1. Purpose and scope of application
This Data Protection Policy aims to inform the users of the website https://www.restauranteellago.com (hereinafter, the “Website”) about how ELVIRIA HILLS, S.L., with registered address at Urb. Elviria Hills - Avda. Las Cumbres, s/n, Postal Code 29604, Marbella (Málaga), and Tax ID (CIF) B-29.756.814, processes the personal data that may be collected through the Website, as well as the rights granted to users under the applicable personal data protection legislation.
This policy applies to all processing of personal data carried out through the Website, including but not limited to contact forms, newsletter subscriptions, user registrations, online purchases, and any other data collection mechanisms enabled on the Website.

2. Data controller
The data controller for the personal data collected through the Website is ELVIRIA HILLS, S.L. For any matters related to data protection, users can contact the controller via email at restaurante@restauranteellago.com, or by sending a written communication to the company’s registered office.

3. Purpose of data processing
The personal data provided by users through the Website will be processed for the following purposes:

• To manage requests for information, inquiries or complaints submitted via the Website forms.
• To manage user registration and access to private areas, where applicable.
• To process orders, purchases, or services requested via the Website.
• To send commercial, promotional, or informational communications, provided the user has given their express consent.
• To manage subscription to newsletters or similar informational bulletins.
• To comply with applicable legal and contractual obligations of the company.
• To improve the user experience and Website functionality, including browsing analysis and the use of cookies, in accordance with the specific cookies policy.

In all cases, the data will be processed lawfully, fairly, transparently, and for specified, explicit, and legitimate purposes. It will not be processed further in a way that is incompatible with those purposes.

4. Lawful basis for processing
The lawful bases for processing users' personal data are:

• The express consent given by the user by checking the corresponding box in the data collection forms and accepting this privacy policy.
• The execution of a contract to which the user is a party or the application of pre-contractual measures at the user's request.
• Compliance with legal obligations applicable to the company.
• The company’s legitimate interest, where applicable, in improving the Website and customer service, provided this does not override the user’s fundamental rights and freedoms.

Users may withdraw their consent at any time without affecting the lawfulness of the processing based on consent prior to withdrawal.

5. Data recipients and international transfers
Users’ personal data will not be shared with third parties, except when required by law, a court order, or when necessary to provide the services requested by the user, in which case the user will be duly informed.
If certain services require data processing by third-party service providers (e.g., technology providers, hosting, logistics, etc.), the company will enter into data processing agreements with these providers, ensuring they comply with data protection laws.
No international data transfers outside the European Economic Area (EEA) are planned unless expressly communicated to the user and adequate safeguards are implemented in accordance with applicable regulations.

6. Users’ rights
Users have the right to:

• Access their personal data and confirm whether or not it is being processed.
• Request rectification of inaccurate or incomplete data.
• Request the erasure of their data when, among other reasons, it is no longer needed for the purposes it was collected.
• Request restriction of processing under certain circumstances.
• Object to the processing of their data for reasons related to their particular situation.
• Request data portability where technically feasible.
• Not be subject to automated decision-making, including profiling, except as permitted by law.

To exercise these rights, users may contact the data controller via the contact methods provided in this policy. Users also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if they believe their rights have been infringed.

7. Data retention
Personal data will be retained for as long as necessary to fulfill the purpose for which it was collected and, where appropriate, for the periods required by applicable laws to handle potential liabilities arising from the processing. After these periods, the data will be securely deleted.

8. Security measures
The company has implemented appropriate technical and organizational measures to ensure the security and integrity of personal data and to prevent unauthorized access, alteration, loss, or processing, in accordance with the state of the art, the nature of the stored data, and the risks to which it may be exposed.

9. Confidentiality
All staff of the company, as well as any third parties who may access personal data in the course of providing services, are bound by a duty of confidentiality and professional secrecy. This obligation remains in effect even after the termination of any contractual relationship.

10. Use of cookies and similar technologies
The Website uses cookies and similar technologies to enhance user experience, analyze browsing activity, and deliver personalized content. Users can refer to the company’s Cookies Policy for detailed information on the types of cookies used, their purpose, and how to manage or disable them. The use of cookies requires the user's express consent, except for those strictly necessary for the operation of the Website.

11. Changes to the Data Protection Policy
The company reserves the right to modify this Data Protection Policy at any time in accordance with legislative or judicial developments, or industry practices. In case of substantial modifications, the updated policy will be published on the Website and, where necessary, user consent will be requested as required by applicable regulations.