Privacy Policy
Last updated: 15 July 2026
This Privacy Policy explains how Ulu Tapas Bar (“Ulu Tapas Bar”, “we”, “our” or “us”) collects, uses, stores, shares and protects your personal data when you visit https://ulubar.nl, contact us or make a reservation. It has been prepared with the requirements of the General Data Protection Regulation (EU) 2016/679 (GDPR) in mind.
1. Data Controller
Ulu Tapas Bar
Voorstraat 102
3512 AV Utrecht
Netherlands
Email: info@ulubar.nl
2. Scope
This policy applies to visitors of our website, customers making reservations through our website, TheFork or Google Business Profile, and anyone contacting us by email or telephone.
3. Personal Data We Collect
We may collect your name, email address and telephone number when you submit a group reservation enquiry or contact us. We also collect technical information such as IP address, browser type, device information, pages visited, referring website, date and time of access and similar analytics data through Google Analytics 4. Reservation platforms such as TheFork and Google Business Profile may collect additional information under their own privacy policies.
4. How We Collect Data
Personal data is collected directly from you when you complete our reservation form, email us or otherwise contact us. Technical information is collected automatically through cookies and similar technologies after consent where required.
5. Purposes of Processing
We use personal data to respond to enquiries, process and manage reservations, communicate regarding
bookings, maintain customer service, improve our website, analyse website performance, maintain website security, comply with legal obligations and protect our legitimate business interests. In particular, we use your personal data for the following purposes:
- To measure and improve advertising performance: We may use aggregated and pseudonymised information collected through Google Analytics and Google Ads technologies to understand the effectiveness of our advertising campaigns, improve our marketing activities, and optimise our Website.
6. Legal Basis
We process personal data under Articles 6(1)(a), 6(1)(b), 6(1)(c) and 6(1)(f) GDPR, namely consent, performance of a contract or pre-contractual steps, legal obligations and legitimate interests. Where consent is relied upon, you may withdraw it at any time without affecting previous lawful processing.
7. Cookies
Our website uses essential cookies necessary for website functionality and analytics cookies through Google Analytics 4. Non-essential cookies are only placed after consent via our cookie banner. You may modify or withdraw your cookie preferences at any time.
Advertising and Analytics Technologies
We use Google Analytics 4 to better understand how visitors interact with our Website and to improve the user experience. We may also use Google Ads for conversion measurement and advertising campaign optimisation, to measure the effectiveness of our advertising campaigns and to measure the effectiveness of our advertising campaigns and improve our marketing activities.`
Where required by applicable law, including the General Data Protection Regulation (GDPR) and the ePrivacy rules applicable within the European Economic Area (EEA), non-essential cookies and similar technologies used for analytics and advertising are only activated after you have provided your consent through our cookie consent banner.
We use Google’s Consent Mode, where applicable, to communicate your consent choices to Google services. This helps ensure that Google Analytics and Google Ads operate in accordance with your consent preferences.
You may manage cookies through your browser settings. Where a cookie consent mechanism is available, you may also update your preferences through that mechanism. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
8. Third-Party Services
We use trusted third-party service providers to operate and maintain our Website and to deliver certain services. These include:
- Google Analytics 4 for website analytics and performance measurement.
- Google Ads for conversion measurement and advertising campaign optimisation, where applicable.
- Our website hosting provider.
Reservations made through TheFork or Google Business Profile are processed in accordance with the privacy policies of those respective platforms.
These providers may process personal data on our behalf or as independent controllers in accordance with their own privacy policies.
For more information about how Google processes personal data, please refer to:
Google Privacy Policy:
https://policies.google.com/privacy
How Google uses information from sites and apps:
9. International Transfers
Some of our service providers, including Google, may process personal data on servers located outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are implemented in accordance with the GDPR. These safeguards may include the European Commission’s Standard Contractual Clauses (SCCs), adequacy decisions, or other lawful transfer mechanisms.
10. Data Retention
Reservation enquiries submitted through our website are retained for up to 12 months unless a longer period is required by law or necessary for resolving disputes. Email correspondence is retained only as long as reasonably necessary. Analytics information is retained according to the retention settings configured within Google Analytics. Personal data is securely deleted or anonymised
when no longer required.
11. Sharing of Personal Data
We do not sell personal data. We may disclose information to carefully selected service providers acting on our behalf, competent public authorities where legally required, professional advisers, or in connection with a business reorganisation where
permitted by law.
12. Security
We implement appropriate technical and organisational
measures designed to protect personal data against unauthorised access, alteration, disclosure or destruction. Despite these measures, no internet transmission or storage system can be guaranteed to be completely secure.
13. Your GDPR Rights
You have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, objection to processing, data portability, and withdrawal of consent where applicable. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
14. Children’s Privacy
Our services are not directed to children under the age of 16 and we do not knowingly collect personal data from children.
15. Third-Party Links
Our website may contain links to external websites. We are not responsible for the privacy practices or content of those third-party websites.
16. Changes to this Policy
We may update this Privacy Policy periodically to reflect legal, technical or operational changes. The latest version will always be published on our website with the revised ‘Last updated’ date.
17. Contact
For privacy requests or questions regarding this Privacy Policy, please contact:
Ulu Tapas Bar
Voorstraat 102
3512 AV Utrecht
Netherlands
Email: info@ulubar.nl
We aim to respond to GDPR requests within the applicable statutory timeframes.
Summary of Your Rights
- Access the personal data we hold about you.
- Request correction of inaccurate or incomplete information.
- Request deletion where legal requirements permit.
- Object to or restrict processing in certain circumstances.
- Receive your data in a portable format where applicable.
- Withdraw consent at any time.
- Lodge a complaint with the Autoriteit
- Persoonsgegevens.
This Privacy Policy is intended for publication on the Ulu Tapas Bar website and should be reviewed whenever new services, marketing technologies or reservation systems are introduced.