Personal Data Processing Policy

Grupo Bastardo is the trade name under which the Bastardo restaurants operate in Medellín and Envigado, Colombia. The controller of your personal data is:

Trade name

Grupo Bastardo

Legal name

[PENDING: legal name]

Tax ID (NIT)

[PENDING: tax ID (NIT)]

Registered address

[PENDING: controller's registered address]

Data-protection email

mercadeobastardoprovenza@gmail.com

Phone numbers

Provenza +57 310 662 8843 · Le Mont +57 310 683 3660 · Envigado +57 310 681 3311

Venues

• Bastardo Provenza — Cra. 35 #8A-11, El Poblado, Medellín
• Bastardo Le Mont — Av. Las Palmas KM 15, Le Mont Mall, Unit 101, Envigado
• Bastardo Envigado — Transversal 31 Sur Diagonal 32D-6, La Magnolia, Envigado

This policy follows Colombian Law 1581 of 2012 on personal data protection (known as habeas data) and Decree 1377 of 2013, now part of Decree 1074 of 2015.

It covers the data we receive through this website, WhatsApp, phone, email, social media and at our venues.

Data subject

The person the data is about: you.

Personal data

Any information that identifies you or could identify you, such as your name, phone number or email.

Sensitive data

Data that affects your privacy or could lead to discrimination, such as information about your health (for example, an allergy).

Processing

Any operation on personal data: collecting, storing, using, sending or deleting it.

Consent

Your prior, express and informed authorization for us to process your data.

Controller and processor

The controller decides how data is processed; the processor handles data on the controller's behalf.

Transfer and transmission

A transfer sends data to another controller; a transmission shares it with a processor. Either can happen inside or outside Colombia.

Bookings. Name, phone number with its country code, email (optional), venue, date, time, party size, occasion and comments (optional). The booking form does not store or send this data to our servers: it builds, on your device, a WhatsApp message that you decide whether to send to the venue. We only receive it when you send that message.

Private events. Event type, venue, tentative date, approximate number of guests, budget (optional), your name and any comments you choose to include. As with bookings, the form builds a WhatsApp message for the chosen venue and we only receive it if you decide to send it.

Messages and calls. Whatever you tell us when you write to us on WhatsApp, email or social media, or when you call a venue.

Newsletter. We do not collect emails for newsletters today. If we launch one, we will ask for your express consent with an unticked box.

Browsing. Technical data such as your IP address, browser type and pages visited, which our hosting provider processes to deliver the site securely and to produce aggregated statistics that do not identify you. Fonts and images are served from our own domain: no external font service receives your data.

If you tell us about an allergy, intolerance or dietary restriction, you are sharing health data, which the law treats as sensitive. Sharing it is optional: you are not required to answer questions about sensitive data. We use it only to prepare your visit safely, never to profile you or for advertising.

Please include in your comments only what we need to look after you.

Bookings and requests must be made by adults. We do not knowingly collect data from anyone under 18, and selling alcoholic beverages to minors is prohibited at our venues (Colombian Law 124 of 1994).

We process your data only for these purposes:

• To manage, confirm, change or cancel your booking or private-event request, and to contact you about it.
• To answer your messages, questions, requests and complaints.
• To look after the needs you tell us about: allergies, accessibility or a special celebration.
• To meet legal, accounting and tax obligations, for example when you ask for an electronic invoice.
• To protect the site and understand how it is used through aggregated statistics that do not identify you.
• To send you news, offers or the Court's newsletter only if you have consented in a prior, express and informed way. You can withdraw that consent at any time.

We do not sell or rent your data, and we will not use it for other purposes without asking for your consent again.

When you send us, on your own initiative, a booking or event request on WhatsApp, or when you write to or call us, you authorize us to use that data to handle that request (unequivocal conduct, article 7 of Decree 1377 of 2013).

For marketing (newsletter and offers) we ask for express consent through a box that is never pre-ticked. Whenever we store data in our own systems, we will keep proof of your consent.

