Privacy policy

Data controller

We process your data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the protection of personal data and digital rights (LOPDGDD).

This page is a translation. If the English and Spanish versions differ, the Spanish version applies.

What data we process

• Contact details: first name, last name, email and phone.
• Delivery address, postcode and notes for the driver.
• If you buy as a business: company name, NIF/CIF and billing address.
• Order data: products, amounts, delivery day and slot, order status.
• If you create an account: email, encrypted password, saved addresses and order history.
• Technical data about your visit, such as IP address and browser, which the server logs for security.

Your card details are handled by Stripe directly. We never see or store them: we only receive the result of the payment.

What we use it for and on what legal basis

• Handling your order: charging it, preparing it, delivering it on the day and in the slot you chose and emailing you about its status. Legal basis: performance of the contract (art. 6.1.b GDPR).
• Running your customer account, if you create one. Legal basis: performance of the contract.
• Telling our team about each new order by email and Telegram so they can plan the delivery. Legal basis: performance of the contract.
• Planning delivery routes, for which we work out the coordinates of your address. Legal basis: performance of the contract.
• Issuing and keeping invoices and meeting other tax and accounting obligations. Legal basis: legal obligation (art. 6.1.c GDPR).
• Preventing payment fraud and protecting the site. Legal basis: legitimate interest (art. 6.1.f GDPR).

We do not send you advertising or newsletters.

How long we keep it

Order data and invoices are kept for six years, as required by article 30 of the Spanish Commercial Code, plus any longer period set by tax rules. Account data is kept while your account is open. If you ask us to delete it, we block the data the law requires us to keep until that period ends, and then delete it.

Who else processes your data

We work with these providers. They process data on our behalf and only to provide their service:

• Stripe Payments Europe, Ltd. (Ireland): card, Apple Pay and Google Pay payments.
• Hetzner Online GmbH (Germany): servers that run the shop and the database.
• Cloudflare, Inc. (USA): DNS, site delivery, images and backups.
• Resend, Inc. (USA): sending emails about your order and your account.
• Functional Software, Inc. (Sentry, USA; data stored in the EU, Frankfurt): technical error reports from the site. Email addresses, phone numbers, IP addresses and cookies are removed before the report is sent.
• Geoapify GmbH (Germany): turns the delivery address into coordinates for route planning.
• Telegram: internal notifications to our team about new orders, with the details needed for delivery.
• OpenFreeMap: shows the delivery area map and receives your browser's IP address when the map loads.

Some of these providers are outside the European Economic Area. In those cases the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses (art. 46 GDPR). We do not share your data with anyone else unless the law requires it.

Your rights

You can ask us for access to your data, to correct or delete it, object to its processing, restrict it, or receive it in a format you can take to another service.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Children

The shop is not aimed at children under 14. You must be of legal age to buy.

Cookies

We only use technical cookies. You will find them, with their purpose and duration, in the Cookie policy.