Privacy policy

Definitions

• Site: the website at kokukitchen.com, in English, Catalan and Spanish.
• Restaurant (or "we", "us"): DE LISTUIN AND SANS SL, the company that runs the Koku Kitchen restaurants in Barcelona and owns the Site.
• Website Operator: BEAUT1FUL NET S.R.L., the company that builds and runs the Site on the Restaurant's behalf.
• You: the person using the Site.
• Personal data: any information that relates to an identified or identifiable person.
• Usage data: data collected automatically while you use the Site, whether by the Site itself or by its infrastructure: for instance the pages you open and how long you stay on them.
• Cookies: small files that a website places on your computer, phone or tablet, holding among other things details of your browsing on that website.
• Service provider: a company that processes data on our behalf, to run the Site, to host it, or to help us see how it is used.

Who is responsible for your data

Two companies are behind the Site, and each is responsible (the "data controller") for its part:

• For the Site itself: BEAUT1FUL NET S.R.L., at Strada Ștefan Cicio-Pop 8, Dej, Cluj, Romania. The Website Operator is responsible for all the data collected through your visits to the Site: usage data, cookies, analytics, session recordings and advertising measurement, as described below. You can reach them through info@kokukitchen.com, which passes your request on to them.
• For everything else: DE LISTUIN AND SANS SL, with tax ID (NIF) B66245432, at Carrer del Comerç 29, 08003 Barcelona, España. The Restaurant is responsible for everything to do with the business: your bookings, your delivery orders, the messages you send us, reviews and your relationship with the restaurants. You can reach them at info@kokukitchen.com.

If you are not sure which of the two to write to, write to info@kokukitchen.com: your request will be handled by the right one.

What we collect

• Usage data: Collected automatically when you use the Site. It may include your device's IP address, browser type and version, the pages you visit, the date and time of your visit, the time spent on each page, unique device identifiers and other diagnostic data. On a phone or tablet it may also include the type of device, its unique ID, its operating system and its browser.
• How you use the Site: Without cookies, the Site counts the pages you open and what you click, as described under "Cookies and tracking tools". With your consent, the analytics tools listed there also record which pages you open, what you click or tap, how far you scroll, your device and browser, and an approximate location worked out from your IP address. One of them, PostHog, can also record a replay of your visit: how the page looked and how you moved through it.
• Your location, only if you ask for it: The "Choose closest one" button in the delivery picker asks your browser where you are, to find the nearest restaurant. That calculation happens in your browser: your location is not sent to us or to anyone else.
• Messages: If you write to us, we use your name, your email address and what you tell us to answer you.
• Bookings: Tables are booked through TheFork's widget, embedded in the Site's booking pages. What you type there (your name, phone number, email address, party size and time) goes to TheFork, which handles it under its own privacy policy, and is passed on to the Restaurant to seat you.
• Delivery orders: Delivery orders are placed on Uber Eats, Glovo and Just Eat, under their own privacy policies. The Restaurant only receives what they pass on to prepare and hand over your order.

The Site has no user accounts, and we do not knowingly collect any special categories of data (such as health data). If you tell a restaurant about an allergy, that is handled at the restaurant, not through the Site.

Cookies and tracking tools

We use cookies and similar technologies (tags, scripts and web beacons) to run the Site, to see how it is used and to measure our advertising. Cookies can be "session" cookies, deleted when you close your browser, or "persistent" cookies, which stay on your device until they expire or you delete them. You can set your browser to refuse cookies or to tell you when one is being set, though some parts of the Site may then not work.

Without asking you, the Site only stores what it needs to work and to remember your cookie choices. Two tools also count visits without cookies, whatever you choose in the banner: visitors.now, and PostHog in its cookieless mode. Both are described below. Everything else in the analytics and advertising categories below, including PostHog's cookies and session recordings, is used only after you accept it in the cookie banner, which lists each tool and the company behind it. You can change or withdraw your choice at any time with the "Cookie settings" link at the foot of every page, which opens the banner again. Withdrawing a consent stops the tools it covered and deletes the cookies they left in your browser: Google's (_ga, _ga_*, _gcl_*, and _gcl_ls in local storage) and PostHog's. The banner keeps only your choice, and asks you again when a new tool is added to its list.

These are the tools the Site uses, and what each one does. Our Cookie statement lists every cookie and storage item they leave, by name, with who sets it, what for and for how long.

