To book a visit we need a few details from you. Here we explain exactly which ones, what we use them for, how long we keep them and what you can ask of us at any time. We do not sell or share data with third parties for commercial purposes.
1. Who the controller is
- Controller
- David Fernández Bodega S.L.
- Tax ID (NIF)
- B75893529
- Registered address
- C/ Buen Varón 16, 35544 Guatiza, Teguise, Lanzarote (Las Palmas), España
We are a small winery and are not required to appoint a data protection officer. For any question relating to your data you can write to the email address above, with “Data protection” in the subject line.
2. What data we process
We only process the data you give us, and the minimum needed to look after you:
- When booking a visit: first and last name, email address, phone number, number of people, chosen date and time, type of experience and, if you state it, your nationality — which the form suggests automatically and you can always correct or leave blank — and any comments or special requirements you wish to tell us. If you use a discount code, we also store the code applied.
- If you tick the relevant box: your consent to receive commercial communications by email.
- As proof of your booking: alongside the data above we record the date and time you confirmed, the IP address and browser you did so from, the page you were on, and the version of these terms published at that moment. This lets us evidence what you agreed to — including, if you ticked it, your permission to receive commercial communications — should it ever be disputed, which the law itself requires us to be able to do. We do not record the content of any comment you write to us.
- If you answer the satisfaction survey we send after the visit: your ratings and any comment you write, linked to your booking.
- When browsing: the usual technical data any web server records (IP address, date and time, page requested, browser type) in the access logs, and the session cookie described in section 11.
- If you write or call us: your contact details and the content of your message.
We do not collect data through third parties or buy databases, and the website has no user registration: there are no customer passwords to store.
3. What we use it for and on what legal basis
| Purpose | Legal basis (art. 6.1 GDPR) |
|---|---|
| Managing your booking: checking availability, holding the place and preparing your visit. | Performance of a contract or pre-contractual steps at your request (art. 6.1.b). |
| Sending you by email the confirmation with your booking code, reminders and, where applicable, notices of changes or cancellation; and, for the same reason, SMS messages to the phone number provided. | Performance of a contract (art. 6.1.b). |
| Answering the enquiries you send us by email or phone. | Legitimate interest in replying to whoever writes to us (art. 6.1.f). |
| Sending you a satisfaction survey after the visit and assessing the answers to improve the experience. | Legitimate interest in knowing the quality of our own service (art. 6.1.f). You may object at any time. |
| Sending you news and offers from the winery by email. | Your consent, given by ticking the box on the form (art. 6.1.a). You may withdraw it whenever you wish. |
| Meeting our accounting, tax and invoicing obligations. | Legal obligation (art. 6.1.c). |
| Keeping the website secure and available, and preventing abuse. | Legitimate interest in protecting our systems (art. 6.1.f). |
The fields marked as required in the booking form are required precisely because without them we cannot manage the visit: if you do not provide them, the booking cannot be completed. Those marked as optional can be left blank with no consequence.
We do not take automated decisions producing legal effects on you, nor do we build profiles from your data.
4. Allergies and special requirements
The comments field of the form lets you tell us about allergies, intolerances or accessibility needs. That information may reveal data about your health, which the GDPR protects with additional safeguards (art. 9).
We only process it if you decide to tell us, with your explicit consent (art. 9.2.a GDPR) and for a single purpose: adapting the visit and the tasting to what you need. Only the staff who will look after you see it, and it is deleted along with the rest of the booking data. If you would rather not write it in the form, you can tell us by phone on the day.
5. How long we keep it
- Booking data: while the visit is being prepared and carried out and, afterwards, for the limitation periods of any liability arising from it.
- Invoicing and accounting: the periods required by tax and commercial law, generally six years from the last entry.
- Data used for commercial communications: until you withdraw your consent or unsubscribe, at which point we stop using it.
- Survey answers: for as long as they are useful for improving the service; after that we keep them dissociated from your identity or delete them.
- Server technical logs: the time needed for the maintenance and security of the site, and in no case longer than applicable law requires.
- Proof of booking and consent: six years, the same commercial period as the business records, after which it is deleted automatically.
Once those periods have elapsed, the data is securely deleted.
6. Who we share it with
We do not sell, rent or transfer your data to third parties for commercial purposes. To provide the service we rely on some suppliers who access the data on our behalf — data processors — with whom we have signed the contract required by article 28 GDPR: Brevo (Sendinblue SAS, France) for sending the emails and SMS messages relating to your booking and, if you have consented, the commercial communications; the hosting provider of the website and of the database where bookings are stored; and our tax and accounting advisers, to meet the winery's accounting and tax obligations.
