Privacy Policy

INFORMATION ON THE PROCESSING OF PERSONAL DATA

BODEGAS EL PIMPI, S.L., with Tax Identification Number (CIF) B-93094084 and registered address at Calle Granada, No. 62, Postal Code 29015 Málaga (hereinafter, BODEGAS EL PIMPI), hereby informs users, through this Privacy Policy, about the processing of personal data carried out in the development of its activities.

Personal data processing will be conducted in accordance with Regulation (EU) 2016/679 of April 27, 2016, General Data Protection Regulation (GDPR), Organic Law 3/2018 of December 5 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and any other applicable legislation.

BODEGAS EL PIMPI will process personal data in respect of the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and proactive accountability.

This Privacy Policy may be modified whenever necessary as a result of regulatory changes, modifications to the processing activities performed, or changes in the services provided. When modifications affect processing activities based on consent and require new consent in accordance with applicable regulations, such consent will be requested prior to carrying out the new processing.

DATA CONTROLLER

Controller: BODEGAS EL PIMPI, S.L.
Tax Identification Number (CIF): B-93094084
Registered Address: Calle Granada, n.º 62, C.P. 29015 Málaga, Spain
Email: lopd@elpimpi.com

DATA PROTECTION OFFICER

BODEGAS EL PIMPI has appointed as Data Protection Officer (DPO):

Entity: LEGAL ADVISORS IN COMPLIANCE
Contact Person: Ernest Abelló
Email: legal@universecompliance.com

For any communication addressed to the Data Protection Officer, the following subject line must be explicitly included in the email: EL PIMPI.

Data subjects may address the Data Protection Officer directly regarding any issue concerning the processing of their personal data and the exercise of their rights.

PERSONAL DATA PROCESSING ACTIVITIES

BODEGAS EL PIMPI carries out the processing activities detailed below:

I. RESERVATIONS

When a person requests a table reservation at BODEGAS EL PIMPI, whether through the online booking system, by telephone, or through any other enabled channel, their personal data will be processed to:

Manage and confirm the reservation.
Identify the person making the reservation.
Maintain necessary communications related to the booking.
Manage modifications or cancellations.
Address incidents related to the reservation.
Properly organize the requested service.

Data processed:

First name and surname.
Phone number.
Email address.
Date and time of the reservation.
Number of guests.
Remarks voluntarily provided by the customer that are necessary to manage the reservation.

When the data subject provides information regarding allergies, intolerances, or other health-related circumstances, this information will be considered a special category of data and will only be processed when necessary to fulfill the request and when a valid processing condition applies under Article 9 of the GDPR.

Personal data that is not necessary for managing the reservation must not be included in the remarks section.

Legal basis:

The processing of ordinary data necessary to manage the reservation is based on the application of pre-contractual measures requested by the data subject and, where applicable, the execution of the contractual relationship.

When health-related data provided voluntarily to adapt the service to customer needs is processed, explicit consent will be requested when required as the legitimating condition for processing.

Recipients:

Data will not be disclosed to third parties unless required by legal obligation or when necessary to provide the requested service. Technology providers supplying services to BODEGAS EL PIMPI may access data when acting as data processors, subject to the corresponding contract under Article 28 of the GDPR.

Storage period:

Operational reservation data will be kept for the time necessary to manage and finalize the service. When an economic relationship, invoice, payment voucher, or other documentation with accounting or tax relevance arises from the reservation, such documentation will be retained for the corresponding statutory periods.

Data concerning allergies, intolerances, or health provided exclusively to service a specific reservation will be deleted once no longer necessary for that purpose, unless a legal obligation justifies its retention.

II. PERSONNEL SELECTION PROCESSES

When a person submits their candidacy to participate in recruitment processes at BODEGAS EL PIMPI, including submission via laboral@elpimpi.com or through any other enabled channel, their data will be processed to:

Receive and manage their candidacy.
Analyze their education, experience, and professional profile.
Evaluate their suitability for available positions.
Manage interviews and selection tests.
Maintain necessary communications during the process.

Data processed:

First name and surname.
Contact details.
Academic history.
Professional experience.
Curriculum vitae (CV).
Information provided during interviews or evaluation processes.
Any other relevant professional details to evaluate the candidacy.

Special categories of data that are unnecessary for the process must not be provided.

Legal basis:

The processing necessary to manage a candidacy for a specific selection process is based on the application of pre-contractual measures at the request of the data subject. When BODEGAS EL PIMPI intends to retain a CV after the selection process ends to consider it for future recruitment, such retention will take place provided there is a legal basis legitimating it.