These third parties are involved in providing the service. Some are outside Colombia, so using them involves an international transfer or transmission of data, which you authorize by using those channels:

• WhatsApp (Meta Platforms)

  Purpose

  The channel you use to send your booking or event request and chat with the venue.

  Where

  United States and other countries (an international transfer you start by sending the message)

• Cloudflare

  Purpose

  Hosting and secure delivery of the site; aggregated, cookie-free visit statistics (Cloudflare Web Analytics).

  Where

  Global network; US-based company

• Instagram, Google Maps, Waze, Cluvi

  Purpose

  External services our links take you to (social media, directions, digital menu) and the Google map that loads on each venue page only if you choose to show it. Their own policies apply once you open them.

  Where

  Depends on each service

We aim to work only with providers that apply adequate security measures. Beyond them, we will only share your data when a competent authority requires it by law.

This site does not use advertising or tracking cookies, whether our own or third-party.

Visits are measured with Cloudflare Web Analytics, which uses no cookies and builds no individual profiles: it only counts page views and aggregated technical data.

Cloudflare may use strictly necessary technical cookies to protect the site from malicious traffic, and your browser may store technical preferences (such as language) that do not identify you.

On each venue page, the Google Maps map does not load until you choose to show it; from then on Google may use its own cookies under its privacy policy.

If we ever add tools that use analytics or advertising cookies, we will ask for your consent before enabling them and update this policy.

This site does not currently use artificial-intelligence assistants or make automated decisions about you.

If we add an AI assistant (for example, to help you book or choose from the menu), before enabling it we will update this policy to state what data it processes, which provider runs it, how long conversations are kept and how to ask for their deletion. The assistant will always identify itself as AI and ask you not to share sensitive data in the chat.

Under article 8 of Law 1581 of 2012, you may:

• Access, update and correct your data, including data that is partial, inaccurate, incomplete or misleading.
• Request proof of the consent you gave us.
• Be told, on request, how we have used it.
• Withdraw your consent or ask us to delete your data when we fail to respect your rights or when there is no legal or contractual duty to keep it.
• Access your personal data free of charge.
• File complaints with the Superintendence of Industry and Commerce (SIC) (opens in a new tab) for breaches of the law, after first completing the query or claim process with us.

These rights may be exercised by you, your successors, or your duly accredited representative or attorney.

Contact channel. Email us at mercadeobastardoprovenza@gmail.com with the subject «Datos personales» (personal data), call any of our venues (Provenza +57 310 662 8843 · Le Mont +57 310 683 3660 · Envigado +57 310 681 3311) or send a written request to [PENDING: controller's registered address]. Team in charge of these requests: [PENDING: responsible team or person].

Include your name, a contact detail so we can reply, a description of your request and, for a claim, any documents you want to rely on.

Queries (to access your data): we reply within 10 business days of receiving them. If that is not possible, we explain why and reply within 5 more business days at most (article 14 of Law 1581).

Claims (to correct, update or delete your data, withdraw consent or report a breach): we reply within 15 business days from the day after receipt, extendable by up to 8 more business days with notice of the reason (article 15). If a claim is incomplete, we will ask you to complete it within 5 days; if 2 months pass without it being completed, we will consider it withdrawn. While it is being resolved, the data will be flagged «reclamo en trámite» (claim in progress).

If you are not satisfied with our answer, you may contact the Superintendence of Industry and Commerce (SIC) (opens in a new tab).

We apply reasonable technical, human and administrative measures to protect your data against loss and unauthorized access or use, such as the site's encrypted connection (HTTPS) and limiting access to the people who need the data to look after you.

We keep your data only as long as needed for the purpose you gave it to us and for the periods required by accounting, tax or other rules. Our databases remain in force for as long as those purposes apply.

This policy is effective from [PENDING: effective date]. Version 1.0, updated September 30, 2026.

If we change it substantially (for example, when launching the newsletter, new forms or an AI assistant), we will publish the new version here with its date before applying it and, if the purposes change, we will ask for your consent again.