Who is responsible for your data
The data controller is Rupo, a self-employed individual in Spain who runs Breakfast Always Wins.
- Controller
- Ruben Benarroch Esayag
- Tax ID (NIF)
- 50905553k
- Address
- Calle Sanchez Pacheco 101
- Privacy contact
- privacidad@breakfastalwayswins.com
What data we use, why and on what basis
You can browse the map, routes and places without giving us any personal data. We only process it in these cases:
Tour requests
- Data
- Name, email, WhatsApp number, preferred date, group size, language and anything you tell us about the tour (e.g. allergies or dietary needs, if you choose to share them).
- Purpose
- Replying to you, checking availability, agreeing the details and running the tour. The request is also forwarded to Rupo’s private Telegram bot so he can answer quickly.
- Legal basis
- Steps taken at your request before entering into a contract (art. 6.1.b GDPR). Any health information, such as allergies, is processed only with your explicit consent (art. 9.2.a), given by writing it in the form.
Newsletter
- Data
- Email, language, where you signed up, the version of the consent text you accepted and the relevant dates. We also measure opens and clicks in aggregate.
- Purpose
- Sending you the newsletter with new places and routes.
- Legal basis
- Your consent (art. 6.1.a GDPR), confirmed by double opt-in: we only send it once you click the link in the confirmation email. In the tour form the box is unticked by default. Every email has a one-click unsubscribe link.
Place suggestions
- Data
- The place, your note, the name you want to appear and, optionally, a contact email.
- Purpose
- Reviewing the suggestion, publishing it on the suggestions board and, if you left your email, thanking you and letting you know if it makes it onto the map.
- Legal basis
- Your consent (art. 6.1.a GDPR).
Tour reviews
- Data
- Display name, text, rating, month of the tour, an optional photo and, optionally, an email just to thank you.
- Purpose
- Moderating and publishing your review on the website.
- Legal basis
- Your consent (art. 6.1.a GDPR), including a specific checkbox to allow publication. If you send a photo where other people appear, you must have their permission.
Votes on suggestions
- Data
- A non-reversible hash built with a salt that changes every day, plus a random identifier stored in your browser. We cannot work out who you are from it.
- Purpose
- Preventing the same person from voting several times.
- Legal basis
- Legitimate interest in keeping voting fair (art. 6.1.f GDPR).
Our own analytics (cookie-free)
- Data
- Anonymous events (pages viewed, map filters, searches, clicks on “Directions”…), with a random session identifier stored in your browser tab, device type, language and approximate country and city derived at that moment from our hosting provider’s headers. No cookies and no IP address stored.
- Purpose
- Understanding which places and features are useful and improving the guide.
- Legal basis
- Legitimate interest in measuring and improving the service with minimal, non-identifying data (art. 6.1.f GDPR).
Google Analytics 4 and Microsoft Clarity
- Data
- Browsing data, identifiers stored in cookies and, in Clarity’s case, recordings of how you use the page (with form fields masked).
- Purpose
- More detailed statistics, heatmaps and detecting usability problems.
- Legal basis
- Only with your consent (art. 6.1.a GDPR), through the cookie banner. See the cookie policy.
Anti-bot protection
- Data
- Technical signals from your browser and device assessed by Cloudflare Turnstile when you send a form or vote. We don’t store your IP address: rate limits use a hash that changes daily.
- Purpose
- Stopping spam and abuse of the forms.
- Legal basis
- Legitimate interest in keeping the site secure (art. 6.1.f GDPR).
Emails you send us
- Data
- Whatever you include in your message.
- Purpose
- Answering you.
- Legal basis
- Your consent when writing to us and, if it concerns a tour, the pre-contractual steps you asked for (art. 6.1.a and 6.1.b GDPR).
