Privacy policy

The controller of data collected on the site is:

Company name

MEXICAN TOUCH (SAS)

Address

31 rue Saint Sauveur, 75002 Paris, France

Email

mexicantouch.fr@gmail.com

Depending on what you do on the site, we process the following data:

• Table booking: name, e-mail, phone (optional), date, time, party size and any note, to record the booking, send you the confirmation and organise the service. The team also records whether the booking was honoured.
• Event booking: name, e-mail, phone (optional), number of seats, note and language, for the booking, its confirmation, a reminder the day before, the link that lets you cancel and, where relevant, tracking payment at the restaurant.
• Contact form (question, group, private hire, press): name, e-mail, phone (optional), message and, for a group or private hire, the date, time and number of guests, to reply to you. The message is kept in our internal inbox and also sent to us by e-mail.
• Job application: name, e-mail, message and CV (PDF or Word), kept in a private space, to consider your application.
• News and offers (optional): if you tick the box when booking, your e-mail to send you our news. You can unsubscribe at any time.
• Customer file: every booking with an e-mail creates or updates a record (name, e-mail, phone, language, booking and visit history) so we can recognise you and handle your requests.
• Event co-organisers: name and e-mail of the people invited to manage an event’s bookings, and the date of their last login.
• Security: IP address of login attempts to the restricted areas (to block attacks) and the host’s technical logs.

Each processing relies on one of the following bases:

• performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR): table and event bookings, confirmations, reminders and cancellation;
• your consent (Article 6(1)(a)): news and offers by e-mail, job applications and CVs, display of Google reviews. You can withdraw it at any time;
• our legitimate interest (Article 6(1)(f)): replying to your messages, keeping the customer file and visit history, securing the site and its restricted areas.

• Table and event bookings, customer record: 3 years after your last booking or your last contact with us.
• News and offers: until you unsubscribe, and at most 3 years after your last contact with us.
• Contact form messages: 12 months.
• Job applications and CVs: 24 months at most, unless you ask us to delete them earlier.
• Event co-organisers: for the duration of the access (92 days at most), then deleted with the event or on request.
• Login attempts to the restricted areas: 24 hours.

Your data is never sold or rented. Only the following have access to it:

• the team of Hacienda Malinche Paris, as needed (floor staff, management);
• co-organisers of an event, for that event’s bookings only;
• our processors, acting on our instructions: Supabase (database and files, servers in the European Union, in Ireland), Vercel (website hosting, United States), Resend (e-mail delivery, United States) and, only if you accept it, Elfsight (display of Google reviews).

Transfers to providers in the United States are covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses. If you book through TheFork, TheFork processes your data under its own privacy policy.

Under Articles 15 to 22 of the GDPR, you have the following rights:

• right of access to your data;
• right of rectification of inaccurate data;
• right to erasure ("right to be forgotten");
• right to restriction of processing;
• right to portability;
• right to object to processing;
• right to lodge a complaint with the CNIL (cnil.fr).

To exercise these rights or withdraw your consent, write to mexicantouch.fr@gmail.com. To stop receiving our news, use the “Unsubscribe” link included in each of those e-mails, or write to us. We will reply within one month.

We apply appropriate technical and organisational measures: HTTPS encryption, a database that cannot be reached from the browser, restricted areas protected by a code with lock-out after several failed attempts, and CVs kept in a private space that can only be downloaded through a temporary link.