Privacy and Cookie Policy
Last updated: 22 August 2026
This policy explains what data the restaurant A Toca collects through the site atoca.food, why it collects it, and what you can do about it. It is written under the General Data Protection Regulation (GDPR) and Portuguese Law no. 58/2019.
1. Who is responsible for your data
The data controller is the restaurant A Toca:
- Address: Rua Cândido dos Reis 93, Cacilhas, 2800-270 Almada, Portugal
- Phone: +351 212 764 183
- WhatsApp: +351 912 070 333
- E-mail: [email protected]
2. What data we collect
When you contact us. If you write to us via WhatsApp, e-mail or a form, or if you call us, we keep whatever you give us: name, phone number or e-mail, and the content of the message — usually a date, time and number of people for a booking. We do not ask you for anything beyond that.
When you browse the site. The server automatically logs your IP address, browser type and the page visited, as happens on any website. If you allow analytics or marketing cookies, we also collect usage data through the tools described in section 5.
We do not collect special category data (health, beliefs, ethnic origin) and we do not knowingly collect data from minors.
3. What we use the data for, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Answering messages and handling bookings | Name, contact, message content | Pre-contractual steps, Art. 6(1)(b) |
| Keeping the site secure and operational | IP, technical logs | Legitimate interest, Art. 6(1)(f) |
| Understanding how the site is used | Aggregated browsing data | Consent, Art. 6(1)(a) |
| Measuring campaigns and advertising | Marketing identifiers | Consent, Art. 6(1)(a) |
Where the basis is consent, you may withdraw it at any time — see section 6 — without affecting the lawfulness of processing carried out beforehand.
4. Who we share it with
We do not sell or rent your data. We rely on service providers that process data on our behalf:
- Cloudflare Pages — site hosting.
- Google Ireland Ltd. — Google Analytics 4 and Google Tag Manager, only if you allow analytics or marketing cookies.
- Meta Platforms Ireland Ltd. — WhatsApp, if you choose to reach us through that channel.
Some of these providers may process data outside the European Economic Area. In those cases the transfer relies on the Standard Contractual Clauses approved by the European Commission, or on an applicable adequacy decision.
5. Cookies
Cookies are small files the site stores on your device. We use them in three groups, and only the first one needs no permission.
Strictly necessary
Always on. They store your language choice and your cookie decision itself, so we do not have to ask on every page. The site does not work properly without them.
| Cookie | Purpose | Duration |
|---|---|---|
cc_cookie | Records the categories you allowed | 6 months |
Analytics
Only installed if you allow them. They count visits and show which pages are read most, in aggregate.
| Cookie | Purpose | Duration |
|---|---|---|
_ga, _ga_* | Distinguishes visitors in Google Analytics 4 | 2 years |
_gid | Distinguishes visitors | 24 hours |
_gat | Throttles the request rate | 1 minute |
Marketing
Only installed if you allow them. They let us measure campaign results and tailor ads on other sites.
| Cookie | Purpose | Duration |
|---|---|---|
_gcl_* | Attributes conversions to Google Ads campaigns | 90 days |
_fbp | Meta campaign measurement | 90 days |
Until you allow them, we apply Google’s Consent Mode v2: tags load in a denied state and write no cookies and send no identifiers. They only switch to granted after you say so in the banner.
6. Changing or withdrawing your permission
You can review your choices whenever you like:
Alternatively, you can delete or block cookies in your browser settings. Note that blocking the necessary ones may stop parts of the site from working.
7. How long we keep it
Messages and booking requests stay with us for as long as the contact lasts and for up to 2 years afterwards, so we can pick up the history if you write again. Analytics data follows the retention periods configured in Google Analytics, up to a maximum of 14 months. Technical logs are deleted after 30 days.
8. Your rights
You have the right to access your data, correct it, erase it, restrict or object to processing, and receive it in a portable format. To exercise any of these, write to [email protected] — we reply within one month.
If you believe we have not handled the matter properly, you may lodge a complaint with the Portuguese Data Protection Authority (CNPD), at cnpd.pt.
9. Changes to this policy
If we change how we handle data, we update this page and the date at the top. If the change involves new purposes requiring consent, we will ask for your permission again through the banner.