Privacy policy

This is a translation of the Spanish original, provided for information only. In the event of any discrepancy, the Spanish version prevails.

• Who handles your data: Grupo Amida Restaurantes 2025, S.L.U., the company behind the restaurants BàrBar, La Bodeguilla, Periplo Portixol, Bar Nicolás, Nura and Room Service.
• What for: to manage your booking and your visit, charge you, comply with the law and, only if you allow it, send you news and measure our advertising.
• Who we share it with: the providers that help us deliver the service (such as CoverManager, which manages bookings) and, if you accept advertising cookies, Google, Meta and OpenAI. We do not sell your data.
• Your rights: you can ask to access, correct or delete your data, or object, by writing to legal@grupoamida.com.

The details of each point are below.

• Controller: Grupo Amida Restaurantes 2025, S.L.U.
• Tax ID (NIF): B75868265
• Address: C/ Gremi de Cirurgians i Barbers, 25, A.3.2, 07009 Palma (Balearic Islands), Spain
• Email for anything about your data: legal@grupoamida.com

We do not have a data protection officer, as we are not required to. Questions about your data are handled by our administration team at the same email address.

Grupo Amida Restaurantes 2025, S.L.U. belongs to a group of companies whose parent company is Balikan Family 2025, S.L.U. (Tax ID B75868257), together with Amida Events, S.L.U. (Tax ID B57145898). The staff of these two companies provide the restaurants with management, administration, accounting, IT and marketing services, and to do so may access your data as processors: on our behalf, only for those purposes, under a duty of confidentiality and under a data processing agreement signed between the group companies. They do not use your data for their own purposes.

When you book

Your first and last name, email, phone number, the date, time and party size, whether anyone at the table has allergies or intolerances (and which), your comments and whether you want to receive news. If you join the waiting list, also when the table would suit you. If the booking requires a guarantee, you enter your card on CoverManager's secure page: we never see the card number.

You can book on this website, through CoverManager's booking module, by phone or in person. If you book through another platform (for example, through Google), that platform passes on the details you gave it.

If you book for other people, make sure they are happy with it and tell them what this policy says.

When you visit

What you order and how you pay is recorded in our point-of-sale system (Ágora). The receipt does not carry your name; if you ask for a full invoice, it carries your tax details. If you pay by card, the card terminal sends it encrypted to the bank: we do not keep the card number.

In restaurants with security cameras, images of the signposted areas are kept for one month at most, unless they need to be kept as evidence of an incident (article 22 of the Spanish Data Protection Act, LOPDGDD).

When you write to us or call us

What you tell us and your contact details, so we can answer you.

When you browse the website

Technical data about your browser and your visit (IP address, device, pages, where you came from). Non-essential cookies are only used if you accept them; they are explained in the "Cookie policy".

When you receive our emails

Whether they reach you, whether you open them (each email carries an invisible image that tells us), which links you click and whether you book afterwards. We work out your country from your phone's dialling code.

When you book from an email

The link in the email opens the restaurant's booking page with your name, contact details and recent visits already filled in, so you only choose the day and time. That data travels encrypted inside the link, expires after 30 days and is not stored in your browser. You tick the boxes (allergies, news, charge) yourself.

Managing your booking

Creating it, confirming it, reminding you of it, changing or cancelling it, managing the waiting list and, if the booking requires it, the card guarantee and the charge for a no-show or late cancellation.

Basis: it is what you ask us for (performance of a contract or pre-contractual steps, art. 6.1.b GDPR).

Your allergies and intolerances

Only to prepare your food safely. This is health data: only the people who need it for the service see it, and we do not use it for anything else.

Basis: your explicit consent, which you give with the allergies tick box when booking on the website, or verbally if you book by phone (art. 9.2.a GDPR). You may choose not to give it, but then we cannot take them into account, and you can withdraw it at any time. If the allergies belong to someone else at the table, only tell us with their permission.

Charging and invoicing

Basis: complying with our tax and commercial obligations (art. 6.1.c GDPR).

Asking how it went

After your visit we may email you a link to a short Google survey so you can tell us how we looked after you. The survey contains no offers or advertising.

Basis: our legitimate interest in improving the service (art. 6.1.f GDPR). You can tell us you do not want more surveys from the survey itself or at legal@grupoamida.com.

