Privacy & Security
Last updated · June 2026
Es Mercat is operated by Malohi Asociacion and The Culture Club. This page explains what data we collect, how it is stored, and the controls we use to keep it safe.
Data we collect
- Booking details (name, email, brand, optional website) submitted via the reservation form.
- Contact form messages.
- Newsletter subscriptions (email only).
- Anonymous page-view analytics (path, referrer, country).
Payments
All payments are processed by Stripe. We never see or store full card numbers, CVCs, or bank credentials. Stripe is PCI-DSS Level 1 certified.
Access controls
- Row-Level Security is enabled on every database table.
- Administrative actions require an authenticated admin account; admin roles are stored in a dedicated table and verified server-side.
- Direct-booking links contain a server-side secret token; links cannot be guessed.
- Outbound transactional emails are admin-only and signed with SPF/DKIM on our verified sending domain.
Your rights
You can request a copy or deletion of your personal data at any time by emailing info@esmercat.net. Newsletter emails include a one-click unsubscribe link.
Reporting a security issue
If you believe you have found a vulnerability, please email info@esmercat.net with details. We will respond within 5 business days.