Privacy and cookies policy

Who is responsible for your data

The data controller is:

Company name

Valentina Kovtunenko

Trade name

Urban Garden

Tax ID (NIF)

Z0186420X

Registered address

Av. Rosa dels Vents, 15, 03570 Benidorm, Alicante

Restaurant

Av. Rosa dels Vents, 15, 03570 Benidorm, Alicante

Phone

+34 644 04 83 36

E-mail

privacy@ugarden.es

What data we process, why, and on what legal basis

We only process the data you give us yourself when you place an order, and the data generated by using the website.

• Handling and delivering your order. Data: first and last name, phone number, e-mail address, delivery address (street, number, postcode, town, entrance, floor and door), the map point if you pick one or it is derived from the address, the order note, the chosen date and time slot, and the dishes ordered. Legal basis: performance of the contract (art. 6.1.b GDPR). Without the fields marked as required we cannot process the order.
• Suggesting and locating the delivery address. When you type the address or open the map at checkout, the text you type and the map area are sent to Google (Google Maps Platform) to suggest addresses and show the map. If you press “My location”, your browser asks for permission first and the position is used only to centre the map and fill in the address. Legal basis: performance of the contract (art. 6.1.b).
• Taking payment. You pay in a form provided by Stripe; we do not receive or store your card number, only the confirmation of the payment. Legal basis: performance of the contract (art. 6.1.b).
• Telling the restaurant about your order. When an order is confirmed, an automatic notice with its details is posted in the restaurant staff’s internal Telegram group so that the order can be prepared and handed over. Legal basis: performance of the contract (art. 6.1.b).
• Legal obligations. Invoicing, accounting and tax records. Legal basis: compliance with a legal obligation (art. 6.1.c).
• Website statistics (Google Analytics 4 through Google Tag Manager). Only if you accept. We measure which pages and dishes are viewed, what is added to the cart and whether an order is completed (order number and amount — never your name, phone, e-mail or address), together with technical data such as device type, browser and approximate location, to improve the menu and the website. With your consent we also keep with your order your browser's Google Analytics identifier and the link or campaign that brought you (e.g. the table QR code) and the site that sent you, to know which channels bring orders; with that identifier we may report to Google Analytics that the order was completed (order number and amount). If you have accepted statistics but not advertising, our server reports the completed order (order number, amount, items and the pseudonymous Google Analytics identifier) to Google Analytics, with advertising use marked as denied. Legal basis: your consent (art. 6.1.a GDPR and art. 22.2 LSSI); you can withdraw it at any time.

Apart from the Google Ads advertising described in “Advertising (Google Ads)”, which works only with your consent, we do not use your data for advertising or profiling, we make no automated decisions that affect you, and we do not sell personal data. Order data are not used to send you marketing messages.

Advertising (Google Ads)

Only if you accept, we use Google Ads to measure which of our ads lead to an order (conversion measurement) and to show our own ads, including to people who have already visited this website (remarketing). You give your consent with “Accept” or with the “Advertising” option in “Cookie settings”, and it is independent of the statistics one: you can give either without the other. If you do not, no advertising cookie is set and the website and orders work just the same.

• Purpose. Measuring conversions (which ads lead to an order) and showing our own ads, including by remarketing.
• Data. What the Google Ads cookies and your browser generate: cookie identifiers, the ad you clicked, the pages you view and whether an order is completed (order number and amount — never your name, phone, e-mail or address), together with technical data such as IP address, device and browser. We also keep with your order the ID of the click on our ad (gclid, gbraid or wbraid), to report to Google Ads which ads ended in an order (order number and amount).
• Recipient. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), acting for Google LLC (United States). Privacy policy.
• International transfers. Because Google LLC is in the United States, these data may be processed there under the EU–US Data Privacy Framework (Google LLC is certified) and, otherwise or in addition, the standard contractual clauses of the European Commission (art. 46 GDPR).
• Legal basis. Your consent (art. 6.1.a GDPR and art. 22.2 LSSI).
• Cookies and duration. They are listed, with their duration, in the advertising table of the cookies section below.
• How to withdraw. At any time, without affecting what was done before, with the “Cookie settings” link on this website: on withdrawal the _gcl_* and _gac_* cookies of this website are deleted.