Recipients:

Data will not be disclosed to third parties outside BODEGAS EL PIMPI, except under legal obligation or the existence of a legal basis legitimating the communication.

Storage period:

Data will be retained while the selection process remains open. Once concluded, if a legal basis exists to retain the candidacy to evaluate participation in future processes, it may be kept for a maximum period of one year from the close of the process. Upon expiration of this period, the data will be deleted, without prejudice to any legally required blocking.

III. WI-FI CONNECTION

When a person uses the Internet access service through the Wi-Fi network provided by BODEGAS EL PIMPI, strictly necessary data may be processed to:

Manage the delivery of the service.
Authenticate or identify the user when necessary.
Maintain network security.
Prevent unlawful or unauthorized uses.
Manage technical incidents.
Comply with legal requirements issued by judicial authorities or Law Enforcement Agencies.

Data processed: Depending on the technical configuration of the service, the following may be processed:

Identifying or contact data when requested.
IP address.
Technical device identifiers.
Date and time of connection.
Technical information required to manage the session and ensure network security.

Legal basis:

The processing necessary to provide the requested service is based on the execution of the relationship arising from the user’s request to access the service.

Processing strictly necessary to ensure system security and prevent unlawful use may be based on the legitimate interest of BODEGAS EL PIMPI in protecting its systems, networks, and infrastructures, after balancing user rights and interests.

Where a legal obligation to retain or communicate data exists, processing will be grounded in compliance with said legal obligation.

Recipients:

Data may be communicated to judges and courts, Law Enforcement Agencies, and other public authorities when a legal obligation or valid requirement exists. Technology providers involved in rendering the service may access data when acting as data processors.

Storage period:

Data used exclusively for technical session management will be retained for the time necessary to deliver the service and resolve associated incidents. Technical or security logs will only be retained subsequently for the period necessary to fulfill the purpose justifying their generation and during statutory time limits when a specific retention obligation applies.

A general one-month period is not established for all connection data, as there is no single legal retention period applicable indiscriminately to every Wi-Fi service offered by an establishment.

IV. VIDEO SURVEILLANCE SYSTEMS

BODEGAS EL PIMPI facilities are equipped with video surveillance systems.

Purpose:

Images will be processed to:

Safeguard the security of individuals.
Protect facilities.
Protect goods and assets.
Prevent and, where applicable, provide evidence of incidents affecting security.

Data processed:

Images of individuals entering or staying within areas monitored by video surveillance.

Legal basis:

Processing is based on the public interest recognized by data protection legislation regarding the use of video surveillance systems to ensure the safety of people, assets, and facilities.

Recipients:

Images will only be disclosed when a legal basis permits and, specifically, may be made available to:

Judges and courts.
Law Enforcement Agencies.
Competent Public Administrations.

Storage period:

Images will be deleted within a maximum period of one month from their capture.

When images must be retained to prove the commission of acts against the integrity of people, assets, or facilities, they will be handed over to the competent authority within the legally established timeframe and retained solely for the period necessary for that purpose.

If a legally valid request for preservation is made while images remain available, necessary measures will be taken to prevent their deletion while retention remains necessary.

V. SUPPLIERS

When BODEGAS EL PIMPI receives proposals for the provision of services or supply of products, or maintains contractual relationships with suppliers, it may process personal data of sole traders, professionals, representatives, employees, and contact persons.

Purposes:

Data will be processed to:

Manage commercial proposals.
Manage procurement processes.
Formalize and execute contracts.
Maintain necessary professional communications.
Manage orders and supplies.
Manage billing, collections, and payments.
Manage incidents.
Comply with administrative, accounting, tax, and legal obligations.

Legal basis:

When data belongs to a sole trader or individual professional with whom a relationship exists, processing is based on the application of pre-contractual measures or the execution of the contract.

When professional data of representatives, employees, or contact persons of a supplier entity is processed, processing may be based on the legitimate interest of maintaining professional relations with the legal entity for which they render services, under the terms of data protection laws.

Processing resulting from tax, accounting, or administrative obligations is grounded in compliance with the corresponding legal obligations.

Recipients:

Data may be communicated to:

Public Administrations when legally required.
Tax Administration.
Financial institutions to manage collections and payments.
Judges and courts when appropriate.
Auditors, advisors, and other professionals when their intervention is necessary and sufficient legal coverage exists.

Suppliers accessing data on behalf of BODEGAS EL PIMPI will act as data processors when requirements set forth in Article 28 of the GDPR are met.

