Privacy policy

1. Data controller

The controller is [Legal name], tax ID [Tax ID], registered at [address], Valencia (Spain). For privacy matters you can write to privacidad@wearetavola.com.

2. Data we process

Depending on how you use Tavola, we may process:

• Identity and contact data: name, email and profile details.
• Professional verification documents: the payslip, contract or work-life certificate you upload to prove you work in hospitality.
• Usage data: offers redeemed, history and last visit.
• Location: only at the moment of redemption, to confirm you are at the venue.
• Payment data: handled by our payment provider (Stripe). We do not store your full card details.

3. Purposes and legal bases

We process your data to:

• Provide the service and manage your membership (performance of the contract).
• Verify your status as a hospitality professional (performance of the contract and legitimate interest in keeping a verified community).
• Handle payments and meet tax and accounting obligations (legal obligation).
• Confirm redemptions via location and send you the newsletter or marketing communications (consent).
• Ensure security and prevent fraud (legitimate interest).

4. Verification documents

The documents you upload for verification are stored encrypted, with restricted and logged (audited) access, and kept for the minimum time needed to confirm your eligibility. You can request their deletion in line with your rights.

5. Retention

We keep your data while you are a member and, after you leave, for the applicable legal periods (for example, tax obligations). We then delete or anonymise it.

6. Recipients

We do not sell your data. We may share it with providers who deliver services to us (payments, email delivery, hosting), always under contract and in the EU where possible. Partner venues only receive aggregate figures, never data that identifies you. We may also disclose data to authorities where legally required.

7. International transfers

Our data resides in the European Union. If any provider processes data outside the EEA, we will do so with appropriate safeguards (for example, the European Commission’s standard contractual clauses).

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time, as well as withdraw your consent. Write to us at privacidad@wearetavola.com. If you believe we have not handled your request, you can complain to the Spanish Data Protection Agency (www.aepd.es).

9. Location

We only use your location at the moment of redemption, to confirm you are at the venue. You can disable location permissions on your device, but you will not be able to redeem offers in that case.

10. Cookies

This site uses only the cookies necessary for it to work and, if you accept them, measurement cookies. You can manage them from your browser settings.

11. Minors

Tavola is aimed at professionals of legal age. We do not knowingly process minors’ data.

12. Security

We apply reasonable technical and organisational measures to protect your data, including encryption of sensitive documentation and access control.

13. Changes to this policy

We may update this policy. We will publish the current version on this page with its update date.

14. Contact

For any privacy question or to exercise your rights, write to us at privacidad@wearetavola.com.