Privacy Policy

1. Data controller

In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), users are informed that the personal data provided through this website will be processed by:

Data controller: Custodios y Gentiles de Palacio.S.L.
Trade name: Grupo OLEILÚ
Tax ID (CIF): B-26956540
Registered office: Plaza Pozo Santo, 2, 41003, Seville, Spain.
Contact email: hola@grupoleilu.com
Website: www.grupoleilu.com

No Data Protection Officer has been appointed, as this is not mandatory under current legislation.

2. Purposes of processing

Personal data collected through the website will be processed for the following purposes:

Contact form: to handle enquiries, requests for information, quote requests or any other communication made by the user.
User registration (where applicable): to manage the creation and maintenance of user accounts and provide access to restricted services or features.
Newsletter and commercial communications: to send information about news, events, promotions, commercial campaigns, prize draws, openings, gastronomic activities and news related to Grupo OLEILÚ and its venues.
Management of commercial relationships: to maintain the relationship with customers, users and potential customers, including the management of bookings, services and customer care at any of the group’s venues.
Website analysis and improvement: to analyse browsing behaviour using analytics tools in order to improve the user experience and optimise the website.
Advertising and digital marketing: to carry out marketing actions and personalised advertising through advertising platforms and tracking tools authorised by the user.
Birthday promotions: to use the birthday provided by the user to send greetings, special promotions or commercial benefits associated with that date.
Information on allergies and intolerances: when users make a booking at any of the Grupo OLEILÚ venues, they may voluntarily provide information about allergies, intolerances or other food-related conditions. This information will be processed solely to ensure the service is provided correctly and to look after the guest properly during their visit. Only staff who need it to provide the service will have access to it.

3. Categories of data processed

Depending on the service used, the following categories of data may be processed:

First name and surname.
Email address.
Telephone number.
Province of residence.
Date of birth.
IP address.
Browsing data and website usage preferences.
Information voluntarily provided by the user in forms or communications.
Information voluntarily provided in booking forms, including, where applicable, data relating to allergies, intolerances or other food-related conditions.

Users guarantee that the data provided are true, accurate and up to date, and undertake to report any changes to them.

4. Legal bases for processing

The legal basis for processing personal data is:

Consent of the data subject: for sending newsletters, commercial communications and promotions, managing birthday promotions and using non-technical cookies.
Performance of pre-contractual or contractual measures: when users request information, make enquiries, make bookings or use website features linked to the provision of services.
Legitimate interest of the controller: to guarantee website security, prevent fraud, improve the services offered and analyse how the website works, provided that the rights and freedoms of the data subject do not prevail.
Compliance with legal obligations: where a legal obligation requires certain data to be processed.
When users voluntarily provide information about allergies, intolerances or other food-related conditions through a booking form, the processing of such data will be based on the explicit consent of the data subject, in accordance with Article 9.2.a of the GDPR, as these are data that may reveal information about their health.

Each form will clearly state the specific purpose and the applicable legal basis.

5. Data retention periods

Personal data will be kept for as long as necessary to fulfil the purpose for which they were collected. In particular:

Contact data: while the relationship continues or until the user requests their deletion.
Data for commercial communications: until consent is withdrawn.
Data linked to bookings, services or contractual relationships: for the periods necessary to address any liabilities arising from the provision of the service.
Information on allergies, intolerances or food-related conditions will be kept for the same period as the rest of the booking data and will not be used for purposes other than the proper provision of the service.
Data related to legal obligations: for the periods required by applicable legislation.

Once these periods have ended, the data may remain blocked for the legally established limitation periods before being permanently deleted.

6. Recipients and data processors

Data may be processed by providers offering services necessary for the operation of the website and the activity of Grupo OLEILÚ, acting as data processors, including:

Web hosting company.
Web maintenance and development services.
Email marketing platforms.
Web analytics services.
Technology providers.

The website currently uses or may use services such as Webempresa (web hosting), Brevo (email marketing), Google Analytics and Google Tag Manager (web analytics), which will process data in accordance with their respective privacy policies and the data processing agreements signed with Custodios y Gentiles de Palacio.S.L.

No data will be disclosed to third parties other than those indicated, except where required by law or with the user’s express consent.

7. International data transfers

Some technology providers used by the website may be located outside the European Economic Area or carry out international data transfers.

In such cases, these transfers will be made applying the appropriate safeguards provided for in the GDPR.

8. Users’ rights

Users may at any time exercise their rights of access, rectification, erasure, objection, restriction of processing, data portability, withdrawal of consent and not to be subject to automated decisions.

To exercise these rights, they may contact:

Email: hola@grupoleilu.com

Postal address: Custodios y Gentiles de Palacio.S.L., Plaza Pozo Santo, 2, 41003, Seville, Spain.

They may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

9. Information security

Custodios y Gentiles de Palacio.S.L. adopts the technical and organisational measures necessary to guarantee an appropriate level of security and protect personal data against loss, alteration, unauthorised access or improper processing.

10. Minors

The services offered through the website are not specifically aimed at minors. Where required by current legislation, authorisation from their legal representatives may be requested.

11. Cookie Policy

This website uses its own and third-party cookies. Detailed information about their use is available in our Cookie policy.

12. Changes to the Privacy Policy

Custodios y Gentiles de Palacio.S.L. may amend this Privacy Policy to adapt it to new legislation, case law or changes in its activity.

The version in force will always be the one published on this website.

13. Contact

For any matter related to the protection of personal data, users may contact:

Custodios y Gentiles de Palacio.S.L.

Email: hola@grupoleilu.com

Website: www.grupoleilu.com

Last updated: August 2026.