PRIVACY POLICY

LAST UPDATED: 21 SEPTEMBER 2026

The purpose of this Privacy Policy is to inform you about the processing of your personal data by Trópico, setting out the data collected, the purposes for which it is used, the recipients to whom it is disclosed and the rights available to you. This processing is governed by Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation) and by Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights.

Who is the Data Controller of your personal data?

The owner of the website https://www.tropicobcn.com (hereinafter, the “Website”) and of the restaurants operating under the trade name “Trópico”, located at Carrer de Balmes, 24 and Passeig de Joan de Borbó, 15, both in Barcelona, is the following company:

SAMBA BARCELONA, S.L.
Spanish tax ID: B72538135
Registered office: Carrer de Balmes, 24, bajo, local 1, 08007 Barcelona
Registered with the Commercial Registry of Barcelona, Volume 48.503, Folio 155, Section 8, Sheet B-586233
Email: info@tropicobcn.com

For the purposes of this Privacy Policy and the other Legal Notices of the Website, the aforementioned company SAMBA BARCELONA, S.L. is referred to as “Trópico”.

What personal data do we collect and how do we obtain it?

Trópico processes the personal data that you provide yourself, as well as the data obtained from your visit to the restaurants and from browsing the Website, through the following channels:

Table booking. The Website incorporates the CoverManager booking system. When you make a booking, you provide your name and surname, telephone number, email address, number of guests, date and time of the booking and, where applicable, allergies, intolerances or other remarks relating to your visit.
Booking guarantee. In certain cases, confirmation of the booking requires you to enter debit or credit card details as a guarantee. Those details are provided directly in the secure environment of the payment gateway, without Trópico having access to the full card number or storing it. Trópico only knows that the booking is secured by a guarantee and, where applicable, the outcome of the charge for late cancellation or no-show, which is processed through the gateway itself.
Group and event enquiries. For groups of more than eight guests, you provide your contact details and the details of your enquiry.
Direct communications. When you contact Trópico by email, telephone or WhatsApp.
Newsletter. When you subscribe voluntarily, providing your email address.
Social media. When you follow Trópico’s profiles, interact with its posts or contact Trópico by message.
CCTV. The restaurants have CCTV cameras, duly signposted by means of the required information signs, which capture your image during your visit.
Browsing the Website. Technical data is collected through cookies and similar technologies, as described in the Cookie Policy.

The fields marked as mandatory on any form are necessary in order to deal with your request; if they are not completed, Trópico will not be able to process it. You warrant that the data provided is truthful and up to date, and you are liable for any harm arising from the disclosure of false or inaccurate data.

For what purposes do we process your personal data?

To manage and confirm the booking requested, and to serve you during your visit to the restaurant.
To take into account the allergies, intolerances or preferences you inform us of when preparing your food.
To apply the booking terms in force, including those relating to late cancellation and no-show.
To deal with enquiries, requests for information and requests for quotations for groups and events.
To send marketing communications about Trópico’s news, promotions and activities, where you have subscribed to the newsletter.
To manage Trópico’s presence on social media and respond to your interactions.
To ensure the safety of people and property at the restaurants by means of CCTV systems.
To comply with the applicable legal, tax and accounting obligations.

Trópico does not make automated decisions or carry out profiling using your personal data.

What is the legal basis for processing your data?

Performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR): managing the booking, serving you at the restaurant and applying the booking terms.
Your consent (Article 6(1)(a) GDPR): sending the newsletter, processing data relating to allergies and intolerances and the placing of non-essential cookies. You may withdraw your consent at any time, without this affecting the lawfulness of the processing carried out prior to its withdrawal.
Trópico’s legitimate interests (Article 6(1)(f) GDPR): dealing with enquiries, managing social media and ensuring the safety of people and property by means of CCTV.
Compliance with a legal obligation (Article 6(1)(c) GDPR): the tax, accounting and any other obligations applicable to Trópico.

Data relating to allergies and intolerances is regarded as data concerning health. Providing it is voluntary and it is processed for the sole purpose of ensuring your safety during your visit.

How long will we keep your data?

Bookings, enquiries and group requests: for as long as our relationship with you continues and, thereafter, for the limitation periods laid down by law. As a general rule, five years for contractual liability and six years for accounting and tax records.
Data relating to allergies and intolerances: for the time strictly necessary to provide the service.
Newsletter: until you ask to unsubscribe, which is possible through a link in every email.
CCTV: for a maximum of one month from the time of recording, unless the footage must be kept in order to evidence events affecting the safety of people or property or at the request of a competent authority.
Social media: for as long as you maintain your relationship with Trópico’s profiles.
Cookies: for the periods set out in the Cookie Policy.

To which recipients will your data be disclosed?

The provider of the booking system and the provider of the newsletter email platform, which act as data processors under the corresponding agreement.
The providers of web hosting, email and IT services, which act as data processors under the corresponding agreement.
Banks and payment gateways, for the purpose of managing the booking guarantee.
Public authorities, law enforcement agencies and the courts, where there is a legal obligation to do so.

Trópico does not disclose or sell your personal data to third parties for commercial purposes.

Is your data transferred outside the European Economic Area?

As a general rule, data is processed within the European Economic Area. However, some of the technology providers used by Trópico — in particular Mailchimp, Google Maps, web analytics services and social media platforms — may involve international data transfers. Those transfers are carried out on the basis of adequacy decisions of the European Commission or by entering into standard contractual clauses, which ensure a level of protection equivalent to that required by European legislation. Detailed information is available in the Cookie Policy.

Does the Website use cookies?

The Website uses first-party and third-party cookies for technical, preference, analytics and advertising purposes, as described in the Cookie Policy, which is permanently accessible from the footer.

You may accept or reject non-essential cookies via the cookie banner, and change your choice at any time via the “Cookie settings” link in the footer.

What are your rights when you provide us with your personal data?

You may exercise, free of charge and at any time, your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw the consent you have given.

To do so, simply send a request to info@tropicobcn.com or by post to Carrer de Balmes, 24, bajo, local 1, 08007 Barcelona, stating the right you wish to exercise and enclosing a copy of your identity document. Trópico will respond within a maximum of one month from receipt of the request.

Trópico is not required to appoint a Data Protection Officer.

If you consider that your request has not been dealt with properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es), the competent supervisory authority for data protection.

What security measures do we take to protect your personal data?

Trópico has implemented the technical and organisational measures necessary to ensure the security of personal data and to prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data and the risks to which it is exposed.

These include limiting access to the data to staff who need it to perform their duties, providers being bound by data processing and confidentiality agreements, and the whole Website operating over an encrypted connection (https).

May minors provide us with their personal data?

The Website’s services are aimed at persons aged fourteen or over. Anyone under the age of fourteen must have the authorisation of their parents or guardians in order to make a booking or send any communication to Trópico. Trópico is not responsible for data provided by children under the age of fourteen without such authorisation and will delete it as soon as it becomes aware of this.

May we amend this Privacy Policy?

Trópico may amend this Privacy Policy in order to adapt it to legislative or case-law developments, as well as to changes to its business. The version in force will in all cases be the one published on this page, which shows the date of its last update at the top.

The Legal Notices of the Website are this Privacy Policy and the Cookie Policy, permanently available in the footer. The identifying information about Trópico required by information society services legislation appears in the “Data Controller” section of this Privacy Policy.