Privacy policy

1. Data controller

• Owner: Chiringuito Ayo Nerja S.L.
• Tax ID (NIF/CIF): B93290526
• Address: Paseo Burriana, 15, 29780 Nerja (Málaga)
• Email: elchiringuitodeayo@gmail.com

2. What data we process

• Technical browsing data (IP address, browser type, date and time of access) that the server records automatically for security and correct operation.
• Order and contact data: name, phone, products, options, amount, pickup time and order code. The website does not ask for free-text order notes.
• Payment data: payment status, reference and amount. Full card details are entered in Redsys and are not stored by Chiringuito Ayo.
• Communications you send us by phone, email or social media.

3. Purpose and legal basis

• Manage, charge for, prepare and hand over the order: performance of the contract.
• Handle questions, incidents and complaints: performance of the contract and legitimate interest.
• Comply with tax, accounting and consumer obligations: legal obligation.
• Prevent fraud and protect the website: legitimate interest.

4. Retention

Operational contact and order data is generally kept for no longer than 30 days to manage pickup and possible incidents. Information required for payment, invoicing, accounting or the defence of claims is retained for the periods required by law. It is then securely deleted or anonymised.

5. Recipients

Data may be processed, only where necessary, by the hosting provider, Redsys and the banks involved in payment, and communications or support providers. Agora receives only the operational data required to prepare the order (code, products, options, amount and pickup), not the customer's name or phone number. Data may also be disclosed where legally required. Loading the map establishes a connection with Google Maps under its own privacy policy.

6. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to elchiringuitodeayo@gmail.com, attaching a copy of an identity document. If you believe the processing does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Minors

Orders must be placed by people with legal capacity to contract. Alcohol may only be purchased and collected by people aged 18 or over.

8. Security

The owner applies appropriate technical and organisational measures to protect data. Communications from the browser to the website and Redsys use HTTPS; contact details are kept out of tickets and Agora, with restricted access and scheduled deletion. The website never receives or stores PAN or CVV data.