Storage period:

Data will be kept for the duration of the contractual or professional relationship. Upon its termination, the following retention limits apply:

Commercial and accounting records: Six years from the last entry made in the books.
Tax-related documentation: Generally four years under standard tax limitation periods, without prejudice to legal causes of interruption, restarting of calculations, or cases where a longer period applies.
Contracts and documentation linked to potential contractual liability: For the limitation period of actions that may arise from the corresponding legal relationship.

Once applicable periods expire, data will be destroyed unless another cause legitimates its retention.

VI. INTERNAL WHISTLEBLOWING CHANNEL

The Internal Information System of BODEGAS EL PIMPI is governed by its specific regulations and, in particular, by Law 2/2023 of February 20, regulating the protection of persons who report normative infringements and the fight against corruption, as well as personal data protection legislation.

Complete information regarding the functioning of the Internal Information System, management procedure, and data protection is available in the dedicated section: Internal Information System.

Purposes:

Personal data processed through the Internal Information System will be used to:

Receive and manage reports/communications.
Analyze the admissibility of reports received.
Investigate reported facts where appropriate.
Adopt corresponding measures.
Comply with obligations established under Law 2/2023.
Defend the rights and legitimate interests of BODEGAS EL PIMPI and affected individuals where appropriate.

The channel allows for the submission of anonymous communications.

Legal basis:

Personal data processing will be carried out under the legal bases specifically provided by Law 2/2023 and the GDPR.

Access to data:

Access to personal data contained in the Internal Information System is restricted solely to legally authorized persons and bodies.

Storage period:

Data subject to processing within the Internal Information System will be retained only for the time strictly essential to decide whether to initiate an investigation into the reported facts.

When it is established that the information provided, or part of it, is not truthful, it will be immediately deleted from the moment such circumstance is recorded, unless the lack of truthfulness may constitute a criminal offense, in which case the information may be kept for the time required to process the corresponding judicial proceedings.

In any case, three months after receipt of the communication without investigative actions being initiated, the data must be deleted from the Internal Information System, unless retention serves to evidence the operation of the system. Unprocessed communications may only be retained in anonymized form.

When investigative actions are initiated, necessary data may be retained outside the Internal Information System during the handling of the case and subsequently throughout the limitation periods for liabilities that may arise.

VII. OTHER PURPOSES

Personal data will not be used for purposes incompatible with those for which it was originally collected.

When BODEGAS EL PIMPI intends to carry out new processing requiring the consent of the data subject, such consent will be requested beforehand freely, specifically, informatively, unequivocally, and, where legally required, explicitly.

INTERNATIONAL DATA TRANSFERS

BODEGAS EL PIMPI will not carry out international transfers of personal data unless necessary due to the use of a provider or service, provided that the requirements set out in Articles 44 et seq. of the GDPR are met beforehand.

Where an international transfer occurs, there must be an adequacy decision by the European Commission or one of the guarantees, mechanisms, or exceptions legally recognized by the GDPR.

When Standard Contractual Clauses are required, those approved by the European Commission will be adopted and, where appropriate, the circumstances of the transfer and necessary supplementary measures will be evaluated.

RETENTION PERIODS

Personal data will be stored only for the time necessary to fulfill the purposes for which it was collected. Once the purpose is fulfilled, data will be erased and, where appropriate, blocked for the duration necessary to meet potential liabilities arising from processing.

Without prejudice to specific time limits indicated for each activity, the following criteria apply:

Reservations: Data necessary exclusively to manage a booking will be kept until its complete finalization. Where tax, accounting, or contractual documentation derives from the service, corresponding statutory retention and limitation periods apply.
Selection Processes: Data will be retained during the recruitment process. Where a legal basis exists to retain the candidacy for future processes, the period established by BODEGAS EL PIMPI is one year from the conclusion of the process. This limit constitutes a controller retention criterion rather than a general period imposed by law.
Wi-Fi: Data required strictly to provide connection will be retained for the duration of the service. Technical and security logs will be retained only for the period necessary to fulfill the purpose justifying their generation and, where a specific legal obligation applies, for the duration set by such law.
Video Surveillance: Images will be erased within a maximum period of one month from capture, unless retention is necessary to prove actions against the safety of people, goods, or facilities.
Suppliers: Data will be retained during the contractual relationship and subsequently:
- Six years for business books, correspondence, documentation, and vouchers subject to commercial retention duties.
- Four years, as a general rule, for tax liabilities and obligations subject to standard limitation periods.
- During corresponding limitation periods when contractual or other liabilities may arise.
Internal Whistleblowing Channel: Data within the Internal Information System will be retained only for the time essential to decide whether an investigation is warranted. If no investigation is launched, data will be erased after three months from receipt, unless anonymized to evidence system operation.