In addition, we may disclose data to public authorities, courts and law enforcement bodies where a statutory provision requires us to do so.
7. International transfers
Our suppliers process the data within the European Economic Area, so as a general rule no international transfers take place.
It is worth knowing that some pages of the site load fonts and libraries hosted on third-party servers (Google Fonts and the jsDelivr repository). When the page is displayed, your browser connects to them directly and discloses your IP address, which may be processed outside the EEA. We do not send them any other data about you, nor do we use those connections to track your browsing.
The contact and getting here pages may also show a Google Maps map (Google Ireland Limited). Unlike the fonts, that map is NOT loaded by default: it only connects to Google's servers if you accept the cookie banner or expressly click “View map”. If you do, your browser discloses your IP address, which Google may process outside the EEA under its own standard contractual clauses.
8. Your rights
You may exercise the following rights at any time:
- Access: knowing what data of yours we process and obtaining a copy.
- Rectification: correcting inaccurate data or completing incomplete data.
- Erasure: asking us to delete it when it is no longer necessary.
- Restriction: asking us to keep it but stop using it while a dispute is resolved.
- Portability: receiving the data you provided in a structured format, or having us send it to another controller.
- Objection: objecting to processing based on our legitimate interest, such as the satisfaction survey.
- Withdrawing the consent you have given, without affecting the lawfulness of processing carried out beforehand.
To exercise them, write to us at info@bodegadavidfernandez.com stating which right you wish to exercise; we may ask you to prove your identity. We will reply within one month. To stop receiving commercial communications you do not even need that: just use the unsubscribe link included in every email.
If you believe we have not dealt with your request properly, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).
9. Minors
Bookings can only be made by people over the age of 18, who are the ones providing the data. We do not knowingly collect data from minors through the website; if we detect that it has been provided, we will delete it. If you believe a minor has given us their data, let us know and we will sort it out.
10. Security
We apply reasonable technical and organisational measures to protect your data: the site runs entirely over an encrypted connection (HTTPS), access to the database is restricted to winery staff through individual password-protected accounts with permissions limited to what each person needs, actions on bookings are logged, and regular backups are taken.
No system is infallible: should a security breach occur that poses a high risk to your rights, we will inform you and notify the supervisory authority in accordance with the GDPR.
11. Cookies
This website uses its own technical cookies, those essential for it to work, with no need for your consent (they are exempt under article 22.2 of the Spanish LSSI). We do not use advertising or profiling cookies.
The exception is the map on the contact and getting here pages: if you accept the cookie banner or click “View map”, a Google Maps iframe is loaded which installs Google's own cookies (third-party cookies from our point of view). Until you take that step, those pages keep a static map and a link to open it separately in Google Maps, without connecting to Google.
If you decline the banner — or never open it — the rest of the site works exactly the same. You can change your mind whenever you like: the “Cookie settings” link in the footer, on any page of the site, reopens the panel where you accepted or declined each one.
| Cookie | What it is for | Duration |
|---|---|---|
| Session cookie | Keeps the state of your visit while you complete the booking steps, and holds the winery staff's session in the management panel. | Deleted when the browser is closed or the session expires. |
| Security cookie (CSRF token) | Protects the forms against fraudulent submissions from other pages. | Session. |
| Cookie banner preference | Remembers in your own browser whether you accepted or declined the Google Maps map, so we do not ask again. It is not sent to our servers. | Until you clear this site's data in your browser. |
| Google Maps cookies (only if you accept) | Those installed by Google when the embedded map on the contact and getting here pages is shown. We do not manage them: they are set by Google itself. | As determined by Google. |
You can delete or block these cookies from your browser settings (Chrome, Firefox, Safari and Edge all allow it in their privacy section), but bear in mind that if you block them the booking form will not be able to complete.
As explained in section 7, when the page loads your browser also connects to the Google Fonts and jsDelivr servers to download fonts and libraries. Those connections do not install tracking cookies on your device.
12. Changes to this policy
We may update this policy if the services we offer, the suppliers we use or the applicable legislation change. The version in force is always the one published on this page, with the last update date shown at the top. If the change were substantial and affected processing based on your consent, we would inform you.
This is a courtesy translation. In case of any discrepancy, the Spanish version prevails.
If you have any questions about this text, write to us at info@bodegadavidfernandez.com.