Privacy policy

Controller

Tatiana González Ferreira

Tax ID (NIF)

44450501B

Registered office

Rúa Juan de Austria, 7, 32005 Ourense

Trading name and premises

Tixola Tapería · Rúa Juan de Austria, 7, 32005 Ourense

Telephone

646 45 72 74

Email

gonzalezferreiratatiana@gmail.com

We are not required to appoint a Data Protection Officer (Art. 37 GDPR and Art. 34 of the Spanish Data Protection Act, LOPDGDD). For any question about your data, write to us at gonzalezferreiratatiana@gmail.com.

All the data comes directly from you. We do not buy data or obtain it from third parties.

Enquiries by phone or WhatsApp

Whatever you choose to tell us when you call or message us: usually your name and your phone number. The website has no forms at all: the call and WhatsApp links open your own app, so no data passes through our servers. We do not take bookings, so we keep no lists of names, dates or times either.

Virtual waiter

The text of your questions and the replies during the session, the language and the page you write from. We do not ask for personal data to use it, and we recommend that you do not include any.

Browsing

Technical data generated by any visit (IP address, browser type, pages requested), processed by our hosting provider for security purposes; the language you choose (NEXT_LOCALE cookie) and your cookie decision (tixola_consent local storage).

Allergies and intolerances

If you tell us about them by phone, on WhatsApp or in person at the bar, we use them solely to prepare your dish safely. This is special-category data (Art. 9 GDPR) that we process with your explicit consent, given when you provide it, and that we neither write down nor keep once you have been served. If you type them into the virtual waiter, that text travels with the rest of your message to Anthropic (USA), under the safeguards in section 6; we do not store it on our servers and it disappears from your browser when you press “New conversation” or close the tab. That is why the chat itself asks you not to type health data: it is not needed to help you with the menu.

We do not make automated decisions with legal effects on you, nor do we create profiles. We do not send marketing communications.

The virtual waiter is an assistant that answers questions about the menu, allergens, opening hours and how to find us. To generate each reply, your messages are sent via our server to Anthropic PBC, the provider of the Claude language model, which acts as a data processor.

• We do not store the conversation on our servers: it is processed on the fly to generate a reply, and there is no chat database. We only count requests per IP address for ten minutes, in memory, to prevent abuse.
• In your browser, the conversation is kept in session storage (sessionStorage) so that it is not lost when you change page; it disappears when you close the tab, and you can delete it at any time using the button in the chat itself.
• Anthropic is headquartered in the United States. The transfer is covered by appropriate safeguards: standard contractual clauses approved by the European Commission and, where applicable, the provider's certification under the EU-US Data Privacy Framework, in accordance with its current documentation. Under its commercial terms, Anthropic does not use content submitted via the API to train its models and, according to its current documentation, deletes inputs and outputs from its systems within 30 days, unless it must keep them longer by law or because its systems detect a use that breaches its policies (in which case, up to 2 years).
• If the provider cannot be reached, a local engine answers using the menu and opening hours, without anything leaving our own servers.
• Replies are generated automatically and may contain errors. For allergies and intolerances, always confirm with our staff on the premises.
• Do not type personal data, yours or anyone else's (names, phone numbers, health data), into the chat: we do not need it to help you.

We do not sell or share your data. The first two on this list are data processors: they handle data on our behalf, following our instructions and under a contract compliant with Art. 28 GDPR. The last three are not: they are third parties that receive data because their content loads on the site or because you click their link, and each of them acts on its own behalf and under its own privacy policy.

Vercel Inc. (USA)

Hosting and delivery of the website and, if you accept, visit measurement (Vercel Web Analytics). Processes the technical data of each visit (IP address, headers) and the security logs. Certified under the EU-US Data Privacy Framework and bound by standard contractual clauses. Vercel privacy policy (opens in a new tab).

Anthropic PBC (USA)

Generation of the virtual waiter's replies (see section 4). Anthropic privacy policy (opens in a new tab).

Google LLC / Google Ireland Ltd.

Google Maps map embedded in the “Find us” section. It only loads if you accept cookies (or if you load it yourself from the “Map” tab in that section); at that point Google receives your IP address and may set its own cookies. The links to Google Maps and to Google reviews open Google websites. Google privacy policy (opens in a new tab).

Meta Platforms Ireland Ltd. (WhatsApp)

If you choose to message us on WhatsApp, the communication takes place in that app and is governed by its terms and privacy policy. We only receive the message you decide to send.

TripAdvisor LLC

Links to our listing and reviews. They open a third-party website with its own privacy policy; we do not share data with TripAdvisor.

Put plainly: Vercel and Anthropic are our responsibility, and you can ask us for a copy of the safeguards in section 6 for either of them. Google, Meta and TripAdvisor are not: we simply tell you when they come into play so that you can avoid it — the map does not load unless you accept it, and the links only open if you click them.

We may also disclose data to the competent authorities where required by law.

Vercel and Anthropic may process data in the United States. In both cases appropriate safeguards exist under Chapter V of the GDPR: standard contractual clauses approved by the European Commission and, where the provider is certified, the EU-US Data Privacy Framework. You can request a copy of the applicable safeguards by writing to gonzalezferreiratatiana@gmail.com.

You may exercise, at any time and free of charge, the rights the GDPR grants you:

• Access: to know what data of yours we process.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to ask us to delete your data when it is no longer necessary.
• Objection and restriction of processing.
• Portability: to receive your data in a structured, commonly used format.
• Withdrawal of consent at any time, without affecting the lawfulness of prior processing (for example, by changing your cookie decision).

To exercise them, write to us at gonzalezferreiratatiana@gmail.com or by post to Tatiana González Ferreira, Rúa Juan de Austria, 7, 32005 Ourense, stating which right you wish to exercise and enclosing a document proving your identity (or an equivalent means). We will reply within one month at the latest.

If you believe we have not handled your rights properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, or via its online portal at www.aepd.es (opens in a new tab). If you prefer, you can contact us first so that we can resolve it.

The website is not aimed at children under 14, and we do not knowingly collect data from minors. If we detect data from a minor without the authorisation of their parents or guardians, we will delete it.

We apply the principle of data minimisation: the website has no forms, no user accounts and no customer database. All communication is encrypted (HTTPS), the providers involved offer appropriate contractual and technical guarantees, and access to the messages we receive is restricted to the restaurant's staff.

We may update this policy to reflect legal changes or changes to the service (for example, if we add an analytics tool). The version in force is always the one published on this page, with its last-updated date (October 18, 2026). See also the Legal notice and the Cookie policy.