Privacy

PRIVACY POLICY

 

Last updated: June 1, 2026

 

DATA CONTROLLER

 

CAN CARLITOS, S.L., with registered address at C/ Jaume I, 17, 1º 1ª (07860) Formentera, Spain, Tax ID (NIF) B-57969008, and email address info@cancarlitosformentera.com.

 

PERSONAL DATA

 

The Data Controller will collect only personal data that is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed, as applicable in each case.

The user guarantees the authenticity of the data provided and shall be solely responsible for any false or inaccurate statements.

This website may contain links to external websites. The Data Controller assumes no responsibility for the content or any other aspect related to such external websites.

The Data Controller reserves the right to modify this Privacy Policy at its discretion or as a result of legal, jurisprudential, or doctrinal changes issued by the Spanish Data Protection Agency or the relevant European authorities. Continued use of the website after such changes have been implemented shall imply acceptance of those changes.

 

PURPOSES OF PROCESSING

 

The personal data received will be processed for the following purposes, as applicable in each case:

 

• Management of reservations and billing, including reservation processing and monitoring, customer communication, and invoice collection management.
• Management of special requests, preferences, or dietary intolerances communicated through the reservation.
• Management of the takeaway service, including order processing and monitoring, customer communication, and invoice collection management.
• Interaction with users through social media profiles providing information via Aigua Aire’s active social media accounts.
• Prevention, detection, and control of abuse and fraud committed on or through the website.
• Compliance with legally established obligations.

 

LEGAL BASIS FOR PROCESSING

 

The legal basis for processing personal data shall be the user’s consent, where provided, for the following purposes:

 

• Management of special requests, preferences, or dietary intolerances communicated through the reservation.
• Interaction with users through social media profiles providing information via Aigua Aire’s active social media accounts.

 

The user may withdraw consent at any time without affecting the lawfulness of processing carried out prior to such withdrawal.

The legal basis for processing personal data shall also be the performance of a contract for the following purposes:ç

 

• Management of reservations and billing, including reservation processing and monitoring, customer communication, and invoice collection management.
• Management of the takeaway service, including order processing and monitoring, customer communication, and invoice collection management.

 

The processing of personal data for the above purposes is necessary for the Data Controller to fulfil its contractual obligations.

The legal basis for processing personal data shall be compliance with a legal obligation for the following purposes:

 

• Management of reservations and billing, including reservation processing and monitoring, customer communication, and invoice collection management.
• Compliance with legally established obligations.

 

The processing of personal data for these purposes is necessary for CAN CARLITOS, S.L. to comply with its legal obligations under applicable legislation.

Finally, the legal basis for processing personal data shall be the Data Controller’s legitimate interest for the following purpose:

 

• Prevention, detection, and control of abuse and fraud committed on or through the website. This legitimate interest is based on the Data Controller’s intention to maintain a secure website environment.

 

RECIPIENTS

 

CAN CARLITOS, S.L. will not disclose personal data to third parties except where required by law or to subcontracted service providers.

CAN CARLITOS, S.L. may contract services from third parties located outside the European Economic Area (EEA), in countries that do not provide data protection regulations equivalent to those of the European Union, thereby involving international data transfers. Specifically, the following company may have access to personal data necessary to provide the services contracted as a data processor:

 

• La Fourchette SAS (TheFork): Platform used to manage user reservations through the website. Standard Contractual Clauses approved by the European Commission apply. A copy is available at: https://www.thefork.es/legal#PoliticaDePrivacidad

 

In addition, social media platforms used through Aigua Aire’s active profiles may carry out international data transfers as independent data controllers. Copies of their privacy policies can be obtained from their respective websites. CAN CARLITOS, S.L. shall not be responsible for the processing carried out by such platforms and declines any liability arising from the use, exploitation, dissemination, communication, or reproduction of images and voice recordings by third parties without explicit consent.

 

DATA RETENTION PERIODS

 

Where the legal basis for processing is the user’s consent, personal data will be retained until such consent is withdrawn.

Where the legal basis for processing is the performance of a contract, personal data will be retained for the duration of the contractual relationship.

Where the legal basis for processing is compliance with legal obligations, personal data will be retained for the period required by applicable legislation.

Notwithstanding the above, personal data will be retained for as long as necessary for the establishment, exercise, or defence of legal claims, in accordance with applicable legislation. Where appropriate, data will be blocked until the relevant limitation period has expired.

 

USERS’ RIGHTS

 

You may exercise your rights of access, rectification, erasure, restriction of processing, objection, and data portability at any time by sending a written request to Carretera Sant Hilari s/n (08506) Calldetenes, Spain, or by email to rgpd@canjubany.com.

Specifically, you may exercise the following rights:

 

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Request the deletion of your data when, among other reasons, it is no longer necessary for the purposes for which it was collected.
• Request the restriction of processing where any of the conditions established under data protection legislation apply.
• Object to the processing of your data in certain circumstances and on grounds relating to your particular situation. In such cases, the Data Controller will cease processing the data unless there are compelling legitimate grounds or the processing is necessary for the establishment, exercise, or defence of legal claims.
• Obtain human intervention, express your point of view, and challenge automated decisions made by the Data Controller, where applicable.
• Request the portability of your personal data.

 

If you consider that the processing of your personal data infringes applicable regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), the competent supervisory authority in Spain: www.aepd.es.

PDF Privacy policy