Privacy Policy | pantrybrightbaskt.com

1. Who we are and who is responsible for your data

The data controller is Brightbaskt Editorial Media S.L. ("we", "us", "our"), a company incorporated in Spain under Company Number B-67482915, with its registered office at Carrer de Pallars 193, 4-2, 08005 Barcelona, Spain. We operate the website pantrybrightbaskt.com, an independent editorial publication covering signature hotels in Spain.

We have appointed a Data Protection Officer who can be contacted at [email protected] or by post at the registered address above, marked "For the attention of the Data Protection Officer". If you prefer, you may use the form on our contact page and select "Data protection request (GDPR)".

We are not a travel agency, tour operator or reservation intermediary. We do not process bookings, take payment card details or hold reservation records. Any booking you make happens on a hotel's own website under that hotel's privacy policy, not ours.

2. What personal data we collect

2.1 Data you give us voluntarily

Contact form submissions: your name, email address, the reason for contact, the hotel concerned (if any), your subject line and the content of your message.
Correspondence: the contents of emails you send to our published addresses, together with any attachments and metadata contained in them.
Press, licensing and advertising enquiries: your name, organisation, role, business contact details and the commercial details you choose to share.

2.2 Data collected automatically

Server log data: your IP address (truncated where technically feasible), the date and time of your request, the pages requested, HTTP status codes, referring URL, user-agent string and approximate country-level location derived from the IP address.
Cookie and local storage identifiers: a consent record stored in your browser's local storage, plus any analytics identifiers you have specifically consented to. See our Cookie Policy for the complete inventory.
Aggregated interaction data: if you consent to analytics, anonymised or pseudonymised data about page views, scroll depth, outbound link clicks and device class.

2.3 Data we do not collect

We do not collect payment card data, passport or identity document data, health data, biometric data, data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation. We do not knowingly collect data from children under sixteen. We do not purchase personal data from third-party brokers, and we do not operate a newsletter or mailing list that requires an email database.

3. Why we process your data and on what legal basis

Purposes and legal bases for processing
Purpose	Data used	Legal basis (UK/EU GDPR)
Replying to your enquiry or correction	Name, email, message content	Consent (Art. 6(1)(a)) and legitimate interests (Art. 6(1)(f))
Operating, securing and debugging the website	Server logs, essential cookies	Legitimate interests (Art. 6(1)(f))
Preventing abuse, spam and fraud	IP address, request patterns	Legitimate interests (Art. 6(1)(f))
Measuring audience and improving content	Analytics identifiers, page events	Consent (Art. 6(1)(a))
Remembering your interface preferences	Functional cookies / local storage	Consent (Art. 6(1)(a))
Complying with legal and accounting obligations	Correspondence, commercial records	Legal obligation (Art. 6(1)(c))
Establishing, exercising or defending legal claims	Relevant records	Legitimate interests (Art. 6(1)(f))

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing already carried out. Where we rely on legitimate interests, we have carried out a balancing assessment and you have the right to object as described in section 7.

4. Cookies, tracking and advertising

On first visit we display a consent banner offering "Accept All", "Reject Non-Essential" and granular "Preferences". Nothing beyond strictly necessary storage is set before you make a choice. Your decision is recorded in your browser's local storage under the keys cookieConsent, cookieConsentChoice, cookieConsentDate and cookieConsentDetail, so that the banner does not reappear on subsequent visits. You can change or withdraw your choice at any time using the "Cookie preferences" link in the footer of every page.

We do not operate cross-site behavioural advertising, we do not build advertising profiles, and we do not sell or share personal information for cross-context behavioural advertising as those terms are defined under the California Consumer Privacy Act as amended. Any display advertising served on this site is contextual and based on the content of the page rather than on your browsing history. A full, categorised inventory of cookies and storage items is published in our Cookie Policy.

5. Third-party processors and recipients

We keep our supplier chain deliberately short. The categories of third parties that may process personal data on our behalf are:

Web hosting and content delivery — an EU-based hosting provider operating data centres within the European Economic Area, processing server logs and delivering static assets.
Transactional email delivery — an EU-based mail processor used solely to deliver and store contact form submissions and our replies.
Privacy-focused web analytics — only where you have consented to analytics cookies. Our chosen provider stores data within the EEA and does not use it for advertising purposes.
Image hosting and content delivery — photographic assets are delivered by third-party image CDNs, which receive your IP address and user-agent as a technical necessity of serving the image.
Mapping — the contact page embeds a third-party map frame. Loading it transmits your IP address to the map provider. Where you have declined functional cookies, the frame is loaded only on explicit interaction.
Professional advisers — accountants, auditors and legal counsel, bound by professional confidentiality obligations.

