Privacy policy
Last updated: 3 August 2026
This policy sets out what personal data we collect through this website, what we use it for and what you can do about it. It is written to meet Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Still to be supplied: the registered trading name, tax number (NIF/CIF) and, where applicable, company registry details of the owner. The LSSI-CE requires all three in this notice.
Who the controller is
The data controller is the owner of Hito restaurant, at Calle Galileo, 4, 35010 Las Palmas de Gran Canaria, Gran Canaria, España, telephone +34 928 05 82 89. Use either of those to reach us about anything to do with your data.
What we collect
Only what you give us when you book a table. The reservation form collects:
- Your name, so we know whose table it is.
- Your phone number, so we can confirm the booking or tell you about any change. It is the only contact detail we require.
- Your email address, optional, if you would rather have written confirmation.
- Party size, date, time and any notes you choose to add.
- The language you are browsing in and the page you submitted from, so we reply in your language.
We do not take payment details on this website and we do not collect any special category data. If you tell us about an allergy or dietary preference in the notes, we use it only to prepare your service and delete it with the rest of the booking.
Why we use it, and on what legal basis
- Handling your booking
- Legal basis: performance of a contract, or pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). Without a name and phone number we cannot confirm a table.
- Measuring use of the site
- Legal basis: our legitimate interest in understanding which pages are visited and improving the site (Art. 6(1)(f) GDPR), always in aggregate.
- Keeping the form secure
- Legal basis: legitimate interest in preventing automated submissions and spam (Art. 6(1)(f) GDPR), using Cloudflare Turnstile.
Who else sees it
Your booking goes to two places: the restaurant inbox and an internal Discord channel the team watches during service. The following providers are also involved, all as processors:
- Cloudflare, Inc. — website hosting, delivery of the booking email and bot protection (Turnstile). Data is processed across its global network under the EU Standard Contractual Clauses.
- Discord, Inc. — internal notification of the booking to the team.
- Google Ireland Ltd. — Google Tag Manager, which manages the site measurement tags.
- Plausible Analytics — cookieless analytics, self-hosted on a server in the European Union, which does not identify individual people.
We do not sell or pass your data to anyone else, and we do not use it to send you marketing unless you specifically ask us to.
How long we keep it
Booking data is kept for as long as it is needed to handle the booking and then for the period during which any liability arising from the service could still arise. After that it is deleted. Analytics data is aggregated and cannot identify you, so there is no individual deletion period.
Your rights
You can ask us at any time to access your data, correct it, delete it, restrict or object to its processing, and to have it ported. Write or call using the contact details above, saying which right you want to exercise. We will reply within one month.
If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.
Cookies
The first time you visit you will see a notice explaining which measurement tools we use and letting you choose which categories to allow. Your choice is stored in this browser and you can change it at any time from the same notice. Plausible works without cookies and stores nothing on your device.
Changes to this policy
If anything material changes we will update this text and the revision date shown above. It is worth checking back occasionally.
