Last updated: 29/07/2026

At a glance

Topic Information
Controller Pablo Japón González — C/Santiago Apóstol, 37 (Local), 21002 Huelva, Spain — DNI 49111248S
Purpose Managing your restaurant account and providing you with the Gastrali service, a complete solution for managing your restaurant
Legal basis Performance of a contract; compliance with a legal obligation (working-time records); legitimate interest
Recipients Technology providers (hosting, email, authentication, payments) acting as processors/sub-processors. No disclosure to third parties without informing you
Retention For as long as the contractual relationship lasts, and the minimum period required by applicable law (e.g. 4 years for clock-in records)
Rights Access, rectification, erasure, objection, portability and restriction, at contacto@gastrali.com

1. Data controller

Pablo Japón González, with address at C/Santiago Apóstol, 37 (Local), 21002 Huelva, Spain and national ID (DNI) 49111248S, is responsible for this website and the Gastrali platform. Contact: contacto@gastrali.com.

Depending on the type of data, Gastrali acts in two different ways (see below): as Data Controller (for the data of restaurant accounts that register on Gastrali) and as Data Processor (for the data of diners and employees that the Restaurant manages through the platform, on behalf of that Restaurant).

2. What data we process and why

2.1 If you are a restaurant registering on Gastrali (here Gastrali is the Controller)

  • Data: account name, email and password (managed via Supabase), restaurant name, tax ID (CIF), address, town, province and the restaurant’s visual customisation.
  • Purpose: creating and managing your account, providing the service you subscribed to, and managing your subscription plan and billing.
  • Legal basis: performance of the service contract (Art. 6.1.b GDPR).
  • Retention: for as long as you keep your account active, and afterwards for the period required by applicable tax/commercial law.

2.2 If you are a diner making a reservation at a restaurant that uses Gastrali (here Gastrali is the Processor; the Controller is the Restaurant)

  • Data: name, phone number, email (if you provide it), number of people, date/time and reservation notes.
  • Purpose: managing your reservation and sending you email confirmations.
  • Legal basis: the pre-contractual/contractual relationship between you and the restaurant (Art. 6.1.b GDPR) — determined by the Restaurant as controller.
  • Retention: according to the retention policy applied by the Restaurant you are booking with.
  • To exercise your rights over this data, you must contact the restaurant where you made the reservation directly, as it is the one that decides on it. Gastrali works with the restaurant to help you exercise them.

2.3 If you are an employee of a restaurant that uses Gastrali (here Gastrali is the Processor; the Controller is the Restaurant that employs you)

  • Data: name, access code, role, contracted hours, assigned schedule (shifts) and clock-in records (in, out, breaks).
  • Purpose: shift planning and compliance with the legal obligation to record working hours (Article 34.9 of the Spanish Workers’ Statute).
  • Legal basis: compliance with the employer’s legal obligation (Art. 6.1.c GDPR) and performance of the employment contract — determined by your employer (the Restaurant) as controller.
  • Retention: clock-in records are kept for a minimum of 4 years, as required by employment law.
  • To exercise your rights over this data, you must contact your employer (the Restaurant), as data controller.

2.4 If you are a diner ordering/paying at the table through the customer app (here Gastrali is the Processor; the Controller is the Restaurant)

  • Data: the dishes and the amount of your order, linked to your table during the session — you are not asked for your name or email to order at the table. If you pay by card, the card details are processed directly by Stripe; Gastrali only receives a technical payment confirmation (amount, table, payment ID), without full card details.
  • Purpose: managing your order and your payment at the restaurant.
  • Legal basis: performance of the contractual relationship between you and the restaurant (Art. 6.1.b GDPR) — determined by the Restaurant as controller.
  • Retention: table session data is kept for as long as needed to manage the service; order records for billing purposes are kept according to the tax law applicable to the Restaurant.

3. Who we share data with

With the technology providers that make the service possible (transactional email, authentication, payment processing, hosting of the admin portal), which act as processors or sub-processors and are contractually bound to protect the data and use it only to provide the service. We do not sell data to third parties or use it for our own advertising. The backend, the database and the real-time sync server are hosted on our own server in Spain.

3.1 International data transfers

Some of our providers (Stripe for payments, Netlify, Supabase and Resend) may transfer data outside the European Economic Area, mainly to the United States. These transfers have safeguards recognised by European law: the EU-U.S. adequacy framework (Data Privacy Framework) and/or Standard Contractual Clauses approved by the European Commission. Stripe, in particular, is certified under the EU-U.S. Data Privacy Framework.

4. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability:

  • If you hold a restaurant account: by writing to contacto@gastrali.com.
  • If you are a diner or employee of a restaurant that uses Gastrali: by contacting that restaurant directly, as explained in points 2.2, 2.3 and 2.4.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe your rights have not been respected.

5. Security

We apply reasonable technical and organisational measures to protect the data: encrypted communications (HTTPS), access control to the platform and regular backups.

6. Cookies and marketing communications

Gastrali does not use analytics or third-party cookies, and does not track you on the web. We also do not send newsletters, marketing communications or advertising — the only emails we send are transactional (e.g. a reservation confirmation).

7. Responsibility for the accuracy of data

The user (restaurant) is solely responsible for the accuracy and correctness of the data it enters into the Gastrali platform, whether its own, its diners’ or its staff’s.

8. Changes to this policy

We may update this Privacy Policy. We will publish any relevant change on this page, together with the date of the last update.

This is an English translation provided for convenience. In the event of any discrepancy, the Spanish version shall prevail.