Data Blocking

When personal data erasure is due, it will be blocked in accordance with the LOPDGDD when necessary to address potential liabilities stemming from processing.

During blocking, technical and organizational measures will be adopted to prevent data processing—including its viewing—except to make it available to judges and courts, the Public Prosecutor, or competent Public Administrations (including data protection authorities) for enforcing potential liabilities. Upon expiration of the corresponding period, definitive destruction will take place.

PERSONAL DATA RIGHTS

Data subjects may exercise the rights recognized under data protection legislation:

Right of Access: The data subject has the right to obtain confirmation as to whether BODEGAS EL PIMPI is processing personal data concerning them and, if so, access such data and statutory processing information.
Right to Rectification: The right to request the rectification of inaccurate personal data and to have incomplete data completed.
Right to Erasure (“Right to be Forgotten”): The right to request the deletion of data when any of the circumstances provided in Article 17 of the GDPR occur. This right does not apply when retention is necessary for legally established reasons.
Right to Restriction of Processing: The right to request processing restriction when any of the cases set out in Article 18 of the GDPR apply.
Right to Data Portability: When requirements under Article 20 of the GDPR are met, the data subject has the right to receive personal data provided in a structured, commonly used, and machine-readable format and transmit it to another controller. Where technically feasible, direct transmission to the new controller may be requested.
Right to Object: The data subject may object, on grounds relating to their particular situation, to processing based on public interest or legitimate interest, under Article 21 of the GDPR. Where data is processed for direct marketing, objection may be made at any time.
Right not to be subject to Automated Individual Decision-Making: Where applicable, the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or similarly significantly affects the individual, except in legally permitted cases.
Withdrawal of Consent: Where processing is based on consent, it may be withdrawn at any time without affecting the lawfulness of processing carried out prior to its withdrawal.

EXERCISING YOUR RIGHTS

Data subjects may exercise their rights by contacting:

BODEGAS EL PIMPI, S.L.

Calle Granada, n.º 62

Postal Code 29015 Málaga, Spain

Email: lopd@elpimpi.com

Additionally, data subjects may directly contact the Data Protection Officer:

Entity: LEGAL ADVISORS IN COMPLIANCE
Contact Person: Ernest Abelló
Email: legal@universecompliance.com
Subject line: “EL PIMPI”

The request must contain sufficient information to identify the applicant and specify the right being exercised. Where reasonable doubts exist regarding the identity of the applicant, strictly necessary additional information may be requested to confirm identity.

Requests will be addressed within one month of receipt. This period may be extended by an additional two months if necessary, taking into account the complexity and number of requests. In such cases, the data subject will be informed of the extension and its reasons within the first month.

RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

If a data subject considers that the processing of their personal data does not comply with current regulations, they have the right to lodge a complaint with the Spanish Data Protection Agency:

AGENCIA ESPAÑOLA DE PROTECCIÓN DE DATOS (AEPD)

C/ Jorge Juan, 6

28001 Madrid, Spain

The right to lodge a complaint with the supervisory authority applies without prejudice to any other administrative or judicial remedy.

RESPONSIBILITY FOR INFORMATION PROVIDED

Any individual providing personal data to BODEGAS EL PIMPI must ensure the information is true, accurate, and up to date.

As a general rule, third-party personal data must not be provided unless sufficient legal authority exists to do so. When providing third-party data, the person submitting it will be responsible for ensuring the communication is lawful and that all legal obligations have been met.

Excessive or unnecessary personal data for the corresponding purpose must not be sent. In particular, special categories of personal data must not be provided unless necessary for the specific purpose, expressly requested, or supported by a legal basis and processing condition.

SECURITY MEASURES

BODEGAS EL PIMPI will implement appropriate technical and organizational measures to guarantee a level of security appropriate to the risk involved in data processing.

These measures are aimed at preserving confidentiality, integrity, and availability of personal data and, where appropriate, system resilience and the ability to restore data availability and access rapidly following an incident.

Access to personal data will be restricted strictly to authorized personnel who require it to perform their duties, all of whom are bound by a duty of confidentiality. BODEGAS EL PIMPI will review its security measures in light of evolving risks, processing activities, and systems used.

DATA PROTECTION OFFICER CONTACT

For any matters concerning the processing of personal data, the exercise of rights, or the application of this Privacy Policy, data subjects may directly contact:

LEGAL ADVISORS IN COMPLIANCE

Data Protection Officer for BODEGAS EL PIMPI, S.L.