Sending you news and recommendations from our restaurants

By email, and only if you say yes: with the box when booking on this website or with the button in the email we send you if you booked by phone, in person or on another platform. The news comes from all the Grupo Amida restaurants: BàrBar, La Bodeguilla, Periplo, Bar Nicolás and Nura.

So that we only send you what may interest you, we choose each email based on your bookings and visits (which restaurant, when and with how many people), your language and your phone's country. For example, if you are visiting Mallorca, that same evening or over the following days we recommend another of our restaurants, and we stop writing when you leave; if you live here, at most one email a month.

To learn what works, we test different versions of the same email, we do not send a given email to some people so we can compare, and a program chooses which restaurant to recommend based on what has worked best with other people. We measure whether you open the emails, click their links and book afterwards, including at another of our restaurants. We do not use artificial intelligence to write to you and we make no decision with legal or similarly significant effects on you.

Booking never depends on accepting them. You can unsubscribe from everything with one click in any email, or by writing to us, and you can also ask us not to personalise what we send you.

Basis: your consent (art. 6.1.a GDPR and art. 21 LSSI-CE).

Measuring the website and our advertising

With your consent in the cookie banner, we count visits and bookings that come from our ads on Google, Meta (Facebook and Instagram) and OpenAI (ChatGPT), to learn what works and who to show our ads to. Details are under "Advertising and measurement".

Basis: your consent (art. 6.1.a GDPR and art. 22.2 LSSI-CE).

Counting where bookings come from

With each booking made on this website we record, and pass on to CoverManager, whether you came from an ad (Google, Meta, OpenAI or another) or from one of our emails. We take it from the address you arrived through and keep only the platform's name, with no identifier, to count in total how many bookings each one brings. We store nothing in your browser for this.

Basis: our legitimate interest in knowing which advertising works (art. 6.1.f GDPR).

Website and venue security

Protecting the website against abuse and, in venues with cameras, people and premises.

Basis: our legitimate interest (art. 6.1.f GDPR) and, for cameras, art. 22 of the Spanish Data Protection Act (LOPDGDD).

Answering your questions and requests

Basis: your request (art. 6.1.b GDPR) and our legal obligation to handle your rights (art. 6.1.c GDPR).

We do not make automated decisions that have legal effects on you or similarly significant effects.

Only if you accept analytics or advertising cookies in the banner. You can change your mind at any time under "Cookie settings" in the website footer.

• Analytics (Google Analytics 4): counts visits, pages and booking steps (without your name, email or phone). When a booking is confirmed, we also record it from our server with your browser's identifier, so that bookings confirmed later are not lost. Google keeps this data for 14 months.
• Google Ads advertising: when you book, Google receives the conversion with a booking number and, to attribute it to an ad, your email and phone number scrambled with an irreversible hash (SHA-256) before they leave your browser ("enhanced conversions"). With advertising cookies, Google also builds lists of website visitors so we can show them our ads.
• Meta (Facebook and Instagram): its pixel records visits and bookings and, when a booking is confirmed, we also send it from our server (Conversions API) with your IP address, your browser, its cookies (_fbp, _fbc) and, to match it with whoever saw the ad, your email, phone number, first and last name, encrypted with an irreversible hash (SHA-256). This is how we measure and improve our campaigns.
• OpenAI (ChatGPT): its pixel records bookings that come from our ads on ChatGPT and, when a booking is confirmed, we also send it from our server with your IP address, your browser, its cookies (__obref, __oppref) and, to match it with whoever saw the ad, your email, phone number, first and last name, encrypted with an irreversible hash (SHA-256). Bar Nicolás does not use it.

We do not upload customer lists to any advertising platform.

If you do not accept, Google Analytics and Google Ads may receive cookieless pings without identifiers (Google's "consent mode"), which are only used to estimate overall figures. Meta and OpenAI receive nothing.

With Google and Meta we are joint controllers for collecting this data through their tag or pixel on our website; what they then do with it for their advertising services is their sole responsibility. Meta governs this in its Controller Addendum and Google in its Controller-Controller Data Protection Terms. For enhanced conversions, Google processes the hashed email and phone number on our behalf, as a processor. OpenAI Ireland Limited acts as an independent controller under its Conversion Terms.

