Privacy policy

This policy explains what personal data we collect at Estafeta Gourmet, what we use it for and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

Cristina Lopez de Murillas, tax ID 44612030B, Calle Estafeta, 70 · 31001 Pamplona / Iruña (Navarre). Contact for privacy matters: info@estafetagourmet.com.

2. What data we process, why and on what legal basis

Purchases (orders)

• Data: name, shipping and billing address, email, telephone, the content of the order and, for alcoholic drinks, the declaration of being of legal age.
• Purpose: to manage, charge, ship and invoice your order and to handle guarantees and returns.
• Legal basis: performance of the purchase contract and compliance with legal obligations (tax and accounting).

Contact form, WhatsApp and telephone

• Data: name, email or telephone and the message you send us.
• Purpose: to answer your enquiry.
• Legal basis: your consent (by writing to us) or the application of pre-contractual measures at your request.

Newsletter (Estafeta Club)

• Data: your email address (and your name, if you give it).
• Purpose: to send you news, launches, blog posts, reminders and other notices from the shop, only if you subscribe. The subscription is confirmed with an email (double opt-in).
• Legal basis: your consent, which you can withdraw at any time with the “unsubscribe” link in any email.

Browsing

Website usage data is only measured with your permission (see the cookie policy). Our servers keep technical logs (IP address, date and page) for security and so that the website works.

3. How long we keep it

• Orders and invoices: the time required by tax and commercial law (generally 6 years) and afterwards, blocked while liabilities may arise.
• Enquiries: the time needed to deal with them and, afterwards, the limitation period for possible claims.
• Newsletter: until you unsubscribe or ask us to remove you.

4. Recipients and providers

We do not sell your data. We share it only with providers that process it on our behalf, under a data processing agreement:

• Brevo (Sendinblue SAS, France): sending the newsletter and managing the subscriber list.
• Vercel: website hosting.
• Sanity: management of the blog content (it does not store customer data).
• E-commerce platform, payment gateway and carrier: to charge and deliver your order (to be specified when online sales are switched on).
• Google Maps: the map in the “Visit us” section.
• Public authorities, when required by law.

Some providers (for example, Vercel) may process data outside the European Economic Area; in that case they rely on safeguards such as the European Commission's standard contractual clauses.

5. Your rights

You can access your data, rectify it, erase it, object to its processing, restrict it and ask for its portability, as well as withdraw your consent when it is the basis for processing. Write to info@estafetagourmet.com stating the right you want to exercise and attaching a copy of a document proving your identity. We reply within one month. If you think we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

6. Minors

The website is not aimed at children under 14 and we do not knowingly collect their data. Alcoholic drinks are only sold to people aged 18 or over (see the terms of sale).

7. Security

We apply reasonable technical and organisational measures to protect your data (encrypted connection, restricted access and providers with safeguards). No system is infallible: if there were a breach affecting you, we would notify you as the law requires.

8. Changes to this policy

If we change it in a significant way, we will say so on the website. The date of the last review appears above.