Privacy Notice

Who is responsible for your data

Donde Onde Where is a publication of booteek AI Limited, which is the data controller for everything described in this notice.

What we publish, and where it comes from

DOW ranks independent restaurants and bars using data that Google already publishes: business names, addresses, categories, opening hours, star ratings, review counts and review text. We do not collect this from you, and we do not buy it from a data broker. Our method is described in full on our methodology page.

Where we quote a review, we show the text as written and attribute it to the reviewer's initials only. We never publish a reviewer's full name, profile photo, profile link or any other identifier, and we never contact reviewers.

Our lawful basis for publishing this material is legitimate interests: operating a public-interest guide to independent hospitality, using information that is already public, in a way a reasonable person would expect. You can object at any time — see Your rights below.

What we collect from you

Browsing the site

Nothing that identifies you. We run no analytics product, no tag manager, no advertising pixel and no session tracking, and we set no cookies for those purposes. Our hosting and network providers keep short-lived server logs, including IP addresses, to deliver pages and to defend against attacks and abuse. That is a legitimate interest, and those logs are not used to build a profile of you.

Images loaded from other companies

Venue photography is served from Google (googleusercontent.com, maps.googleapis.com, places.googleapis.com), Wikimedia and Cloudinary. When a page renders, your browser requests those images directly from those companies, and they will see your IP address and browser details as a result. We do not control what they then do with it; their own privacy notices govern that.

Claiming a venue listing

If you represent a venue and we invite you to claim its listing, the claim form asks you to confirm the venue's postal address and choose a delivery format. We store your answers against that claim so we can send the item. The form is reachable only through a private link addressed to you; there is no public sign-up. The lawful basis is performance of the arrangement you entered into by claiming.

Who we share it with

We do not sell personal data, and we do not share it for advertising. We use service providers who process data on our behalf, under contract and on our instructions only: hosting and database infrastructure, content delivery and security, image delivery, and email. Some of these operate outside the UK and EEA; where they do, transfers are covered by UK International Data Transfer Agreements or Standard Contractual Clauses.

How long we keep it

Server logs are kept for a short operational period and then discarded. Venue claim records are kept while the listing is active and for as long as we need them for our accounting and legal obligations. Published venue and review data is refreshed monthly, and superseded data is replaced rather than accumulated.

Your rights

Under UK GDPR and the EU GDPR you can ask us for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict how we use it, and object to our use of it — including to our publishing a quote or profile that concerns you. Email [email protected] and we will respond within one month.

Venue owners: if you would rather your venue was not listed, tell us and we will remove it. You do not need to give a reason.

If you think we have handled your data badly, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the supervisory authority in your own country — the CNPD in Portugal, or the AEPD in Spain.

Changes to this notice

If we change how we handle data, we will update this page and change the date at the top. This notice was last updated on 9 September 2026. Our terms of use cover the rest of your relationship with the site.