You can read their policies at policies.google.com/privacy, facebook.com/privacy/policy and openai.com/policies/privacy-policy.

With the providers we need to serve you. They handle your data on our behalf (processors), under a contract that stops them using it for anything else:

• CoverManager (Restaurant Booking & Distribution Services, S.L., Spain): bookings, the waiting list, the card guarantee, booking notifications, surveys and your opt-in to news.
• Ágora (Spain): the restaurants' point-of-sale system.
• Banca March, Banco Sabadell and Revolut: the card terminals. For their own payment and fraud-prevention obligations they act as independent controllers.
• Google (Google Workspace): the email we use to answer you.
• Vercel (USA): hosting for this website and for the server that handles bookings.
• Wistia, Inc. (USA): serves the website's videos; it receives your browser's IP address when they load. It sets no cookies.
• Resend (Plus Five Five, Inc., USA): sends our news emails and tells us whether they are delivered, opened or clicked.
• Anthropic, PBC (USA): Claude, the artificial intelligence tool our team uses to look up and manage bookings and to reply to your messages. It does not train its models on your data and never makes decisions about you on its own.
• Sanity (Sanity AS, Norway, and its delivery network): stores and serves the website's texts and images; it receives your IP address when images load.
• Google Cloud (server in Madrid, EU): the tagging server that measurement goes through, if you accept it.
• Our internal management dashboard, hosted on Render (Render Services, Inc., servers in Frankfurt, EU), which reads bookings from CoverManager for the restaurants' operations and statistics and chooses which news to send you.
• Balikan Family 2025, S.L.U. and Amida Events, S.L.U., companies in our group: the restaurants' management, administration, accounting, IT and marketing.

And, only if you accept the relevant cookies, Google, Meta and OpenAI, as explained above.

We will also disclose your data to public authorities, courts or law enforcement when the law requires it. We never sell your data.

Some providers (Google, Meta, OpenAI, Vercel, Wistia, Resend, Anthropic, Render and Cloudflare, the latter for OpenAI's pixel) are based in the United States or may process data there. They do so with the safeguards required by the GDPR: the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for participating companies and, otherwise, the European Commission's standard contractual clauses. Wherever possible, we choose servers in the EU.

• Bookings: up to 24 months after the booking date, to look after you if you come back and to handle any claim.
• Allergies and intolerances: up to 30 days after your visit, in case anything comes up; after that we delete it from the booking.
• Receipts and invoices: six years, as required by the Spanish Commercial Code (art. 30), and whatever tax law requires.
• News: until you unsubscribe. If in 24 months you neither visit nor open any of our emails, we stop writing to you and delete or anonymise your mailing data. We keep proof of your yes and of your unsubscribe for three years, in case of any claim. After you unsubscribe, we keep only your email on a suppression list so we never write to you again.
• Analytics: 14 months in Google Analytics.
• Camera footage: one month at most, unless it is needed as evidence of an offence.
• Enquiries: as long as needed to answer you and, afterwards, the period for any claim.

After that, we delete the data or make it anonymous.

You can ask us at any time for:

• Access: to know whether we handle your data and which.
• Rectification: to correct anything that is wrong.
• Erasure: to delete it.
• Objection: to stop using it (for example, for surveys or to personalise the news).
• Restriction: to keep it without using it while something is resolved.
• Portability: to receive it in a format you can take elsewhere.
• Withdrawal of consent (news, cookies, allergies), without affecting what was done before.

Write to us at legal@grupoamida.com or by post to the address above, telling us what you are asking for. If we cannot tell it is you, we will ask you to prove your identity. We answer within one month at most (two more months if the request is complex, and we will let you know).

If you ask us to delete your data, we also delete it in CoverManager and in Resend, except your email on the suppression list, so we never write to you again.

If you think we have not handled your rights properly, you can complain to the Spanish Data Protection Agency: aepd.es.

You must be at least 14 to book. If we learn that we have received data from a child under 14 without their parents' or guardians' permission, we delete it.

We protect your data with appropriate technical and organisational measures: encrypted connections, personal accounts with two-factor authentication where possible, least-privilege access and backups. If a security breach put your data at risk, we would report it to the Spanish Data Protection Agency within 72 hours and, if the risk is high, to you as well.

If we change how we handle your data, we will update this page and its date. If the change is significant, we will let you know.