Skip to content
+34 680 78 73 26info@marialluch.comC/ Villalobos 145, 28018 Madrid

Privacy policy

This English version is provided for convenience only. In the event of any discrepancy, the Spanish version prevails.

At María Lluch Catering we take your privacy seriously. This policy explains what personal data we collect through https://marialluch.com, what we use it for, how long we keep it and what rights you have.

Data controller

  • Controller: María Lluch Catering S.L.
  • Tax ID (CIF): B22768162
  • Registered office: C/ Arturo Soria 286, 28043 Madrid
  • Production and customer service centre: C/ Villalobos 145, 28018 Madrid
  • Email: info@marialluch.com
  • Phone: +34 680 78 73 26

We process your data in accordance with Reglamento (UE) 2016/679 (RGPD, the EU General Data Protection Regulation, GDPR) and Ley Orgánica 3/2018, de 5 de diciembre (LOPDGDD, Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights). If you have any question about your personal data, write to us at info@marialluch.com. The rest of the owner’s details are in the Legal Notice.

What data we collect and what we use it for

Quote, “We’ll call you” and dossier forms

To prepare your quote, we ask you to fill in the form. We collect:

  • Contact details: name, email address and phone number (optional).
  • Company details (if applicable): company name, job title, how often the service is needed and company tax ID (CIF) for the invoice (optional).
  • Event details: whether it is for a company or a private client, type of service, date, number of guests, venue (district or municipality), approximate budget and whatever you tell us in the detail fields.
  • Guests’ allergies or diets (optional, with its own consent box): see the next section.
  • How you heard about us (optional).
  • Your consent boxes: your acceptance of this policy and, if you tick it, the newsletter box.
  • Technical submission data: the page from which you submit the form, the first page of your visit, the campaign parameters of the link you arrived through (utm_source, utm_medium, utm_campaign, utm_term and utm_content), if any, and the format chosen in the price calculator, so that we know which content brings us enquiries.

If you ask us to call you, we collect your name, your phone number and the time slot you prefer. If you ask us for the company dossier, we collect your name, your company’s name and your email address. In both cases you can also tick the newsletter box.

The fields marked as required are necessary to respond to your request: if you do not fill them in, we will not be able to prepare your quote. The rest are optional.

Purpose: to assess your request, prepare and send you the quote, call you or send you the dossier if you ask us to, contact you and, if you accept it, take the steps needed to contract the service. To manage it, we keep your contact details (name, email, whether it is for a company or private, language and the form you used) in our contact management tool. We do not send you marketing communications as a result: you will only receive the newsletter if you expressly tick its box.

Legal basis: processing necessary to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) and, for general enquiries, the consent you give by sending us the form (Article 6(1)(a) GDPR).

Guests’ allergies and diets (health data)

Allergies, intolerances or diets for health reasons are special categories of personal data. We only process them if you choose to provide them, and solely to take them into account when preparing the proposal and menu for your event. We do not use them for any other purpose.

So that we process as little data as possible, we ask you not to include names: it is enough to say how many people have each allergy or diet (for example, “two people with coeliac disease and one vegan”).

Legal basis: your explicit consent (Article 9(2)(a) GDPR), which you give by ticking the relevant box on the form. You can withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Retention: we keep this data only to prepare and serve the event and we delete it, at the latest, 30 days after it takes place. If the quote is not accepted, we delete it at the latest 3 months after your request.

Newsletter (optional)

If you tick the newsletter box (in the sign-up form or, optionally, in any of our other forms), we will use your email address to send you ideas for planning your events and news from María Lluch Catering. The box is never ticked in advance.

So that we can demonstrate your consent, we keep your email, your name if you give it, whether you are interested as a company or as a private client, your language, the date you subscribed and the version of the text you accepted.

Legal basis: your consent (Article 6(1)(a) GDPR and Article 21 of Ley 34/2002 de Servicios de la Sociedad de la Información y de Comercio Electrónico, LSSI-CE, Spanish Law 34/2002 on Information Society Services and Electronic Commerce). You can unsubscribe at any time using the link in every message or by writing to info@marialluch.com.

Contracting and invoicing

If you hire our services, we process the data needed to provide and invoice them and to meet our tax and accounting obligations. Legal basis: performance of the contract and compliance with legal obligations (Article 6(1)(b) and (c) GDPR).

Contact by email or phone

If you write to info@marialluch.com or call us, we will use your data to reply. Legal basis: your consent or steps taken at your request prior to entering into a contract, as the case may be.

Who we share your data with

We do not sell your data or disclose it to third parties for their own purposes. Only the following providers (processors) access it, on our behalf and to provide their service to us:

Provider Service Location
Netlify, Inc. Website hosting, and receipt and storage of form submissions United States
Resend, Inc. Sending emails related to your request, managing the contact details from requests, and sending the newsletter to subscribers United States
Google Workspace (Google) Email for info@marialluch.com Several countries, including the United States

In addition, our tax adviser, the invoicing and management software we use and other technology providers for the website may process some data on our behalf.

Netlify, Resend and Google process data outside the European Economic Area, in the United States. International transfers are covered by the safeguards provided for in the GDPR: the provider’s certification under the EU-U.S. Data Privacy Framework or, failing that, the standard contractual clauses approved by the European Commission. You can ask us for more information or a copy of these safeguards by writing to info@marialluch.com.

We may also disclose data to public authorities and the courts where required by law, and to our tax and accounting advisers to meet our legal obligations.

How long we keep your data

  • Quote requests that do not lead to a booking: at most 24 months from your last contact, so that we can help you if you resume your enquiry. If you want us to delete them sooner, write to us at info@marialluch.com.
  • Health data (allergies and diets): at most 30 days after the event or, if you do not book it, 3 months from your request.
  • Clients: for as long as the relationship lasts and, afterwards, for the applicable legal periods (generally up to 6 years for commercial and accounting records, and 4 years for tax purposes).
  • Newsletter: until you unsubscribe or withdraw your consent.

Once that period has passed, we erase the data or keep it blocked for as long as any liability may arise, and then destroy it securely.

Your rights

You can exercise the following rights at any time:

  • Access: find out what data of yours we process.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: ask us to delete your data when it is no longer necessary.
  • Restriction: ask us to restrict processing in certain cases.
  • Objection: object to processing based on our legitimate interest.
  • Portability: receive your data in a structured format.
  • Withdrawal of consent: where processing is based on consent, without retroactive effect.

To exercise them, write to info@marialluch.com stating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for a copy of an identity document. We will reply within one month at most.

If you believe we have not handled your data properly, you have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD, Spanish Data Protection Agency): www.aepd.es.

Automated decisions

We do not use your data for automated decision-making or profiling.

Security

We apply appropriate technical and organisational measures to protect your data against loss, unauthorised access, alteration or misuse, including encrypted connections (HTTPS), filters against automated submissions on the form and access limited to the people who need it.

Cookies

The site does not use analytics or advertising cookies: only necessary technical storage. More details in the Cookie Policy.

Changes to this policy

We may update this policy to adapt it to legal changes or to the way we work. The date of the last update appears at the top of this page: 24 October 2026.