Privacy Policy

Data Controller

The entity responsible for the processing of your personal data is:

For any enquiry related to data protection, you may contact us at: feedback@block-house.es

Personal Data Collected

Depending on the services you use, we may collect the following personal data:

• Identification data: name, surname, tax ID (NIF/CIF/NIE)
• Contact data: email address, phone number, postal address
• Reservation data: date, time, number of guests, special requests
• Billing data: tax ID, company name, billing address
• Navigation data: IP address, browser type, pages visited, session cookies
• Authentication data: email address, verification codes (temporary)

Purpose of Processing

Your personal data is processed for the following purposes:

• Managing restaurant reservations and related communications
• Responding to enquiries submitted through the contact form
• Generating invoices as requested by the customer
• Authenticating users for the reservation and invoice systems
• Complying with legal and tax obligations
• Improving our website and services

Legal Basis for Processing

The legal bases for the processing of your data are:

• Consent: when you submit the contact form or accept cookies.
• Performance of a contract: when you make a reservation or request an invoice.
• Legal obligation: for tax and accounting purposes.
• Legitimate interest: for improving our services and ensuring the security of our website.

Data Retention

Your personal data will be retained for the following periods:

• Reservation data: for the duration of the reservation plus 1 year for potential claims.
• Invoice data: 5 years as required by tax legislation.
• Contact form data: until your enquiry has been resolved, plus 1 year.
• Authentication data: for the duration of the session (30 days maximum for persistent sessions).
• Cookie consent: 12 months.

Data Recipients

Your data may be shared with the following recipients:

• Google LLC: if you sign in using Google Sign-In (subject to Google's Privacy Policy).
• Email service providers: for sending verification codes and reservation confirmations.
• Public authorities: when required by law (tax authorities, courts).

We do not sell your personal data to third parties.

Your Rights

Under the GDPR, you have the following rights:

• Right of access: to know what personal data we hold about you.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure: to request deletion of your data when it is no longer necessary.
• Right to restriction: to limit the processing of your data in certain cases.
• Right to data portability: to receive your data in a structured, commonly used format.
• Right to object: to oppose the processing of your data based on legitimate interest.

To exercise any of these rights, please send an email to feedback@block-house.es with a copy of your ID document.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted storage, secure connections (HTTPS), and access controls.

Cookies

This website uses cookies. For detailed information, please consult our Cookie Policy.

Account Deletion (Block House App and Website)

If you use the Block House mobile app, you can delete your account and the associated personal data at any time:

1. Open the Block House app and go to the "Account" (Cuenta) tab.
2. Tap "Delete account" (Eliminar cuenta).
3. Review the summary of what is erased and what is kept, then confirm the deletion.

On this website: sign in, open "My account" → "Your details" and choose "Delete my account". Before you confirm you will see what is erased and what we are required to keep.

You can also request deletion by emailing feedback@block-house.es from the address linked to your account.

Data that is deleted: your sign-in identity for the app and the website, and your personal data in our systems (name, email address, phone number, date of birth, communication history, delivery addresses, the notes on your reservations and any upcoming reservations). In accordance with Article 32 of Spanish Organic Law 3/2018, this data is blocked immediately — nobody can view or use it, except to make it available to judges, courts and public authorities — for the period provided for by law; once that period has passed it is destroyed for good.

Data that is retained: invoices already issued are kept for the period required by Spanish tax and commercial law (Article 30 of the Commercial Code and tax regulations, between 4 and 6 years). They are deleted once that period expires.

Security record: to prove that we complied with your request and to prevent fraudulent use, we keep a record that contains neither your name nor your email address in clear text (only a cryptographic fingerprint of the address), together with the date, the channel and the IP address the request came from. The IP address is erased together with the blocked data; the rest of the record is kept for three years. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You may register again at any time; the new account will have no link to the old one.

Changes to This Policy

We reserve the right to update this Privacy Policy. Any changes will be published on this page. Last updated: March 2026.