Privacy policy

1. Who handles your data

The restaurant where you book is the controller of your data. If you arrive from its booking form, its contact details appear at the top of this page.

Mibu is the tool the restaurant uses: it processes your data on the restaurant’s behalf and is only responsible for the security, maintenance and abuse prevention of the platform.

2. What data we use

Your name, phone, email and language, and the booking details: date, time, party size, area, table and status.

Anything you choose to add, such as special requests. Allergies or intolerances are health data and are only stored if you provide them. An accessible table is a preference: we do not ask why.

Basic technical data, such as your IP address and browser, to protect the service.

3. What we use it for

To manage your booking: confirm it, allow changes or cancellations and send you notices about it.

Allergies are only used to prepare your visit, never for advertising or profiling.

To protect the service against fraud, bots and unauthorised access.

4. Legal basis

The booking is based on your relationship with the restaurant; commercial communications, on your consent; and security, on the legitimate interest in protecting the service.

Allergies are based on your explicit consent (Article 9(2)(a) GDPR), given with the tick box on the website, a “yes” on the phone or by authorising the restaurant staff. It is optional: you can book without them.

5. Withdrawing your consent

You can withdraw it at any time by asking the restaurant, which will delete the allergy from your booking. What was done before remains valid.

You can also ask the restaurant to stop sending you commercial communications.

6. Who receives your data

The restaurant, to serve you.

The providers we need to operate: Hostinger (server and email), Telnyx (calls, SMS and voice assistant), WhatsApp (only if you choose that channel) and Cloudflare (bot protection, if enabled).

Mibu does not sell diners’ data.

7. Data outside the European Union

The data is hosted on a Hostinger server in the United Kingdom, a country with an adequacy decision from the European Commission.

Telnyx (USA) handles calls, SMS and the voice assistant on its own infrastructure, and Cloudflare (USA) protects the form when enabled. Both apply EU standard contractual clauses.

You can ask the restaurant for more information about these safeguards.

8. How long we keep it

Allergies are kept until the restaurant removes them from the booking or deletes your data.

The rest of the booking history stays with the restaurant until it is deleted or anonymised. Requests that do not become a booking are anonymised after a while.

We keep a record that you gave your consent (when and how), without the content of the allergy. Backups and messages already sent follow their own periods.

9. Your rights

You can ask to access, correct or delete your data, restrict its use, object, or take it to another service.

For your booking, contact the restaurant. For what Mibu handles directly: mibu@gastroonic.com.

If you are not satisfied, you can complain to the supervisory authority; in Spain, the Spanish Data Protection Agency (www.aepd.es).

10. Security

Mibu protects data with access controls, separation between restaurants and security logs.