This policy describes how the personal data of people who visit the digital menu of Nisia Café + Bocatas is processed, in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).

1. Data controller

The controller of the data collected on this website is the owner of the establishment:

  • Company name: Nisia Café
  • Tax ID: Y7210739T
  • Registered address: Carrer D'Alberic, 27, Extramurs, Valencia, España
  • Data protection contact: nisiacafeteria@gmail.com

2. Data processor

The QMenut platform (murga.ing, tax ID Z1225135E) provides the digital-menu technology service and acts as a processor on behalf of the establishment, in accordance with Article 28 of the GDPR.

3. Data processed and purposes

  • Technical connection data: the IP address and basic browser data are processed temporarily to serve the page securely (abuse prevention and error logging). They are not used to create profiles.
  • Google reviews (when enabled): public reviews are requested from Google when you approach that section. QMenut does not store their content. The IP address is used transiently to limit abusive requests, without creating profiles.
  • Loyalty programme (when enabled): if the establishment enables its points programme and you choose to participate, your email will be processed to create and manage your card, points, and benefits. Your name and date of birth are not requested. Participation requires expressly accepting this policy at registration.
  • Reservations, when enabled: if you make a reservation, your name, phone number and email are processed together with the date, time and party size to manage it: to email you its confirmation and, before the time, a reminder with a link to confirm or cancel your attendance. You only receive messages about your own reservation, never advertising. Anyone who types the email used into this website, or opens the link in those emails, can see, confirm and cancel the reservation; every cancellation is notified to that email.

4. Cookie-free analytics

To understand which dishes and sections attract the most interest, PostHog (PostHog EU, with data hosted in the European Union) is used anonymously: without cookies, without analytic storage on your device, and without identifying you across visits. Each page load uses a random, short-lived identifier kept only in memory; recorded events are not associated with your identity.

5. Legal basis

  • Technical data and anonymous analytics: legitimate interest in security and service improvement (Article 6(1)(f) GDPR).
  • Loading public Google reviews: legitimate interest in providing information about the establishment’s public reputation (Article 6(1)(f) GDPR).
  • Loyalty programme: the participant’s express consent (Article 6(1)(a) GDPR), which may be withdrawn by requesting removal.
  • Reservations: managing the reservation you make (Article 6(1)(b) GDPR). The checkbox in the last step also records your agreement to receive emails about that reservation.

6. Recipients and processors

Data is not disclosed to third parties except where legally required. The following providers act as processors:

  • QMenut — digital-menu platform.
  • Cloudflare, Inc. — hosting and content delivery network.
  • PostHog EU — anonymous, cookie-free analytics (data hosted in the EU).
  • Google LLC — provider of public Google Maps reviews when the establishment enables this feature.
  • Email delivery provider — transactional messages (e.g. access codes).

Payments by the establishment to the platform are handled by Stripe and do not affect visitors’ menu data.

Reviews are fetched by the server and are not stored in the digital menu. If you open a Google Maps link, you will leave this website and the Google Privacy Policy and the relevant Google terms will apply.

7. Retention

The identifier used to rate-limit review requests is retained only for the technical rate-limit window. The email, programme relationship, and consent record are kept while you participate or until you request removal, without prejudice to legal retention obligations.

A reservation's contact data (name, phone number and email) is anonymised 90 days after the reserved date; only the date, time and party size are kept, with nothing that identifies you.

8. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing, and data portability by writing to the controller and proving your identity. If you believe the processing is not compliant, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Cookies and storage technologies

This website does not use cookies or equivalent technologies for advertising or tracking. When you register for loyalty, your card token is stored in the browser’s localStorage, associated with the establishment’s domain, so the card remains available on that device. Your selected language may also be stored in localStorage; one-time language detection and some installation states use sessionStorage. Analytics is kept in memory only. If you make or look up a reservation, the email used is stored in the browser's localStorage to show your reservations on that device. These technical technologies support functions you requested and their treatment should be reviewed under Article 22(2) of the LSSI-CE.

10. Changes to this policy

This policy may be updated to reflect regulatory or service changes. The current version will always be published on this page.

Last updated: 31 October 2026.

MenuHighlightsContactRewards