Privacy and cookies policy

diegoschatten.com is a static site: it has no comments, no user accounts, no shop, and it does not set any cookies of its own. It only processes personal data when someone fills in one of its two forms, and it only loads third-party content once the visitor consents to it.

Controller and the data we process

Controller: Diego Schattenhofer
Business address: Hotel Villa Cortés
Avenida Rafael Puig, 38
38660 Playa de Las Américas · Tenerife
Website: diegoschatten.com
Contact: Contact form
Updated: 26 September 2026

The controller responsible for the personal data collected on this website is Diego Schattenhofer, executive chef of Hotel Villa Cortés and of the Taste 1973 restaurant, with business address at Hotel Villa Cortés, Avenida Rafael Puig, 38, 38660 Playa de Las Américas (Tenerife, Spain). For any question about this policy, including exercising your rights, the channel is this site's own contact form.

This processing is governed by Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR), by Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD) and, as regards cookies and third-party content, by article 22.2 of Law 34/2002 on information society services and electronic commerce (LSSI-CE).

What this site is, technically

diegoschatten.com is a static site: its pages are generated before publication and served as finished files. There is no visitor database, no private area, no login, no comments, no shopping basket and no payment gateway. Browsing the site does not require you to provide any personal data.

Hosting is provided by Netlify, Inc. (San Francisco, United States), which acts as data processor. Like any web server, its infrastructure automatically logs the technical data of each request — IP address, date and time, page requested, user agent — in order to serve the pages, measure usage and defend the site against attacks and abuse. The legal basis for that technical logging is the controller's legitimate interest in keeping the site available and secure (article 6.1.f GDPR). You can read Netlify's privacy terms (opens in a new tab) and its trust centre (opens in a new tab).

As Netlify is established in the United States, hosting and receiving form submissions involve an international transfer of data outside the European Economic Area. That transfer relies on the standard contractual clauses approved by the European Commission, which Netlify includes in its data processing addendum, together with the supplementary technical and organisational measures described in it.

What this site does NOT do

No third-party analytics. No Google Analytics, no Tag Manager, no advertising pixels, no heatmaps, no AdSense. The only measurement tool in use is Google Search Console, which reports how the site appears in search based on Google's own crawl data: it installs nothing in your browser and places no tag on these pages.
No profiling and no automated decisions are made that produce legal effects on individuals.
No mailing lists are bought or rented, and no one is added to the newsletter without having asked for it themselves.
Data is never sold or passed on to third parties. Only the providers strictly necessary to deliver the service, described below, have access to it, along with public authorities or courts where there is a legal obligation to do so.

The site's forms

The site has exactly two forms, and both are optional. They are submitted through Netlify Forms, the form-handling feature of the hosting itself: no additional third-party service is involved, and submissions are received in the Netlify admin panel and by email in the controller's inbox.

Data requested: Email address and the tick of the consent checkbox.
Purpose: To email the site's news: research, Canarian produce and what is coming up.
Legal basis: Consent of the data subject (article 6.1.a GDPR and article 21 LSSI-CE).
Retention: Until you unsubscribe. After that, only the minimum data needed to prove the unsubscription and avoid writing to you again is kept.

Contact

Data requested: Name, email address, reason for the message and the message itself.
Purpose: To read and reply to the enquiry, and manage any relationship arising from it.
Legal basis: Consent of the data subject when submitting the form (article 6.1.a GDPR) and, for handling the enquiry, the controller's legitimate interest (article 6.1.f).
Retention: The time needed to handle the enquiry and, afterwards, the period during which liabilities could arise from it; it is then deleted.

The fields marked as required are the ones strictly necessary for the stated purpose. If you do not provide them, the request cannot be handled.

Who processes this data on our behalf

Netlify, Inc. — site hosting and receiving the forms (international transfer covered by standard contractual clauses, as explained above).
Whichever newsletter-sending service we use, currently Resend (Resend's privacy policy (opens in a new tab)) — sending the newsletter emails and handling unsubscriptions. If that provider were to change, this page would be updated before the first send with the new one.
The controller's email provider — receiving and storing the messages that arrive through the contact form.

All of them process the data following the controller's instructions, under a data processing agreement in force, and none of them use it for their own purposes.

Minimum age

The forms on this site are intended for people over 14, the minimum age to consent to the processing of personal data in Spain (article 7 LOPDGDD). If we become aware of data belonging to someone under that age, we will delete it as soon as we learn of it.

Unsubscribing from the newsletter

Every newsletter email includes a one-click unsubscribe link, with no need to give a reason and at no cost. You can also request to unsubscribe through the contact form. Unsubscribing is immediate and does not affect the lawfulness of the earlier processing.

