Last updated: August 2026.

1. Data controller

Controller: La Polonesa Hostelería S.L.
Tax ID (NIF): B10717023
Address: Calle de Narciso Serra 3, 28007 Madrid
Contact: [email protected]

2. What data we process and why

We process only the data you provide in the reservation request form:

Name, phone and e-mail: to reply to you and handle the reservation.
Date, time, number of people and high chairs: to plan the tables.
Notes: an optional free-text field. We recommend not including health information or other sensitive data; an allergy can just as well be mentioned by phone or on arrival.

We additionally store the date and time of your consent and a cryptographic fingerprint of your IP address. The fingerprint cannot be reversed to the original address and is used solely to limit abusive automated form submissions.

3. Legal basis

Handling the reservation: steps taken at the request of the data subject prior to entering into a contract, Article 6(1)(b) GDPR, together with the consent you tick in the form, Article 6(1)(a).
Protecting the form against abuse: legitimate interest in the security of the service, Article 6(1)(f).
Recording no-shows: the restaurant’s legitimate interest in not losing booked tables that stay empty without notice, Article 6(1)(f). You may object as described in section 5.
Web analytics: your consent only, Article 6(1)(a), which you may withdraw at any time.

4. Retention period

Reservation request data is kept for a maximum of 3650 days. After that, an automated process deletes the name, phone, e-mail and notes. Only statistical information without personal data (date, time and number of guests) is retained, so the restaurant can understand its busy periods.

You may request earlier deletion by writing to [email protected].

5. No-shows

If you book a table, receive our confirmation and then neither come nor cancel, restaurant staff may record this. In that case we store a cryptographic fingerprint of your e-mail address and phone number, your name and the date of the reservation. The fingerprint cannot be reversed to the address or the number: it only serves to check whether a new request comes from the same contact.

The consequence is that for 6 months you cannot book through the website form. Booking by phone remains available at all times, so at no point are you refused a table or entry to the restaurant.

The entry is always made by a member of staff, never by an automated system, so this is not automated decision-making within the meaning of Article 22 GDPR. The entry expires on its own after 6 months and is deleted. If there was a mistake or a good reason for the absence, write to [email protected] or call 914 33 94 57 and we will remove it.

6. Recipients

We do not sell or share your data for commercial purposes. Only the following providers are involved, acting as processors:

Web hosting and e-mail provider (seohost.pl), where the website and messages are stored, with servers in the European Union.
Cloudflare, providing form protection against automated submissions (Turnstile) and content delivery services.
Google Ireland Limited, only if you accept analytics cookies, for Google Analytics 4.

7. Your rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw your consent at any time, by writing to [email protected] or by post to the address above, providing proof of identity.

If you believe your request has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid, or with the supervisory authority in your country of residence.

8. Security

The website runs entirely over an encrypted connection (HTTPS). Reservation data is stored in the site database with access restricted to authorised restaurant staff. Contact details linked to no-shows are stored only as a cryptographic fingerprint, never in the clear.

9. Minors

The form is intended for people over 14 years of age. We do not collect children’s data; indicating the number of high chairs involves no identifying information about the children.

Privacy policy