1. Data controller
In compliance with the General Data Protection Regulation, Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights, and all other applicable regulations, users are informed that the controller of the personal data collected through this website is:
Controller: Associació Cuina Pirinenca de Cerdanya
Tax ID number: G55308845
Address: CR Nacional 152, 17520 Puigcerdà, Girona
Contact email address: cuinapirinenca@gmail.com
2. Personal data processed
Through this website, the personal data voluntarily provided by the user via the contact form, email or other available channels may be processed.
The data processed may include:
- First name and surname.
- Email address.
- Telephone number, where applicable.
- Information freely included by the user in the message.
- Technical data associated with browsing, under the terms indicated in the Cookie Policy.
The user must refrain from sending specially protected data or information that is unnecessary for managing their request, such as data relating to health, ideology, religion, racial or ethnic origin, trade union membership, sex life, sexual orientation, biometric data or data relating to criminal offences.
3. Purposes of processing
Personal data will be processed for the following purposes:
a) Responding to enquiries and requests for information
The data provided via the contact form or email will be processed in order to respond to enquiries, requests for information, collaboration proposals or any other communication sent by the user.
b) Managing the relationship with interested persons, entities or restaurants
When the communication is related to the Association’s activities, collaborations, participation in initiatives or information about associated restaurants, the data may be processed in order to manage that relationship.
c) Ensuring the operation and security of the website
Minimum technical data necessary to maintain website security, prevent abuse, detect technical incidents and ensure the proper functioning of digital services may be processed.
d) Complying with legal obligations
Where necessary, data may be processed in order to comply with legal obligations applicable to the Association.
4. Legal basis for processing
The legal bases that legitimise the processing are:
- Consent of the data subject, when the user voluntarily sends an enquiry via the contact form or other available channels.
- Legitimate interest of the Association, to maintain website security, prevent fraudulent use and respond to communications linked to its activity.
- Compliance with legal obligations, when processing is necessary to respond to regulatory or administrative requirements.
The user may withdraw their consent at any time, without affecting the lawfulness of processing carried out previously.
5. Data retention
Personal data will be retained for the time necessary to respond to the enquiry, manage the relationship with the user or fulfil the purpose for which it was collected.
As a general rule:
- Enquiries received through the contact form or by email will be retained for the time necessary to manage them and, where applicable, for the relevant statutory limitation periods.
- Technical security data will be retained for the time strictly necessary to ensure the operation and security of the website.
- When the user requests the deletion of their data, such data will be blocked for any applicable legal periods and subsequently erased.
6. Recipients of the data
As a general rule, personal data will not be disclosed to third parties, except where necessary to comply with a legal obligation or where the user has expressly authorised it.
However, certain providers that supply services to the Association may have access to the data, such as web hosting, technical maintenance, email or IT support services. These providers will process the data as processors and only in accordance with the Association’s instructions.
7. International data transfers
The Association does not intend to carry out international data transfers outside the European Economic Area.
However, if technological services provided by suppliers located outside the European Economic Area, or which may involve international access to the data, are used, the Association will adopt the appropriate safeguards provided for by data protection regulations.
This section should be reviewed if the website incorporates third-party tools such as Google Analytics, Google Maps, YouTube, reCAPTCHA, Meta Pixel, advertising pixels, marketing tools or similar services.
8. Rights of data subjects
The user may exercise the following rights:
- Right of access: to know what personal data the Association processes.
- Right to rectification: to request the correction of inaccurate or incomplete data.
- Right to erasure: to request deletion of data when it is no longer necessary.
- Right to object: to object to the processing of data in certain circumstances.
- Right to restriction of processing: to request that the use of data be restricted.
- Right to data portability: to receive the data in a structured format, where applicable.
- Right to withdraw consent: to withdraw the consent granted at any time.
To exercise these rights, the user may send a request to:
The request must clearly indicate which right the user wishes to exercise and must be accompanied, if necessary, by a document that allows the identity of the applicant to be verified.
9. Complaint before the supervisory authority
If the user considers that the processing of their personal data does not comply with applicable regulations, they may lodge a complaint with the Spanish Data Protection Agency.
10. Accuracy of the data
The user guarantees that the data provided is true, accurate, complete and up to date. The user shall be responsible for any damage or loss that may arise from the communication of false, inaccurate or incomplete data.
11. Minors
This website is not specifically aimed at minors. If a minor provides personal data through the contact form, it will be understood that they do so with the authorisation of their parents, guardians or legal representatives, where such authorisation is required.
12. Security measures
The Association will apply appropriate technical and organisational measures to protect personal data and prevent its destruction, loss, alteration, unauthorised access or unlawful processing.
13. Changes to the privacy policy
The Association reserves the right to modify this Privacy Policy in order to adapt it to legislative, technical or organisational changes. In the event of relevant changes, users will be duly informed through the website.
Last updated: 24/05/2026