1. Who we are
The controller of your personal data is A Lota – Restaurante-Cervejaria, Lda. (VAT PT500002975), Rua do Jardim do Regedor, 15, 1150-193 Lisboa, Portugal. Contact: lotarestaurante@sapo.pt, +351 21 342 3355.
2. What data we process and why
- Reservation requests: name, email, phone, date, time, party size, occasion and notes you write (which may include allergies). Purpose: manage your booking. Legal basis: performance of a contract / steps prior to a contract (art. 6(1)(b) GDPR). Health-related notes are processed only because you provide them, on the basis of your explicit consent (art. 9(2)(a)).
- Contact form: name, email, subject and message. Purpose: reply to you. Legal basis: legitimate interest in answering enquiries (art. 6(1)(f)).
- Newsletter: email and language. Purpose: send occasional news. Legal basis: consent (art. 6(1)(a)), which you can withdraw at any time via the link in each email.
- Technical data: IP address, browser and access logs, kept by our hosting provider for security. Legal basis: legitimate interest in keeping the site secure (art. 6(1)(f)).
- Analytics cookies: only with your consent. See the cookie policy.
3. Retention
- Reservation and contact records: up to 24 months after the last interaction, then deleted or anonymised.
- Newsletter: until you unsubscribe.
- Server logs: 30 days.
- Invoicing data, where applicable: 10 years (Portuguese tax law).
4. Who receives your data
We use the following processors, under data-processing agreements and, where outside the EEA, Standard Contractual Clauses:
- Google Cloud (Google Ireland Ltd.): website hosting (EU region).
- Twenty CRM (auto-alojado na nossa infra-estrutura): reservation and contact management.
- Brevo (Sendinblue SAS, França): transactional email and newsletter delivery.
- Google Analytics / Tag Manager: usage statistics, only with consent.
- Google Maps: location map, only when you load it.
- TheFork (La Fourchette SAS): bookings made via TheFork, governed by TheFork's policy.
We never sell your data.
5. Your rights
You may access, rectify, erase, restrict or object to the processing of your data, ask for portability, and withdraw consent at any time, by writing to lotarestaurante@sapo.pt. We reply within one month. You may also lodge a complaint with the Portuguese supervisory authority, CNPD.
6. Security
The site is served over HTTPS, hosted in the EU, and access to reservation data is restricted to staff who need it. Forms are protected against automated abuse.
7. Minors
The site is not aimed at children under 16; we do not knowingly collect their data.
8. Changes
We may update this policy. The date at the top of the page shows the current version.