Privacy Policy

Last updated: 23 September 2026

1. Data controller

The controller of the personal data collected on this website is:

• Website: directoriocatering.com
• Contact email: local@gastroseo.com

2. Data we collect

We may collect the following personal data:

• Browsing data: IP address, browser type, pages visited, time spent and cookie data (see the Cookie Policy).
• Contact data: name, email and message when you contact us through forms or by email.
• Quote request data: name, email, phone, city, event type, date, number of guests, indicative budget and the message describing what you need.
• Review data: the name you sign with, the rating, the text of the review and the email you used to request the quote (that email is never published).
• Catering company listing and offer data: company name, city, website, email, phone, catering types, service description and, if you publish an offer, its text and expiry date.
• Billing data: name, email and subscription details of the paid plans. Card details are handled directly by Stripe: we neither see nor store them.
• Text typed into the search box: the sentence describing what you are looking for.
• Fingerprint of your IP address: a salted hash, used to limit how many submissions can be made per hour and to curb abuse of the forms and the search box. The IP address is never stored in the clear.

3. Purpose of the processing

Personal data is processed for the following purposes:

• Managing the directory of catering companies, their profiles and their offers.
• Passing your quote request on to the catering companies you choose (a maximum of five), so that they can reply to you directly.
• Writing to you after the event to ask how it went and, if you give us permission, publishing your review on the company's profile under the name you provide.
• Responding to enquiries and contact requests.
• Managing the purchase and invoicing of paid plans.
• Understanding what you ask for in the search box so we can show results that fit.
• Curbing abuse of the forms and the search box by limiting the number of submissions per hour.
• Sending commercial communications (only with prior consent).
• Keeping the site secure and working properly.
• Complying with legal obligations.

4. Legal basis for the processing

• Consent: for sending your quote request to the companies you choose, for publishing your review under the name you provide, and for sending commercial communications. You can withdraw it at any time by writing to us.
• Pre-contractual steps and performance of a contract: a quote request is the step before a possible contract between you and the catering company; this basis also covers company listings in the directory and the delivery of the contracted plans.
• Legitimate interest: for site security, the hourly submission limit and service improvement.
• Legal obligation: for compliance with applicable regulations.

5. Data recipients

Personal data may be shared with:

• The catering companies you choose: when you request a quote, your name, email, phone number and the description of the event are sent to a maximum of five companies in the directory — the ones you select in the form. They reply to you directly and decide on their own what to do with that data, so they are independent controllers of that processing. If you also send a review and we publish it, your name and your text appear on the company's public profile; your email never does.
• Hosting and storage: Netlify, Inc. (USA), which hosts the website, receives the forms (Netlify Forms) and stores the requests and the reviews (Netlify Blobs).
• Email delivery: Resend, Inc. (USA), which delivers the directory's emails — the request sent to each company, the confirmations, the notices and the email asking how the event went — and processes your name and email in order to do so.
• Payment providers: Stripe, Inc. (USA), for managing payments of the paid plans.
• Search interpretation: OpenRouter, Inc. (USA), which processes the text typed into the search box with models by Anthropic PBC (USA), only to understand what is being asked for.

Netlify, Resend and OpenRouter act as processors on our behalf; the catering companies and Stripe are independent controllers of what they do with the data they receive. Transfers outside the European Economic Area rely on the standard contractual clauses approved by the European Commission.

We do not use analytics tools: the site has no Google Analytics or equivalent installed.

Beyond the above, data will not be sold or transferred to third parties for commercial purposes without prior consent.

About the search box: if you describe your event in the site's search box, that text may be sent to an outside provider (OpenRouter, which processes it with Anthropic models) to work out what you are looking for. Only the sentence is sent: not your name, your email, your phone number or any account. The sentence is kept with nothing that says who wrote it, so the same query is not looked up twice: after 60 days it is no longer used and it is deleted in the periodic clean-ups of the store. Even so, please don't type personal details into the search box — that is what the quote form is for.

6. Data retention

Data will be kept for as long as necessary to fulfil the purpose for which it was collected:

• Contact data: until the enquiry is resolved and for the applicable legal period.
• Quote requests: 12 months from the date they are sent; after that they are deleted from the store in the periodic clean-ups, including the email address you left.
• Published reviews: while the company's profile remains published, or until you ask for yours to be taken down.
• Catering company data: while the profile is active in the directory, and up to 12 months after its removal.
• Billing data: for the periods required by tax and commercial regulations.
• Sentences typed into the search box: no longer used after 60 days and deleted in the periodic clean-ups.
• Fingerprint of the IP address (submission limit): no longer used after the hour and deleted in the periodic clean-ups.
• Browsing data: according to the cookie policy.

7. Your rights

Under the GDPR, you have the right to:

• Access: know which personal data we process about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request the deletion of your data.
• Objection: object to the processing of your data.
• Restriction: request the restriction of the processing.
• Portability: receive your data in a structured format.

To exercise these rights, contact us at local@gastroseo.com. To delete a quote request or take down a published review, just write to that address quoting the email you sent it with; we do it without asking for reasons.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

8. Security

We apply appropriate technical and organisational measures to protect personal data, including SSL/TLS encryption, restricted access and regular backups.

9. Changes

We reserve the right to modify this privacy policy. Any change will be published on this page together with the corresponding update date.