How long we keep it
We delete data as soon as we no longer need it. Most deletions happen automatically every day.
| Data | What | How long |
|---|---|---|
| Tour requests | Name, email, WhatsApp, tour details | Deleted 6 months after the tour (or after the request, if the tour doesn’t go ahead). |
| Newsletter subscribers | Email, language, source, consent text version, dates | While you are subscribed. When you unsubscribe they are deleted and only a hash of your email remains in a suppression list, so we never write to you again by mistake. Unconfirmed sign-ups are deleted after 7 days. |
| Suggestions | Name of the person suggesting, note, optional contact | Published: while they remain visible. Discarded: deleted after 3 months. The contact email is deleted after we send the “I tried it and it’s on the map!” email. |
| Tour reviews | Display name, text, rating, month, optional photo; optional email only to thank you | While published. The email is deleted when the review is moderated. Rejected reviews are deleted after 30 days. |
| Votes | Non-reversible hash (daily salt) | Kept permanently, as anonymous data. |
| Own analytics | Events without cookies or IP | Detailed for 90 days, then only aggregated figures. |
| Google Analytics 4 | According to Google | Minimum retention (2 months). |
We don’t store IP addresses in clear in any table. Where we need to tell requests apart (votes, rate limits) we use a non-reversible hash with a salt that changes every day.
Who helps us (processors)
We don’t sell or share your data with anyone for their own purposes. To run the site we rely on these providers, who process data only on our behalf and under contract:
| Provider | What for | Notes |
|---|---|---|
| Supabase | Database and file storage (e.g. review photos) | Hosted in the EU (Ireland, eu-west-1). |
| Vercel | Website hosting and delivery, approximate location by headers | US company; global network. |
| Resend | Sending emails (confirmations, newsletter) | US company. |
| Maps, Places (live place data), Google Analytics 4, Google Tag Manager, Search Console | GA4 and Tag Manager only with consent. | |
| Microsoft | Clarity (heatmaps and session recordings) | Only with consent. |
| Cloudflare | Turnstile (anti-bot protection on forms and votes) | — |
| Telegram | Private notifications to Rupo | Your tour request, suggestion or review is forwarded to Rupo’s private bot so he can reply. |
| Meta | Instagram feed and embedded posts | Loaded from Instagram. |
| AI Gateway provider (Vercel AI Gateway and the model provider) | Drafting and translating the site’s own texts from the admin panel | Only Breakfast Always Wins content; never your personal data. |
| OpenStreetMap Nominatim | Working out the country, city and neighbourhood of each place from its coordinates | Receives place coordinates only; no personal data. |
We may also disclose data to public authorities when the law requires it.
International transfers
Some of these providers are based in, or use subcontractors in, countries outside the European Economic Area (mainly the United States). When that happens, the transfer is covered by an adequacy decision — such as the EU-US Data Privacy Framework for certified companies — or by the European Commission’s Standard Contractual Clauses, together with any additional measures needed.
Your rights
You can ask us at any time to:
- access the data we hold about you;
- rectify it if it is wrong;
- erase it;
- object to processing based on legitimate interest;
- restrict processing while a request is being resolved;
- receive it in a portable format (portability);
- withdraw your consent whenever you like, without affecting what was done before.
Just write to privacidad@breakfastalwayswins.com saying what you want. If we have reasonable doubts about your identity we may ask you to confirm it. It is free and we will reply within one month. You can unsubscribe from the newsletter with the link in any email, and change your cookie choice from the footer of any page.
If you think we haven’t handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es). We’d appreciate it if you told us first so we can fix it.
Minimum age
You must be at least 14 years old to send any form on this site. Tour requests must be made by an adult, who is responsible for the information they give about the rest of the group.
Automated decisions and security
We don’t make automated decisions or build profiles that have legal or similarly significant effects on you.
The site uses HTTPS, the database has row-level access rules and only Rupo can access the admin panel. Forms are protected against bots and abuse.
Changes to this policy
If we change how we handle data, we will update this page and the date at the top. If the change is significant and affects newsletter subscribers, we will let them know by email.