Accuracy and security

Whoever fills in a form is responsible for the data provided being their own, accurate and up to date. Forms are submitted encrypted over HTTPS and carry an anti-spam trap (honeypot) that discards automated submissions. Reasonable technical and organisational measures have been put in place to prevent the loss, misuse, alteration and unauthorised access to the data, bearing in mind the state of the art and the nature of the information processed, which is minimal and limited to contact details.

Cookies and third-party content

Cookies are small files that a website stores on a visitor's device to recognise them on later visits. Alongside them, browsers offer other local storage with a similar effect, such as localStorage. This policy covers both.

This site does not set any cookies of its own

diegoschatten.com does not set any cookies of its own: there are no sessions, no user preferences remembered in cookies, no analytics and no advertising. The only thing the site stores in your browser is a single local-storage entry with your decision about third-party content, so as not to ask you again on every page.

ds-consentimiento

Where it is stored: In your browser's local storage (localStorage). It is not a cookie and it is never sent to any server.
What for: To remember whether you accept third-party content ("all") or only what is essential ("essential only"), so as not to show you the notice on every page.
What it contains: A single word with your decision. No data that identifies you, no tracking identifier.
Duration: Until you change your decision or clear this site's data in your browser. It does not expire on its own.

If you browse in private mode or with storage blocked, the site still works: your decision applies to that page only and is not remembered.

Third-party content is blocked until you accept it

Some pages and posts include YouTube videos (Google Ireland Limited and Google LLC). When loaded, this content can set third-party cookies and collect browsing data on Google's behalf.

That is why they do not load on their own. Instead, a placeholder appears with the content's title and a button, and the video does not even exist on the page until you request it: no request is made to Google, and no thumbnail is downloaded. There are two ways to watch them:

Accept in the notice that appears on your first visit: from then on, third-party content loads on its own across the whole site.
Click the button on a specific piece of content: only that one loads, for that visit, and no decision is saved.

When you load one of these items, Google's processing of your data is governed by its own policy: you can read it at policies.google.com/privacy (opens in a new tab). The videos are also served from the youtube-nocookie.com domain, YouTube's privacy-enhanced mode. The legal basis for this loading is your consent (article 6.1.a GDPR and article 22.2 LSSI-CE).

How to change your decision

Withdrawing consent is as easy as giving it. The button below brings the notice back up so you can choose again; if you choose "Essential only", any third-party content already loaded is removed from the page immediately, without waiting for your next visit. You can reach this page at any time from the "Privacy policy" link in the footer of every page on the site.

You can also delete the data the site has stored in your browser — which removes the ds-consentimiento entry and returns the site to its initial state, with all third-party content blocked — from your browser's settings:

Google Chrome: Settings › Privacy and security › Cookies and other site data
Mozilla Firefox: Settings › Privacy & Security › Cookies and Site Data
Safari: Settings › Privacy › Manage Website Data
Microsoft Edge: Settings › Cookies and site permissions › Cookies and site data

Declining third-party content does not limit anything on the site: every text, photograph and piece of data remains available, and every blocked video offers a link to watch it directly on YouTube if you prefer.

Links that lead away from this site

The site links to social media profiles (Instagram, Facebook and YouTube), to media outlets and institutions cited in the press section, and to the Taste 1973 booking system, which is run by Europe Hotels International (opens in a new tab). Those links open on the third party's own website and, from that moment, your data is handled by that third party under its own terms: nothing is shared with you, and nothing is received, simply by clicking the link. Restaurant bookings are not processed on diegoschatten.com.

Your rights

The GDPR and the LOPDGDD grant you the following rights over your personal data, and exercising them is free of charge:

Access: to know what data of yours is being processed and to obtain a copy.
Rectification: to correct inaccurate data or complete incomplete data.
Erasure: to ask for it to be deleted once it is no longer necessary (the "right to be forgotten").
Objection: to object to processing based on legitimate interest.
Restriction of processing: to ask for the data to be kept but not used while a complaint is being resolved.
Portability: to receive the data you provided us in a structured, commonly used format.
Withdraw your consent at any time, without affecting the lawfulness of the earlier processing: unsubscribing from the newsletter and the cookie notice are the two direct ways to do it.

How to exercise them

Write through the contact form stating which right you want to exercise and, if you are writing from an address different from the one you used before, some detail that allows us to identify you; proof of identity may be requested if there is reasonable doubt about who is making the request. You can also write to the business address given at the top of this page. The request will be answered within one month of receipt, extendable by a further two months where the complexity justifies it, and you will be told if it is extended.

Complaining to the supervisory authority

If you believe that the processing of your data does not comply with the law, or that your request has not been handled properly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), the competent supervisory authority: C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es (opens in a new tab).

Changes to this policy

This policy may be updated to reflect technical changes, new providers or new legislation. The version in force is always the one published on this page, with its last-updated date shown: 26 September 2026. If a change were to substantially affect your data or require new consent, that consent would be requested before it is applied.