Each processor is engaged under a written contract meeting the requirements of Article 28 GDPR. We do not transfer personal data outside the European Economic Area unless an adequacy decision applies or appropriate safeguards — normally the European Commission's Standard Contractual Clauses together with a transfer impact assessment — are in place. A current list of processors is available on request to the Data Protection Officer.

6. How long we keep your data

Retention periods
Record	Retention period	Rationale
Contact form submissions and email correspondence	24 months from last contact	Handling follow-up, corrections history
Server access logs	90 days, then deleted or fully anonymised	Security, abuse investigation
Consent records	12 months, or until you withdraw or clear browser storage	Demonstrating lawful consent
Analytics data (if consented)	14 months in aggregated form	Year-on-year content assessment
Commercial and accounting records	6 years	Spanish commercial and tax law
Records relating to a live legal claim	Until the claim is resolved plus limitation period	Legal defence

At the end of the applicable period, data is securely deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual.

7. Your rights under the GDPR

If you are in the European Economic Area or the United Kingdom, you have the following rights in relation to your personal data:

Right of access — to be told whether we process data about you and to receive a copy of it together with the supplementary information in Article 15.
Right to rectification — to have inaccurate data corrected and incomplete data completed.
Right to erasure — to have your data deleted where one of the grounds in Article 17 applies.
Right to restriction of processing — to have processing limited in the circumstances set out in Article 18.
Right to data portability — to receive data you provided to us in a structured, commonly used, machine-readable format.
Right to object — to object at any time to processing based on legitimate interests, and absolutely to processing for direct marketing purposes.
Right to withdraw consent — at any time, with future effect.
Right not to be subject to automated decision-making — we do not carry out automated decision-making or profiling that produces legal effects.

To exercise any right, contact [email protected]. We respond within one calendar month, extendable by two further months for complex requests, in which case we will tell you and explain why. We may ask for information to confirm your identity, but only what is strictly necessary. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

If you are unhappy with our response, you may lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es), or with the supervisory authority in your country of residence or place of the alleged infringement.

8. Rights for California and other US residents

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect, to request deletion or correction of it, to request a copy of it, and to opt out of any sale or sharing of it. As stated above, we do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes requiring an opt-out right. We do not discriminate against anyone for exercising a privacy right. Requests may be submitted to [email protected] and will be verified using the email address associated with your correspondence. Authorised agents may submit requests with written proof of authorisation. Residents of other US states with comparable legislation, including Virginia, Colorado and Connecticut, may use the same channel to exercise equivalent rights.

9. Security measures

We apply technical and organisational measures appropriate to the risk, including: TLS encryption for all traffic to and from this site; encryption at rest for stored correspondence; access control on a strict least-privilege and need-to-know basis; multi-factor authentication for all administrative accounts; regular patching of hosting and application dependencies; segregated staging and production environments; logging and monitoring of administrative access; annual review of processor arrangements; and a documented incident response procedure. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within seventy-two hours of becoming aware of it and will inform affected individuals without undue delay where the risk is high.

10. External links and embedded content

Our hotel pages link to the official websites of the hotels we review, and our articles link to third-party restaurants, institutions and information sources. These are independent websites with their own privacy practices, and we have no control over how they process your data. Following such a link is your decision, and we encourage you to read the privacy notice of any site you visit. Embedded content — images and map frames — may set its own cookies once loaded; the Cookie Policy explains how we restrict this pending your consent.

11. Changes to this policy

We review this policy at least annually and whenever we introduce a new processing activity or supplier. When we make material changes, we update the "Last updated" date at the top of this page and, where the change significantly affects your rights, display a notice on the site for a reasonable period. Previous versions are retained and are available on request.

12. How to reach us

Brightbaskt Editorial Media S.L.
Carrer de Pallars 193, 4-2, 08005 Barcelona, Spain
General: [email protected]
Data Protection Officer: [email protected]
Company No. B-67482915 · VAT ESB67482915

Submit a data request Read the Cookie Policy