Skip to content

Privacy policy

Last updated: 11 September 2026

At Aroma Catering we handle your personal data responsibly and transparently. This policy explains what personal data we process, why we do so, on what legal basis, how long we keep it and what rights you have, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD). Information about cookies is available in our cookie policy.

1. Data controller

  • Controller: GASTRONOMIA I OCI COSTA BRAVA SL (Aroma Catering)
  • Tax ID (CIF): B72446206
  • Registered office: C/ Castelló de la Plana, 12, 17220 Sant Feliu de Guíxols (Girona), Spain
  • Office: C/ Granada, 3, 17220 Sant Feliu de Guíxols (Girona), Spain
  • Email: info@aroma-catering.com
  • Phone: +34 972 323 610 · +34 658 534 054

If you have any questions about the protection of your data, please write to us at info@aroma-catering.com.

2. What data we process and why

2.1. Information and quote requests via the contact form

  • Data: full name, email address, phone number, event date, venue or town, approximate number of guests, type of event, the service format you are interested in and your message. We also record the date and time at which you accept this policy and an anonymised version of your IP address.
  • Purpose: to deal with your request, prepare a tailored proposal or quote and follow it up by email or phone. When you submit the form, we send you an email confirming that we have received it, with a summary of your request.
  • Legal basis: your consent, which you give by ticking the relevant box (Art. 6(1)(a) GDPR), and steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
  • Retention: if your request does not lead to a booking, we keep the data for 12 months from the date we receive it and then delete it. If it becomes a booking, the data become part of our client relationship (section 2.3).

Fields marked with an asterisk are mandatory: without that information we cannot deal with your request.

2.2. Enquiries by email or phone

  • Data: the information you give us when you contact us, such as your name, contact details and the content of your enquiry.
  • Purpose: to deal with and reply to your enquiry.
  • Legal basis: your consent, given when you contact us (Art. 6(1)(a) GDPR), and, if you ask us for a quote or information about a service, steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
  • Retention: for as long as necessary to deal with your enquiry and, if it does not lead to a booking, for a maximum of 12 months.

2.3. Clients: contractual relationship and invoicing

  • Data: identification and contact details, tax ID number, billing address, event details (date, venue, number of guests, menu and services booked), bank or payment details, and a record of quotes and invoices.
  • Purpose: to prepare, organise and deliver the service booked, manage the business relationship and handle invoicing, payments and accounting.
  • Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with our legal accounting and tax obligations (Art. 6(1)(c) GDPR).
  • Retention: for as long as the business relationship lasts and, afterwards, for the periods required by law: 6 years for commercial and accounting records (Article 30 of the Spanish Commercial Code) and 4 years for tax-related information (Article 66 of the Spanish General Tax Law), as well as for the limitation period of any claims arising from the contract.

If you tell us about food allergies or intolerances of people attending the event, we will use that information solely to adapt the menu and ensure food safety, and we will keep it only for as long as necessary to deliver the service. As this is health data, we ask you, wherever possible, to provide it without identifying the people concerned (for example, by indicating only the table) and, if that is not possible, to obtain their consent beforehand; the legal basis is the explicit consent of the data subjects (Art. 9(2)(a) GDPR).

2.4. Social media

Aroma Catering has profiles on Instagram (@aromacatering.girona) and Facebook (AromaCateringGirona). If you follow us or interact with us there (comments, messages or mentions), we will process the public information on your profile and whatever you send us, solely to reply to you and to manage our presence on those networks. The legal basis is your consent (Art. 6(1)(a) GDPR), and we keep the data for as long as you keep interacting with our profile or until you ask us to delete it.

These platforms belong to Meta Platforms Ireland Limited, which processes your data in accordance with its own privacy policy; for page insights (statistics), Meta and Aroma Catering are joint controllers, under the terms of Meta’s Page Insights Controller Addendum, which sets out the essence of that arrangement. Our website does not include any social media plug-ins: the links to Instagram and Facebook are ordinary links and do not send any data to those platforms until you click them.

2.5. Client reviews

On the website we reproduce, translated where necessary, some reviews that our clients have published on Google, with the author’s name as it appears there and, where applicable, their profile photo and the images accompanying the review. We do so to show the real experience of other clients, on the basis of our legitimate interest (Art. 6(1)(f) GDPR), and the photographs are published with permission. If you wrote one of these reviews and would like us to remove it from the website, email us at info@aroma-catering.com and we will do so.

2.6. Website security

To protect the contact form against automated submissions and abuse, we use your IP address temporarily (for a maximum of 10 minutes) to limit the number of submissions, and only an anonymised version is stored with your request. In addition, the server hosting the website automatically logs technical connection data (IP address, date and time, page requested and browser) to keep the website secure and working properly. The legal basis is our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR), and this data is kept only for as long as necessary for that purpose.

3. Who we share your data with

We do not sell or pass on your data to third parties. We only disclose it where there is a legal obligation to do so (for example, to the Spanish Tax Agency or to the courts) or where it is necessary to deliver the service booked (for example, to the bank that processes a payment).

GoDaddy, which provides our website hosting and email service, has access to the data as a processor, solely in order to provide its services to us. Providing those services may involve transfers of data outside the European Economic Area; where that is the case, the transfers are made with the safeguards required by Chapter V of the GDPR, in particular the standard contractual clauses approved by the European Commission, which form part of our data processing agreement. You can request a copy of the safeguards in place by writing to info@aroma-catering.com.

Google only receives your data if you choose to load the map on our Contact page: when you do so, your browser connects to Google’s servers, which receive your IP address and may set cookies. Google acts as an independent controller for this processing, in accordance with its privacy policy, in which it states that it participates in the EU–US Data Privacy Framework. If you do not load the map, no data is sent to Google.

4. Automated decision-making

We do not make automated decisions or create profiles based on your data.

5. Your rights

You may exercise the following rights at any time:

  • Access: find out whether we process data about you and obtain a copy of it.
  • Rectification: have inaccurate data corrected or incomplete data completed.
  • Erasure: ask us to delete your data, for example when it is no longer needed for the purpose for which it was collected.
  • Restriction of processing: ask us to suspend the processing in certain cases, for example while we check the accuracy of the data.
  • Portability: receive the data you have provided to us in a structured, commonly used format, or ask us to transmit it to another controller.
  • Objection: object, on grounds relating to your particular situation, to processing based on our legitimate interest.
  • Withdrawal of consent: withdraw any consent you have given us at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise them, email us at info@aroma-catering.com or write to our registered office, stating which right you wish to exercise and enclosing a copy of your identity document or other proof of identity. We will reply within one month, which may be extended by two further months if the request is complex; if so, we will let you know.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the supervisory authority of the EU Member State where you live. If you prefer, write to us first and we will try to resolve the matter.

6. Children

This website is not intended for children under 14. If you are under 14, please do not send us any personal data: your parents or legal guardians must do so on your behalf. If we find that we have received data from a child under 14 without such authorisation, we will delete it.

7. Accuracy of your data

You confirm that the data you provide is true and up to date, and you agree to tell us about any changes. If you provide data about other people (for example, your partner or a colleague), you must first have informed them of this policy and obtained their consent.

8. Security

We apply appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access: the website uses an encrypted connection (HTTPS), form requests are stored in a private area of the website’s content management system that only authorised staff can access, IP addresses are stored in anonymised form, and the form has safeguards against automated submissions.

9. Changes to this policy

We may update this policy to reflect changes in the law or new processing activities. The current version will always be published on this page with the date of the last update, and if the changes are significant we will inform you by appropriate means.