• Axeptio (Agilitation SAS, France) — necessary: Runs the cookie banner and remembers what you chose, in cookies named axeptio_* that last six months. It needs no consent, since it is what records your consent. PostHog keeps a copy of your choice, and nothing else, in your browser's local storage (__ph_opt_in_out_*), so that it knows whether it may use cookies.
• Cloudflare (Cloudflare, Inc.) — necessary: Hosts and serves the Site and protects it from attacks. To do so it sees your IP address and each request for a page, and keeps short-lived server logs. When needed it may set a short-lived security cookie (__cf_bm, 30 minutes). This rests on our legitimate interest in a site that works and is secure.
• Google Tag Manager (Google Ireland Ltd) — necessary: Loads the tools below according to your cookie choices. It sets no cookies of its own.
• Google Analytics 4 (Google Ireland Ltd) — analytics: Counts visits and tells us which pages are read, where visitors come from, what device they use and, approximately, where they are. It sets the cookies _ga and _ga_* (up to two years). Reports are kept for at most 14 months. Data may be processed by Google LLC in the United States, under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
• PostHog (PostHog, Inc.) — analytics: Records how the Site is used, in one of two modes. Until you accept analytics, or if you refuse them, it runs without cookies: it records the pages you open, what you click or tap, how fast pages load and any errors they hit, along with your browser, device and screen size. In this mode it stores nothing on your device but your cookie choice (see Axeptio above), keeps no IP address, works out no location, and tells visits apart with an identifier that PostHog's servers derive from your connection and change every day, so one day's visit cannot be linked to the next. This rests on our legitimate interest in knowing how the Site is used; you can object by writing to info@kokukitchen.com. Once you accept analytics, it records in more detail: heatmaps of where visitors click, and session recordings that replay how a visit went (the page as you saw it, and its technical messages). What you type into form fields is masked before it is recorded. You are then told apart by a random identifier stored in a cookie and in local storage named ph_*_posthog (one year), with a profile of your visits attached to it; we do not link it to your name. If you withdraw your consent, PostHog deletes that cookie and goes back to the cookieless mode. Requests go through po.kokukitchen.com, a relay on our own domain, to PostHog's servers in the European Union (Frankfurt), where the data is stored. Session recordings are deleted after at most a year; other usage events after at most seven years.
• Google Ads (Google Ireland Ltd) — advertising: Measures whether a visit that started from one of our ads led to a booking, and lets us show you our ads on Google and other sites afterwards (remarketing). It sets the cookie _gcl_au (three months) on the Site, plus _gcl_aw, _gcl_gb or _gcl_dc (three months) when you arrive from one of our ads, with a copy in local storage (_gcl_ls), and cookies such as IDE (13 months) on doubleclick.net. If you accept advertising and send a form on the Site, Google Ads may also take an email address or phone number typed into it, scrambled (hashed) in your browser before it leaves, to match the visit to a Google account ("enhanced conversions"). The booking form is TheFork's, inside its own frame, which this cannot read. Data may be processed by Google LLC in the United States, under the EU–US Data Privacy Framework and the standard contractual clauses.
• visitors.now — cookieless measurement: Counts visits and a handful of actions on the Site (a booking button pressed, the menu browsed) without cookies or any identifier stored on your device, so it cannot follow you across sites or visits. It runs whatever you choose in the banner, on our legitimate interest in knowing how the Site is used.
• TheFork (La Fourchette SAS, France) — booking widget: The booking pages embed TheFork's widget in a frame. Inside it, TheFork and its providers set their own cookies (against bots and card fraud, and to test versions of the widget) and collect what you type, under TheFork's own policies, as an independent controller. The Cookie statement lists them.

Why we use your data, and on what legal basis

The Website Operator uses the data collected through the Site:

• To provide the Site, keep it secure and see that it works (legitimate interest, GDPR art. 6(1)(f)).
• To count visits and see which pages and buttons are used, without cookies, through visitors.now and PostHog's cookieless mode (legitimate interest, art. 6(1)(f)).
• To understand how the Site is used in more detail and improve it, through the analytics tools above, their cookies and session recordings (your consent, art. 6(1)(a)).
• To measure our advertising and show you our ads elsewhere (your consent, art. 6(1)(a)).

