1. Who is responsible for your data
The controller of the personal data collected through this website is:
- Owner
- Joan Guasch
- Trade name
- Debizet
- Tax ID (NIF)
- 47407263P
- Address
- Carrer des Riu 23
- joan@debizet.es
- Phone
- +34 663 168 043
- Website
- debizet.es
For any question about your data, write to joan@debizet.es. Debizet has not appointed a Data Protection Officer because it is not legally required to do so.
2. What data we process, why, and on what legal basis
We only ask for the data we need. Fields marked as required are necessary to answer your enquiry or complete your purchase; without them we cannot do so. We do not send newsletters, build profiles, make automated decisions about you or sell your data.
Enquiries and proposal requests
When you write to us through the enquiry form or the step-by-step request on the home page, we receive your name and email and, if you provide them, your phone number, date, venue, format, type of event, number of guests and message.
- Purpose: to reply to your enquiry and prepare a proposal.
- Legal basis: taking steps at your request before entering into a contract (art. 6.1.b GDPR).
- Retention: for as long as needed to handle your enquiry. If no contract follows, we delete it no later than 12 months after our last contact.
Clients who book a private performance
- Data: contact details, event details and, where applicable, billing details.
- Purpose: to organise and deliver the performance, issue invoices and handle payments.
- Legal basis: performance of the contract (art. 6.1.b GDPR) and compliance with tax and accounting obligations (art. 6.1.c GDPR).
- Retention: for the duration of the contract and, afterwards, for the periods required by law (up to 6 years for accounting records, under article 30 of the Spanish Commercial Code).
Ticket purchases
When you buy tickets we record your full name, email, phone number (optional), the number of tickets, your menu choices and notes, the order reference, the amount, the payment status, the transaction identifiers provided by Stripe, your language and the IP address the order was placed from. We never receive or store your card details: you enter them on Stripe’s secure page.
- Purpose: to process your purchase and send your ticket; to check you in on the day; to let you know about changes, postponements or cancellations; to handle refunds and incidents; to meet our accounting and tax obligations; and to prevent fraudulent or automated purchases.
- Legal basis: performance of the contract (art. 6.1.b GDPR); compliance with legal obligations (art. 6.1.c GDPR); and, for the IP address, our legitimate interest in protecting the ticketing system against fraud and abuse (art. 6.1.f GDPR).
- Retention: order data are kept for the legally required periods (up to 6 years). The IP address is deleted automatically 30 days after the order.
Allergies, intolerances and other notes
If you tell us about allergies or intolerances in the notes field when buying, you are providing data concerning your health, which the GDPR treats as a special category of data.
- Purpose: to adapt the menu and inform the kitchen team.
- Legal basis: your explicit consent (art. 9.2.a GDPR), which you give by ticking the corresponding box. You can withdraw it at any time by writing to us; this does not affect prior processing, but we may then be unable to adapt your menu.
- Recipients: only the kitchen team or partner restaurant serving the dinner, and only what they need to prepare it.
- Retention: notes are deleted automatically 30 days after the event date.
Messages by WhatsApp, Instagram or email
If you contact us through WhatsApp or Instagram, the conversation takes place on services owned by Meta Platforms, which process your data under their own privacy policies. We only use what you send us to reply, based on the steps you request before a contract (art. 6.1.b GDPR) or our legitimate interest in answering enquiries (art. 6.1.f GDPR), and keep it for as long as needed for that purpose.
Photos and video at events
At some events we take photos or video of the atmosphere and the performance to show our work on this website and on social media, based on our legitimate interest in promoting our activity (art. 6.1.f GDPR). We favour wide shots in which guests cannot be identified. If you appear recognisably in any image and would rather it was not published, write to us and we will remove it.
3. Who we share your data with
We do not share your data with third parties except where required by law (for example, the tax authorities, courts or law enforcement). The following service providers process data on our behalf under a data processing agreement, and only for the service they provide:
- Raiola Networks, S.L. (Spain): hosting of the website, database and email.
- Accounting or tax advisers, where applicable, to meet our tax obligations.
In addition:
- Stripe Payments Europe, Limited (Ireland) processes payments. Stripe handles your payment details and carries out fraud prevention as an independent controller, under its privacy policy.
- The kitchen team or partner restaurant of each event receives the guest list with menu choices and, where applicable, the allergies you have told us about, only to prepare the service.
4. International transfers
Our hosting and email are located in the European Union. Stripe may transfer data to Stripe, Inc. in the United States and other companies in its group; these transfers are covered by the European Commission’s adequacy decision for the EU-US Data Privacy Framework and by standard contractual clauses. If you choose to contact us through WhatsApp or Instagram, Meta may also transfer your data outside the EU.
The fonts and all other resources of this website are served from our own server: browsing debizet.es does not send your IP address to Google or any other third party. Links to Google Maps, Instagram or WhatsApp only connect to those services if you click on them.
5. Your rights
You can at any time:
- access your data and find out how we use it;
- rectify data that are inaccurate or incomplete;
- erase your data when they are no longer needed (except where we must keep them by law);
- object to processing based on our legitimate interest;
- restrict processing in the cases provided by law;
- receive your data in a portable format (portability);
- withdraw your consent, where processing is based on it.
To exercise these rights, write to joan@debizet.es with the subject “Data protection”, stating which right you wish to exercise and giving enough information to identify you (for example, your order reference). If we have reasonable doubts about your identity, we may ask for further information. We will reply within one month, which may be extended by two further months for complex requests.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
6. Minors
Tickets must be bought by adults. We do not knowingly process data of children under 14 without the consent of their parents or guardians.
7. Security
We apply technical and organisational measures appropriate to the risk: encrypted connection (HTTPS), card details that never pass through our servers, access to the administration panel restricted to authorised staff and protected by password, and deletion of data once they are no longer needed.
8. Changes to this policy
We may update this policy when we change how we process data or when the law changes. The date of the latest version is shown at the top of this page.