Skip to content

Privacy policy

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD):

Controller

FLAMA NAPOLITANA S.L. · Tax ID B22800676 · Carrer de la Conquista 80, 08912 Badalona, Spain · flamanapolitana@gmail.com · +34 698 933 444.

What data we process

  • Reservations and orders: name, phone, email, date and time, number of guests or products, and any notes you give us (for example, allergies).
  • Loyalty programme: name, email, date of birth, language, points and points history.
  • Technical data: IP address and browser data, only to protect the forms against spam and abuse.

Purposes and legal basis

  • Reservations and orders: managing and confirming them and telling you about any change (performance of a contract).
  • Loyalty programme: managing points, rewards and the birthday gift, and sending you the programme's emails (consent, given when you sign up). If you place an order or make a reservation on the website with the same email as your member account, we link it to your account to add your point automatically.
  • Marketing communications: only if you have accepted them (consent, which you can withdraw at any time).
  • Feedback request after your visit: if you are not a loyalty member, after a reservation or order we may send you one email asking for your opinion, at most once every two months (legitimate interest, art. 21.2 LSSICE). You can object at any time by writing to us; every such email reminds you how.
  • Replies to Google reviews: we use the public name and text of reviews posted on our Google profile to reply to them. Replies are drafted with the help of an artificial intelligence tool (legitimate interest).
  • Security: protecting the website and forms against spam, fraud and unauthorised access (legitimate interest).

Retention

Reservation and order data is kept for 6 years for tax and accounting obligations, then deleted. Loyalty programme data is kept until you leave the programme. The record of feedback emails sent is kept as long as needed to avoid sending them again.

Recipients and providers

We do not share data with third parties except where required by law. We work with these technology providers, which process data only to provide their service to us, under data processing agreements:

  • Netlify (website hosting) — United States.
  • Supabase (database) — servers in Ireland (EU).
  • Resend (reservation, order and points emails) — United States.
  • Brevo (newsletter and programme announcements) — France (EU).
  • Cloudflare (anti-spam check on forms) — United States.
  • Anthropic (assisted drafting of review replies) — United States.
  • Google (Google Business Profile and map) — United States.

Transfers to the United States rely on the safeguards provided by the GDPR: the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to flamanapolitana@gmail.com. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Security measures

We apply reasonable technical and organisational measures: encryption in transit (HTTPS), restricted administrative access protected with two-step verification, and backups.