Privacy Policy

At BBQ Chef Sander, we are committed to protecting the privacy and confidentiality of the personal data provided through our website and during the provision of our catering and private dining services.

This Privacy Policy explains how we collect, use, store and protect personal data, the legal basis for each processing activity and the rights available to users under the General Data Protection Regulation (EU) 2016/679 (GDPR), the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights, and other applicable Spanish and European legislation.

Data Controller

Johan Alexander ter Beek, trading as BBQ Chef Sander (hereinafter, “THE CONTROLLER”)
NIE / Tax ID: Z0795382R
Address: Pinos 22C, 03720 Benissa (Alicante), Spain
Email: info@bbqchefsander.nl
Phone: +31 653 885 490
Website: bbqchefsander.es

How We Collect Personal Data

THE CONTROLLER may collect personal data through the following channels:

Contact, enquiry or quotation request forms available on the website.
Direct communication by email, telephone or messaging services.
Requests for proposals, event bookings and service agreements.
Commercial relationships with clients, suppliers, venues and event professionals.
Interactions through social media profiles linked to BBQ Chef Sander.
Cookies and similar technologies, subject to the user’s preferences and consent where required.

Categories of Personal Data

Depending on the nature of the enquiry or service, we may process:

Identification and contact details, such as name, surname, email address and telephone number.
Event information, including the event date, venue, location, number of guests and preferred catering format.
Information necessary to prepare a personalised proposal or provide the contracted service.
Billing, invoicing and payment-related information.
Communications exchanged with clients, guests, suppliers or event professionals.
Technical information associated with use of the website, such as IP address, browser information and cookie identifiers.
Photographs, videos or testimonials, where their publication has been authorised.

Dietary Requirements and Allergy Information

To design menus and provide catering services safely, clients may voluntarily provide information concerning dietary requirements, food intolerances or allergies relating to themselves or their guests.

Some of this information may be considered health-related personal data. It will therefore be processed only when necessary for the organisation and safe provision of the requested service and, where legally required, on the basis of the data subject’s explicit consent.

If a client or event organiser provides personal information concerning guests or other third parties, they confirm that they are authorised to provide it and that the individuals concerned have been appropriately informed.

Purposes of the Processing

Personal data may be processed for the following purposes:

Responding to enquiries, contact requests and questions about our services.
Preparing personalised quotations and bespoke catering proposals.
Managing reservations, contracts, event planning and customer service.
Coordinating menus, dietary requirements, locations, suppliers and event logistics.
Managing payments, invoices, accounting and administrative obligations.
Maintaining communication with clients before, during and after an event.
Sending information about related services when requested, consented to or otherwise permitted by law.
Publishing photographs, videos or testimonials for portfolio and promotional purposes where appropriate authorisation has been obtained.
Protecting the website, preventing misuse and maintaining its technical security.
Analysing website performance and user behaviour when the user has consented to analytical or advertising cookies.
Complying with applicable legal, tax and administrative obligations.

Legal Basis for Processing

The legal basis for processing personal data may include:

Pre-contractual measures: responding to enquiries and preparing quotations or proposals requested by the user.
Performance of a contract: organising and providing the booked catering, private dining or event service.
Compliance with legal obligations: fulfilling accounting, invoicing, tax and administrative requirements.
User consent: sending optional commercial communications, using non-essential cookies, processing certain dietary or health-related information, or publishing authorised images and testimonials.
Legitimate interests: maintaining the security of the website, managing professional relationships, preventing fraud and defending against possible legal claims, provided that the user’s rights and interests do not prevail.

Where processing is based on consent, the user may withdraw that consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

Mandatory and Optional Information

Fields identified as mandatory in a form must be completed so that we can respond to the request or provide the requested service. Failure to provide the necessary information may prevent us from processing an enquiry, preparing an accurate quotation or completing a booking.

Users should provide accurate, current and relevant information and notify THE CONTROLLER of any changes.

Commercial Communications

Commercial or promotional communications will only be sent where the recipient has requested them, provided consent or where sending them is otherwise permitted under applicable legislation.

Recipients may unsubscribe at any time by following the instructions included in the communication or by contacting info@bbqchefsander.nl.