The Restaurant uses your data:

• To handle your bookings and delivery orders (the performance of a contract with you, art. 6(1)(b)).
• To answer your messages and requests (legitimate interest, or the steps you ask us to take before a contract, art. 6(1)(b) and (f)).
• To send you news and offers about the restaurants, only if you asked for them (your consent, art. 6(1)(a)); you can unsubscribe at any time.
• To keep the records the law requires, such as invoices (legal obligation, art. 6(1)(c)).

Where we rely on your consent, you can withdraw it at any time, without affecting what was done before. With your consent to advertising, Google Ads adds visitors to audiences so we can show them our ads again (remarketing), a limited form of profiling. We take no decisions about you by automated means that have legal or similarly significant effects.

Who we share it with

Your data may be shared:

• With service providers: The companies listed under "Cookies and tracking tools", which process data on our behalf and on our instructions, to host the Site, to run the cookie banner and to analyse how the Site is used.
• Between the Restaurant and the Website Operator: Each gives the other what it needs for its part of the work, and no more: the Restaurant sees how the Site is used, and the Website Operator learns of a booking or a message only when something has to be fixed.
• With TheFork and the delivery apps: When you book or order through them, as described above. They are independent controllers.
• When the law requires it: To comply with a legal obligation or a valid request from a public authority, such as a court; to protect our rights or property; to prevent or investigate wrongdoing in connection with the Site; or to protect the safety of the Site's users or the public.
• In a business transfer: If the Restaurant or the Website Operator is involved in a merger, acquisition or sale of assets, your data may be among what is transferred. We will tell you before your data becomes subject to a different privacy policy.

We do not sell your personal data.

Where your data goes

The Restaurant is in Spain and the Website Operator in Romania: both are in the European Union, so processing by either is not a transfer abroad. PostHog stores the Site's data in the European Union. Google and Cloudflare may process data in the United States or elsewhere outside the European Economic Area; those transfers rely on the EU–US Data Privacy Framework, for the companies certified under it, and on the European Commission's standard contractual clauses. Wherever your data is processed, we take the steps needed to see it treated securely and in line with this policy.

How long we keep it

Only as long as we need it for the purpose it was collected for, and after that for as long as the law requires us to keep it:

• Usage data and analytics: for the periods given for each tool under "Cookies and tracking tools"; it is deleted automatically after that.
• Server logs: a short time, for security.
• Messages: for as long as it takes to answer you and to keep a record of the exchange, then deleted.
• Bookings and orders: for as long as accounting and tax law require the Restaurant to keep them.
• Your cookie choices: six months, after which the banner asks you again (and sooner if a new tool is added to it).

Security

We take reasonable technical and organisational measures to protect your data: the Site is served over HTTPS, access to the tools above is limited to the people who need it, and what you type into forms is masked in session recordings. No transmission over the internet or method of storage is entirely secure, though, and we cannot guarantee absolute security.

Children's privacy

The Site is not aimed at children, and we do not knowingly collect personal data from anyone under 14, the age from which Spanish law lets a minor consent to the processing of their data. If you are a parent or guardian and believe your child has given us personal data, write to info@kokukitchen.com and we will delete it.

Links to other websites

The Site links to websites and services we do not run: TheFork, the delivery apps, social networks and maps. When you follow one of those links you are on their site, under their privacy policy, which we advise you to read. We have no control over, and take no responsibility for, their content, policies or practices.

Your rights

Under the GDPR you can ask us to show you the data we hold about you, to correct it, to delete it, to limit how we use it, or to send it to you in a format you can take elsewhere; you can object to its use where we rely on a legitimate interest; and you can withdraw a consent you gave. To do so, write to info@kokukitchen.com: requests about the Site and its analytics are passed on to the Website Operator, and the rest are handled by the Restaurant. We may ask you to confirm who you are before answering, and we answer within a month.

If you think your data has not been handled properly, you can complain to the Spanish Data Protection Agency (www.aepd.es), for the Restaurant's processing, or to the Romanian National Supervisory Authority for Personal Data Processing (www.dataprotection.ro), for the Website Operator's, or to the authority of the country where you live.

Changes to this policy

We may update this policy from time to time, for instance when the Site starts or stops using a tool. The new version is published on this page with its date at the top; if the change is significant, we will say so with a notice on the Site before it takes effect. Please look at this page now and then.

Contact

For any question about this policy or your data, write to info@kokukitchen.com.