement cookie until you accept one. On your first visit a banner offers to accept, reject, or choose.

• Your choice: is stored in your browser (local storage, key rf_cookie_consent). It is strictly necessary in order to honour your decision, and therefore requires no consent.
• If you decline: Google tags run in restricted mode (Consent Mode v2). No advertising or analytics cookie is written, and you cannot be identified or recognised from one visit to the next.
• If you accept: we use Google Analytics and Google Ads to measure our audience and how well our ads perform.
• Counting arrivals from ads: we count how many visits come from an ad, storing no identifier, no IP address, not even the click identifier itself. It is an anonymous counter that cannot reconstruct an individual visit — which is why it works regardless of your choice.

You can change your mind at any time from the cookies link in the footer.

4. Who else sees your data

We do not sell your data and do not pass it to anyone for commercial purposes. We work with the following providers, who process it on our behalf:

• Supabase — the database holding bookings and prize-draw entries.
• Cloudflare — hosting for the site and its images.
• Google — sending booking confirmation emails and, if you have accepted, Analytics and Ads.
• MyMemory — automatic chat translation. When we show you a reply from our team in your own language, your browser sends that text to the service, which also receives your IP address. If you would rather avoid this, email or call us instead.
• Authorities: only where the law requires it.

5. How long we keep it

• Bookings: your personal data — name, email, phone, message, allergies — is erased 30 days after the meal. The booking survives only as anonymous data (date, number of guests, source), which can no longer identify you.
• Chat messages: deleted 7 days after the meal.
• Prize-draw entries: 6 months after entry. The email address is only used to notify the winner.
• If you opted in to our news: we keep your name and email beyond those periods — that is precisely what you agreed to — until you withdraw it. Everything else (phone, message, allergies) is erased on the same schedule.
• Withdrawing that consent: email us at [email protected] and we will remove your address from the list.

After those periods the data is deleted or anonymised by an automated process. You may ask us to erase it sooner at any time.

6. Security

• All connections to the site are encrypted (HTTPS).
• The bookings and prize-draw tables are not publicly readable: access is restricted to the restaurant’s authorised accounts.
• Access to the data is limited to staff who need it for their work.

7. Your rights

Under the GDPR you may at any time:

• Access: request a copy of your data.
• Rectification: have inaccurate data corrected.
• Erasure: ask us to delete it.
• Portability: receive it in a reusable format.
• Objection and restriction: object to a processing operation or ask that it be restricted.
• Withdraw consent: without affecting the lawfulness of what was done beforehand.

Write to [email protected] and we will reply within one month. If you believe your request was not handled properly, you may complain to the Spanish data protection authority, the AEPD (www.aepd.es).

8. Minors

The site is not aimed at anyone under 16 and we do not knowingly collect their data. Group bookings that include minors are always made by an adult.

9. Changes

This policy may change. Any change is published on this page, together with its update date.