Privacy, Cookies & Legal Notice

1. Legal notice (LSSI-CE)

This website (mijas.salu-restaurant.com) is an information and booking channel for the restaurant salú Calahonda, in Centro Comercial El Zoco, Calahonda, Mijas (Málaga), Spain. By using the site you accept the conditions in this notice.

The website operator is Baklafe S.L., NIF B56390537. Its identification and contact details are listed below.

Intellectual property

Texts, photographs, logos and design on this site belong to the operator of salú Calahonda, unless another owner is stated. You may not copy them for commercial use without prior written permission.

Liability

We take care to keep opening hours, the menu and contact details accurate. Kitchen hours and availability can still change — please confirm when you book. We are not responsible for the content or privacy practices of third-party sites you reach from our links.

Applicable law

This website is governed by Spanish law. Consumers in the EU keep any mandatory rights of their country of residence. Where a court must decide, the courts of Málaga apply, without prejudice to consumer jurisdiction rules.

2. Who we are (data controller)

The data controller for this website is Baklafe S.L., NIF B56390537, operator of SALU Italia in Calahonda:

3. What data we collect

We only collect the data you give us directly, plus limited technical data needed to run the site. We don't buy or trade personal data.

Table reservations

When you book a table through our online form, we collect your name, email, phone number, preferred date and time, party size, and any message you add. This is stored in the booking system and sent to our team by email and a private Telegram channel so we can prepare your table.

Events and group enquiries

If you send an events or group enquiry, we collect the details you enter (name, contact, type of celebration, date, number of guests, message) so we can reply with availability and a proposal.

WhatsApp & phone

If you contact us by WhatsApp or phone, we process whatever you share in that conversation. WhatsApp itself is provided by Meta and has its own privacy policy.

Browsing and analytics

Our hosting provider logs basic technical data (IP address, browser, time of request) for security and to keep the site working. If you accept analytics cookies, Google Analytics 4 also measures visits (pages viewed, device type, approximate location derived from IP). We do not build advertising profiles of guests, and we do not turn on Google Signals.

Website booking analytics

With your separate Analytics consent, we use Google Analytics 4 (GA4) to measure the effectiveness of this website and advertising channels, including visits, interactions and confirmed bookings made through the SALU Italia website. Consent to process a reservation is not consent to Analytics. You can book without accepting Analytics.

For a confirmed website booking, the booking_success event contains its confirmed status, party size and a stable random booking ID that does not contain your contact details. Technical visitor and session identifiers may link this event to your website visit. This is pseudonymous measurement: the restaurant can associate the booking ID with its booking record. We do not send your name, email, phone number or booking message to GA4, including hashes of these contact details.

Where server-side booking measurement is enabled, the confirmation event may be sent after the restaurant confirms a pending request, even if you have closed the page. It is sent only when Analytics consent was recorded for that booking and remains valid according to the consent information available to our system. Without that consent, or when the system knows it has been withdrawn or expired, the event is not sent.

You can accept, reject or change Analytics and Advertising separately in Cookies. Changes are recorded using a strictly necessary consent receipt, kept for up to 13 months; its identifier is not sent to GA4. Withdrawal applies to future measurement once received by our system and does not automatically erase events already sent. If you use another device, clear site data, or a technical failure prevents the change reaching us, we may be unable to link that change to an earlier booking. You can also notify us at salu.spain@gmail.com so we can record a withdrawal for the relevant booking. DISH is a separate booking channel; a click to DISH is not a confirmed website booking.

4. Legal basis for processing

• Performance of a contract / pre-contractual steps (Art. 6.1.b GDPR): reservations, event enquiries and preparing your visit.
• Legitimate interest (Art. 6.1.f GDPR): keeping the website secure and working, including essential technical logs.
• Consent (Art. 6.1.a GDPR): the booking-form checkbox; analytics cookies; advertising cookies if we run Google Ads measurement.
• Legal obligation (Art. 6.1.c GDPR): where Spanish tax or accounting rules require us to keep a record.

We do not send marketing emails or newsletters. If that changes, we will ask for separate consent first.

5. How long we keep your data

• Reservations and event enquiries: for as long as needed to host your visit and handle follow-up, then as long as Spanish accounting/tax rules require (typically up to 6 years where they apply).
• Analytics (only with consent): up to 14 months in Google Analytics, then deleted or aggregated.
• Cookie consent record: 13 months, then we ask again.
• Security logs: the short period our host keeps server logs for operations and abuse prevention.

6. Who has access to your data

We don't sell or rent your data. It is only shared with providers that make the restaurant website work, as processors under Art. 28 GDPR or as independent controllers of their own services:

• Timeweb Cloud — hosting of the website and the booking database, on a server in Moscow, Russian Federation.
• Cloudflare — technical relay for internal booking notices to our team's Telegram. It passes the message through; it is not used as a guest CRM.
• Telegram and Google (Gmail) — so staff can receive booking and enquiry notices.
• Google Ireland Ltd. / Google LLC — Google Analytics 4 and, if you consent to advertising cookies, Google Ads measurement; also Google Maps / Reviews when you click those links; typefaces may load from Google Fonts.
• WhatsApp (Meta Platforms Ireland Ltd.) when you choose that channel.

We may also disclose data where required by law or to a competent authority upon a valid legal request.

7. International data transfers

Some providers process data outside the European Economic Area:

• Timeweb Cloud stores the site in the Russian Federation, which has no EU adequacy decision. This is an international transfer under Chapter V GDPR. We keep this hosting under review with the owner.
• Google and Meta may process data in the United States. Where they participate, transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
• Telegram may process notifications outside the EEA under its own terms.

8. Your rights

Under the GDPR and LOPDGDD, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten").
• Request restriction of processing.
• Object to processing based on legitimate interest.
• Request data portability, where technically applicable.
• Withdraw consent at any time, where processing is based on consent — including analytics and advertising cookies. Withdrawal does not affect processing already carried out.
• Not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects. We do not make such decisions.

To exercise these rights, email salu.spain@gmail.com. We will answer within one month. You may lodge a complaint with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es.

9. Security

We apply reasonable technical and organisational measures: HTTPS, restricted access to the booking system, and secure delivery of staff notifications. No online system is 100% secure.

10. Cookies

We use cookies and similar storage (localStorage) as required by the LSSI-CE and the AEPD cookie guidelines. Essential cookies run so the site works. Analytics and advertising cookies are off until you accept them in the banner. You can Accept all, Reject all, or choose by category. Rejecting optional cookies does not block the website.

Cookie list

You can also delete cookies in your browser. Blocking essential cookies may stop language, theme or the booking form from working as intended.

Google's own information: policies.google.com/privacy and policies.google.com/technologies/cookies. You can opt out of Google Analytics collection via tools.google.com/dlpage/gaoptout.

11. Minors

This website and our booking service are not directed at children. Under Spanish law we do not knowingly collect personal data from anyone under 14 without a parent or guardian's consent. If you believe a minor has sent us data without that consent, email us and we will delete it.

12. Third-party links

The site links to Google Maps, Google Reviews, WhatsApp and Instagram. Those services have their own privacy policies. We are not responsible for how they process your data once you leave this website.

13. Changes to this policy

We may update this page when our tools or the law change. The date at the top is the last revision. If we add a new optional cookie category we will ask for consent again.

14. Contact

For this policy, your personal data or cookie choices:

salu.spain@gmail.com

+34 635 016 238

Centro Comercial El Zoco, C. de Los Adarves, 1, Urb. Sitio de Calahonda, 29649 Mijas, Málaga, Spain