Privacy Policy

1. Data controller

2. Personal data we collect

At LaMaruja Bakery we only collect the data necessary to provide our services and manage our relationships with customers. Depending on how you interact with us, we may process the following data:

Data you provide to us directly

• First and last name — when you contact us by email or WhatsApp
• Phone number — when you start a WhatsApp conversation
• Email address — when you write to us at info@lamarujabakery.es
• Order details — products, dates, special instructions, delivery address if applicable
• Business details — if you are a B2B customer (company name, tax ID, billing address)

Data collected automatically

• Browsing data — IP address, browser type, pages visited, session duration (via Google Analytics, if enabled)
• Cookies — see our Cookie Policy

We do not collect specially protected data (health, ideology, ethnic origin, etc.), nor do we intentionally process data from children under 14.

3. Purposes of processing and legal basis

Order management and business relationship

We process your data to prepare, manage and deliver your order, issue invoices and resolve any related issues. The legal basis is performance of a contract (Art. 6.1.b GDPR).

Customer service

When you contact us by email or WhatsApp, we process the data you provide in order to respond to your query. The legal basis is legitimate interest (Art. 6.1.f GDPR) and, where applicable, your consent (Art. 6.1.a GDPR).

Compliance with legal obligations

We retain billing and accounting data for the legally established period (generally 5 years). The legal basis is compliance with a legal obligation (Art. 6.1.c GDPR).

Website improvement (analytics)

If we use Google Analytics, we process aggregated and anonymised data to understand how the website is used and to improve the experience. The legal basis is the consent you give when accepting analytics cookies.

4. Retention period

• Order and billing data: 5 years from the transaction (tax obligation)
• Customer service queries: up to 1 year after the query is resolved
• Google Analytics data: 14 months (Google's standard configuration)
• WhatsApp conversations: for as long as the business relationship lasts, or until you request their deletion

Once these periods have elapsed, the data will be securely deleted or anonymised.

5. Recipients and transfers

We do not sell or transfer your personal data to third parties for commercial purposes. However, to provide our services we work with the following trusted providers:

• Google LLC — email platform (Gmail), Google Analytics and Google Maps. Google may transfer data outside the European Economic Area under appropriate safeguards (Standard Contractual Clauses). See Google's privacy policy.
• Meta Platforms (WhatsApp) — when you start a WhatsApp conversation with us. See WhatsApp's privacy policy.
• Qamarero.com — online order management platform. When you place an order through their platform, please check their own privacy policy.
• WordPress / Automattic — website hosting.

All our providers act as data processors and are bound by contracts that guarantee the protection of your data.

6. Your rights

Under the GDPR and the LOPD-GDD (Spanish Data Protection and Digital Rights Guarantee Act), you have the following rights regarding your personal data:

• Access: to know what data we hold about you and how we process it.
• Rectification: to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): to request that we delete your data when it is no longer necessary.
• Objection: to object to processing based on legitimate interest or to receiving marketing communications.
• Restriction of processing: to request that we restrict the use of your data in certain circumstances.
• Portability: to receive your data in a structured, commonly used format.
• Not to be subject to automated decisions: we do not make decisions based solely on automated processing that have significant effects.

7. How to exercise your rights

To exercise any of these rights, write to us at info@lamarujabakery.es including:

• Your full name and a copy of your ID card or other identifying document
• The right you wish to exercise and the data affected
• An address for notification purposes (email is sufficient)

We will respond within a maximum of one month from receipt of your request. In complex cases, we may extend this by a further two months, duly notifying you.

You can also send us a letter to: LaMaruja Bakery, Calle Hermes, 10, 29010 Málaga.

8. Complaints to the AEPD

If you believe that the processing of your data does not comply with current regulations, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD — Agencia Española de Protección de Datos):

• Website: www.aepd.es
• Address: C/ Jorge Juan, 6, 28001 Madrid
• Phone: 901 100 099

We would appreciate it if, before approaching the AEPD, you tried to resolve the matter directly with us by writing to info@lamarujabakery.es.

9. Data security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or accidental disclosure. However, no transmission over the Internet is 100% secure, so we cannot guarantee the absolute security of the data you send us.

10. Minors

Our services are not aimed at children under 14. We do not intentionally collect data from children of that age. If you are a parent or guardian and believe your child has provided us with personal data, write to info@lamarujabakery.es and we will delete it.

11. Changes to this policy

We may update this Privacy Policy to reflect changes in our activity, in applicable legislation or in our systems. We will publish the updated version on this page with the date of the last modification. We recommend that you review it periodically.