Privacy

What we collect

When you book, we collect your name, email address, chosen weekend, group size, payment and booking status, the confirmations made during booking and anything you choose to tell us. When you pay, Stripe also asks for your billing address, because Spanish law requires it on the invoice for your booking. Stripe handles your card details; Lewos does not receive or store the complete card number. When you use the question form, we collect your name, email address and question. To protect the forms from automated misuse, we temporarily process a one-way technical identifier derived from your network address and email address. It cannot be used by us to recover either value.

If you attend a filmed Tavern weekend, we may also process your filming preference and, where you consent, recordings containing your identifiable image or voice. The purpose and choices are explained separately before booking and filming.

Why

To reserve and administer your booking, take payment, arrange your stay, comply with our legal obligations, or answer a question you send us.

Where it goes

Questions sent through the contact form are delivered through Netlify, the company that hosts this website. Seat allocations and booking records are processed and stored using Supabase. Payments are handled by Stripe; Lewos does not receive or store your full card details. Transactional email may be delivered through Resend. These providers process the information only to provide those services to Lewos. We do not sell your details, share them with advertisers or add you to a list you did not request.

Where in the world it goes

Lewos works from Asturias in Spain, but the providers above are not all in Europe, so part of your information is processed outside the European Economic Area.

Netlify hosts this website and receives the contact form. Netlify, Inc. is established in the United States, transfers under the standard contractual clauses published by the European Commission, and is certified under the EU–U.S. Data Privacy Framework. Supabase stores the booking records and states that it may process them in the United States and Singapore, under those same standard contractual clauses. Payments run through Stripe's Irish entities, which use the standard contractual clauses and the EU–U.S. Data Privacy Framework for any onward transfer. Transactional email is delivered by Resend, which processes in the United States.

You can ask us for a copy of the safeguards that apply to any of these transfers. One email is enough.

How long we keep it

Booking requests that do not lead to a booking, and ordinary contact questions, are kept only as long as needed to manage the request and reasonable follow-up. Confirmed booking, payment and invoice records are kept for the periods required by applicable accounting, tax and consumer law. A deletion request cannot override a legal duty to retain a particular record.

Filming preferences and consent records are kept for as long as needed to demonstrate and respect your choice. Recordings approved for use are kept while that use remains relevant, unless consent is withdrawn for future use. The technical identifier stops affecting access after its fifteen-minute protection window and is deleted automatically during subsequent security cleanup.

On what basis

Reserving seats, taking payment and arranging your stay is necessary to enter into and perform the agreement with you. Keeping booking, payment and invoice records is a legal obligation. Answering a question you send us, and protecting the forms from automated misuse, rest on our legitimate interest in running the Tavern and keeping it available to real guests. Filming that makes a guest identifiable in promotional material rests on that guest's separate consent, which can be withdrawn for future use.

Your rights

You can ask us to see, correct, restrict or delete personal data we hold about you, object where processing relies on a legitimate interest, or withdraw consent for future use where consent is the basis. These rights can be subject to legal exceptions. One email is enough to start the request.

If you believe we handle your personal data incorrectly, you can also lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos, or with the supervisory authority of the country where you live.