If you think your data is not handled properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es; your other rights are explained in “Your rights and how to exercise them”.

Who receives your data

We rely on the following providers to run the service. Apart from them, we communicate data only to public authorities when the law requires it (for example, the tax authority).

• Stripe (Stripe Payments Europe, Ltd. and Stripe, Inc.): payment processing. Privacy policy.
• Telegram (Telegram Messenger Inc.): the internal channel where the restaurant receives each order notice, with name, phone, e-mail, address and map link, note, dishes, amount and payment status. Privacy policy.
• Google (Google Ireland Limited and Google LLC): Google Maps Platform (address suggestions and map, whenever you use the address field or the map at checkout), Google Tag Manager (the tag container, which always loads; without your consent it sets no cookies and sends no events) and, only with your consent, Google Analytics (statistics) and Google Ads (advertising). Privacy policy.
• Hosting and infrastructure: Vercel Inc. (the website), Hetzner (the server of the ordering system, where orders are stored) and Supabase (storage of the dish images, which receives only the technical data any server receives when it sends you a picture, such as your IP address).

International transfers

Google, Stripe, Telegram and Vercel operate in the United States and other countries outside the European Economic Area, so some of your data may be processed there. These transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it (Google, Stripe and Vercel are) and, otherwise or in addition, on the standard contractual clauses approved by the European Commission (art. 46 GDPR). You can ask us for information on these safeguards using the contact details above.

How long we keep your data

• Orders and invoicing data: for as long as needed to handle the order and, afterwards, blocked and available only to the authorities during the limitation periods of tax and commercial law (generally between 4 and 6 years).
• Unfinished carts: if you abandon the checkout, the details you had already entered may remain in an unfinished cart; we delete them on request and, in any case, once they are no longer needed.
• Statistics (Google Analytics): 14 months, after which Google deletes the data.
• Where an order came from (only with your consent: Google Analytics ID, the link or campaign you arrived by and the referring site): 14 months from the order, then removed from the order. The order itself is kept as stated in the first point.
• Advertising (Google Ads): the cookies, for the period in the advertising table below; the data Google processes through them is kept for the period set in Google’s privacy policy. The ID of the click on our ad kept with the order is removed together with that data, 14 months after the order.
• Cookies and local storage: the durations are in the table below.

Your rights and how to exercise them

You can ask us, free of charge, for access to your data, rectification, erasure, restriction of processing and portability, and you can object to the processing. Where processing is based on your consent you can withdraw it at any time, without affecting what was done before (for cookies, with the “Cookie settings” link on this website).

You can exercise these rights by writing to privacy@ugarden.es, in writing at Av. Rosa dels Vents, 15, 03570 Benidorm, Alicante or by calling +34 644 04 83 36. We will answer within one month (art. 12 GDPR) and, if necessary, ask you to prove your identity first.

If you think we are not handling your data properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es.

Cookies and local storage

A cookie is a small file that a website stores on your device; local and session storage work in a similar way. This website uses only the ones listed here. Statistics and advertising cookies are set only if you accept them.

Strictly necessary (always active)

They make the website and your order work, so they are exempt from consent (art. 22.2 LSSI) and cannot be switched off here.

Statistics (only with your consent)

They are set only if you press “Accept” or switch on “Analytics” in the settings. If you reject or withdraw consent they are not set, and any that exist are deleted.

Advertising (only with your consent)

They are set only if you press “Accept” or switch on “Advertising” in the settings. If you reject or withdraw consent they are not set, and those of this website (_gcl_* and _gac_*) are deleted.

Change or withdraw your choice

You can change your choice at any time:

You can also block or delete cookies in your browser settings; the website keeps working, although the cart and the payment may stop doing so.

Even if you reject the statistics cookies, your browser loads Google Tag Manager (the tag container), as it would load any other external resource; without your consent it sets no Google Analytics cookie and sends no statistics events.

Consent to advertising is independent of consent to statistics: you can switch on “Advertising” without “Analytics”, and the other way round. Without your consent to advertising your browser still loads Google Tag Manager, but no Google Ads cookie is set.

Changes to this policy

We update this policy when the service or the law changes. The date at the top shows the current version.