Privacy Policy

Last updated: 8 October 2026.

In this policy we explain what personal data we process when you use our website, for what purposes, on what legal basis, how long we keep it, who we share it with and how to exercise your rights. We apply Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (Spanish Personal Data Protection and Digital Rights Act, LOPDGDD).

1. Data controller

• Controller: TABANCO EL PASAJE, S.L.U. — CIF (Tax ID) B11880978
• Address: C/ Santa María, 8, 11402 Jerez de la Frontera (Cádiz)
• Telephone: 956 33 33 59
• Email for privacy matters: tabancoelpasaje@jerez.es

We have not appointed a data protection officer because our activity does not require one.

2. What data we process and why

2.1. Online shop orders

Data: first name and surname, email address, telephone number, delivery address (if you request delivery), the products purchased and their amount, the payment method, any note you leave on the order, your confirmation that you are over 18 and the date on which you accepted the terms and conditions. If you request an invoice: name or company name, NIF/CIF (tax identification number) and billing address. We never see or store your card details: payment is made on the bank's secure payment gateway (Redsys) or with Bizum.

Purpose: to prepare and deliver your order, take payment for it, send you the order emails (confirmation, dispatch, collection, refunds), handle returns and guarantee claims, and issue the invoice if you request one.

Legal basis: the performance of the sales contract (Art. 6.1.b GDPR) and compliance with legal accounting and tax obligations (Art. 6.1.c GDPR).

Retention period: for the duration of the business relationship and, thereafter, for the time required by law: 6 years for accounting records (Article 30 of the Código de Comercio (Spanish Commercial Code)) and 4 years for information relevant for tax purposes (Ley General Tributaria (Spanish General Tax Act)).

2.2. Bookings

Table and show bookings and the purchase of gift vouchers are made through CoverManager, whose form appears on our website. CoverManager processes your data (name, telephone number, email address, date, time and number of people) on behalf of Tabanco El Pasaje in order to manage the booking.

Legal basis: the performance of the contract or of pre-contractual measures taken at your request (Art. 6.1.b GDPR).

Retention period: as long as necessary to manage the booking and, thereafter, for the limitation periods of any possible liabilities.

2.3. Contact form and group requests

Data: name, email address, telephone number and your message; for group requests, also the date, the show time and the number of people.

Purpose: to answer your enquiry or to prepare the quotation and the booking for the group.

Legal basis: your consent when you submit the form (Art. 6.1.a GDPR) and, for group requests, the pre-contractual measures you request (Art. 6.1.b GDPR).

Retention period: the time necessary to deal with your request and, at most, 24 months from the day we receive your message; after that it is deleted automatically.

2.4. Website security

To prevent abuse (automated submissions, fraudulent orders), we store, together with each order or message, an encrypted fingerprint of the IP address (not the IP address itself) and the browser type.

Legal basis: our legitimate interest in protecting the website and its users (Art. 6.1.f GDPR).

Retention period: the same as for the order or message it accompanies.

2.5. Analytics (only if you accept it)

If you accept analytics cookies, we use Google Analytics and Microsoft Clarity to find out how the website is used (pages visited, clicks, device, approximate location) and to improve it. Microsoft Clarity may anonymously record movements and clicks on the page; by default, it masks what is typed into forms.

Legal basis: your consent (Art. 6.1.a GDPR), which you may withdraw at any time using the cookie icon (“Cookie preferences”) in the bottom left-hand corner. Further information in the Cookie Policy.

Retention period: Google Analytics keeps user- and event-level data for at most 14 months. Microsoft Clarity keeps session recordings for 30 days and aggregated data (heatmaps and statistics) for up to 13 months. The lifetime of each cookie is given in the Cookie policy.

3. Mandatory data and minors

The fields marked as mandatory are necessary to process your order, booking or enquiry; without them we cannot do so. The sale of alcoholic beverages is restricted to persons over 18, so we do not sell to minors, nor do we knowingly process data of children under 14.

4. Who we share your data with

We do not sell your data to anyone. We only disclose it when necessary:

• To the carrier we use to ship your order (name, address and telephone number).
• To our bank, which processes card or Bizum payments through Redsys.
• To the tax authorities and other public bodies when required by law.

In addition, the following providers process data on our behalf (data processors), under a contract and solely in order to provide their service to us:

• Vercel Inc. — website hosting.
• Supabase — database for orders and messages, with servers in the European Union (Frankfurt, Germany).
• Resend — sending of order emails and notifications.
• Redsys Servicios de Procesamiento, S.L. — card and Bizum payment gateway.
• CoverManager — management of bookings and gift vouchers.
• Google Ireland Ltd. — Google Analytics, Google Tag Manager and the Google Maps map.
• Microsoft Ireland Operations Ltd. — Microsoft Clarity.
• MapaSEO — website development and maintenance.

5. International transfers

Some of these providers (Vercel, Supabase, Resend, Google and Microsoft) are United States companies or belong to US groups, and may therefore access data from outside the European Economic Area. In such cases, the transfer is covered by the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023), where the company has signed up to it, or by the standard contractual clauses approved by the European Commission.

6. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent you have given us (without affecting the processing carried out before its withdrawal). Write to us at tabancoelpasaje@jerez.es or by post to the address given in section 1, stating which right you are exercising. We will reply within one month. If we have reasonable doubts about your identity, we may ask you to prove it.

If you consider that we have not dealt with your request properly, you may lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) (www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid).

7. Security

We apply technical and organisational measures to protect your data: encrypted connection (HTTPS), access to the management panel restricted to authorised staff with a username and password, a log of changes and daily backups.

8. Changes to this policy

If we change this policy, we will publish the new version on this page with its date of update.