Use of Cookies

The website may use technical cookies and, subject to the user’s consent, analytical, personalisation or advertising cookies. Detailed information regarding the cookies used, their duration, providers and how consent can be changed or withdrawn is available in our Cookie Policy.

Data Retention

Personal data will be retained only for as long as necessary to fulfil the purpose for which it was collected.

Enquiry and quotation data will be retained while the request is being managed and for a reasonable period afterwards.
Client, contract, invoice and payment information will be retained for the periods required by applicable tax, accounting and commercial legislation.
Dietary and allergy information will be retained only for as long as necessary to organise and safely provide the relevant event service, unless longer retention is necessary for the establishment, exercise or defence of legal claims.
Data used for commercial communications will be retained until consent is withdrawn or the recipient objects to further communications.
Images and testimonials will be retained until the relevant authorisation is withdrawn, without affecting previous lawful use.
Cookie-related data will be retained for the periods specified in the Cookie Policy.

Once the relevant retention period has expired, data may remain securely blocked for the applicable statutory limitation periods before being permanently deleted.

Data Recipients and Service Providers

Personal data will not be sold to third parties.

Data may be accessed by service providers that assist THE CONTROLLER with the operation of the business and website, including hosting, email, cloud storage, website maintenance, communication, accounting, payment, customer management, analytics and event-related services.

These providers will only process personal data under appropriate contractual arrangements, following documented instructions and subject to confidentiality and security obligations.

Personal data may also be disclosed to public authorities, courts, tax authorities or other competent bodies when required by law.

International Data Transfers

Some technology or communication service providers may process data outside the European Economic Area.

Where an international transfer takes place, THE CONTROLLER will ensure that an appropriate legal mechanism is in place, such as a European Commission adequacy decision, Standard Contractual Clauses or another safeguard recognised under the GDPR.

Photographs, Videos and Testimonials

Photographs, videos or testimonials relating to events may be used on the website, portfolio, social media profiles or promotional materials only where THE CONTROLLER has an appropriate legal basis and, where required, has obtained the necessary authorisation.

Authorisation may be withdrawn by contacting THE CONTROLLER. Withdrawal will not affect any processing or publication lawfully carried out before the request was received.

User Rights

Users may exercise the following data protection rights, where applicable:

The right to access their personal data.
The right to rectify inaccurate or incomplete data.
The right to request deletion of their data.
The right to request restriction of processing.
The right to object to processing based on legitimate interests or direct marketing.
The right to request data portability.
The right to withdraw consent at any time.
The right not to be subject to a decision based solely on automated processing where it produces legal or similarly significant effects.

Rights may be exercised by sending a request to info@bbqchefsander.nl or to the postal address indicated in the Data Controller section.

The request should clearly identify the right being exercised and include sufficient information to verify the identity of the requester. Additional identification may only be requested where there are reasonable doubts concerning the requester’s identity.

Right to Lodge a Complaint

If a user believes that their personal data has not been processed correctly or that their request has not been satisfactorily addressed, they may lodge a complaint with the Spanish Data Protection Agency:

Spanish Data Protection Agency — Agencia Española de Protección de Datos (AEPD)
Edificio Cuzco IV
Paseo de la Castellana, 141, planta 9
28046 Madrid, Spain
Website: www.aepd.es

Data Security

THE CONTROLLER applies appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss, disclosure or destruction, taking into account the nature of the data, the context of the processing and the risks involved.

However, users should be aware that no method of transmitting information over the internet can guarantee absolute security.

Automated Decision-Making

Personal data is not used to make decisions based solely on automated processing that produce legal or similarly significant effects for the user.

Children’s Privacy

This website and its services are not directed at children under the age of 14. Personal data from children under this age should not be provided without the authorisation of their parents or legal guardians.

Third-Party Websites and Social Media

The website may contain links to third-party websites or social media platforms. THE CONTROLLER is not responsible for the privacy practices of those external services. Users should review the privacy policies of the relevant third parties before providing personal information.

Changes to This Privacy Policy

THE CONTROLLER may update this Privacy Policy to reflect legal, technical or operational changes. The latest version will always be published on this website, together with its date of publication.

Date of last publication: 19 July 2026