PRIVACY POLICY

1. USER INFORMATION

Who is responsible for processing your personal data?

RESTAURANTE ES MESTRAL, S.L is the controller responsible for processing the user's personal data and informs you that this data will be processed in accordance with Regulation (EU) 2016/679, of 27 April (GDPR), and Organic Law 3/2018, of 5 December (LOPDGDD).

What types of data do we request and process?

Depending on the form or method of obtaining your data, we always request the minimum necessary to fulfil the purposes detailed in each case.

For what purposes do we process your personal data and why?

Depending on the form through which we obtained your personal data, we process them confidentially for the following purposes:

Contact Form:

— To respond to enquiries or any type of request made by the user through any of the contact methods available on the website. (legitimate interest, art. 6.1.f GDPR)

— To send commercial advertising communications by email, fax, SMS, MMS, social networks or any other electronic or physical means. These communications shall be made by the responsible party and related to its products and services. Third parties shall never have access to personal data. (consent, art. 6.1.a GDPR)

— To carry out statistical analysis and market studies. (legitimate interest, art. 6.1.f GDPR)

Reservations:

— To formalise reservations at the responsible party's establishment. (contract execution, art. 6.1.b GDPR)

— To send commercial communications regarding similar products or services (art. 21.2 LSSI). (legitimate interest, art. 6.1.f GDPR)

Social Media:

— Contact through Social Networks to maintain a relationship between the User and the Responsible Party, including: processing requests and enquiries, informing about activities and events, informing about products and/or services, interacting through official profiles. (consent, art. 6.1.a GDPR)

Instant Messaging:

— To schedule appointments and meetings. (legitimate interest, art. 6.1.f GDPR)

— To respond to enquiries or requests. (legitimate interest, art. 6.1.f GDPR)

Clients and Suppliers:

— Commercial management with clients and suppliers. (legitimate interest, art. 6.1.f GDPR)

Data Subject Rights:

— To attend citizens' requests in exercising their GDPR rights. (legal obligation, art. 6.1.c GDPR)

Website Users:

— Identification data of users accessing the corporate website. (legitimate interest, art. 6.1.f GDPR)

How long will we keep your personal data?

Data will be retained for no longer than necessary to maintain the purpose of processing or until legal retention requirements expire. When no longer necessary, data will be deleted with appropriate security measures.

To whom do we disclose your personal data?

No disclosure of personal data to third parties is planned, except where necessary for the execution of processing purposes, to our communication service providers with whom the responsible party has signed confidentiality and data processor contracts.

Do we carry out international transfers?

In accordance with Article 44 of the GDPR, authorisation for international data transfer to a country without adequate protection may only be granted if sufficient guarantees are obtained. For the updated list of providers, contact uep@esmestral.com

What are your rights?

The rights available to the user are:

— Right to withdraw consent at any time.

— Right of access, rectification, portability, erasure of data, and limitation of or objection to processing.

— Right to file a complaint with the supervisory authority (www.aepd.es) if you consider that processing does not comply with current regulations.

Contact details to exercise your rights: RESTAURANTE ES MESTRAL, S.L. C/ Batle Andreu Burguera Mut, 2, - 07640 Ses Salines (Balearic Islands). Email: uep@esmestral.com

2. MANDATORY OR OPTIONAL CHARACTER OF INFORMATION PROVIDED

Users, by marking the corresponding checkboxes and entering data in fields marked with an asterisk (*), expressly and freely accept that their data is necessary to process their request. The user guarantees that the personal data provided is accurate.

The responsible party informs that all data requested through the website is mandatory for providing an optimal service.

3. SECURITY MEASURES

In accordance with current data protection regulations, the responsible party complies with all GDPR and LOPDGDD provisions, manifestly with the principles described in Article 5 of the GDPR.

The responsible party guarantees the implementation of appropriate technical and organisational policies to protect users' rights and freedoms.

For more information, contact: RESTAURANTE ES MESTRAL, S.L. C/ Batle Andreu Burguera Mut, 2, - 07640 Ses Salines (Balearic Islands). Email: uep@esmestral.com

4. VALIDITY

This privacy policy has been effective since 10/10/2025.

The responsible party reserves the right to modify this policy to adapt to future legislative or jurisprudential updates.