Privacy policy

What data we collect and why

We only process the data you give us when you fill in a form. We use no other source.

· Ordering a cake (the order form and “Build your cake”): your first and last name, your phone number, your email address, which cakes you want, the pick-up day and, if you write them, the message on the cake, the occasion, whether you want candles and your comments. We use them to prepare the order, confirm it by email and let you know if anything changes.

· Quote request for businesses: the name of the business, the contact person, their email, their phone number if they give it, the type of business and what they tell us they need. We use them to reply and send a quote.

We do not ask for health data. If you have an allergy or an intolerance, check the allergens of each cake on the menu or call us: there is no need to write it in the form.

We do not ask for payment details either: the website does not charge anything.

There is no profiling and no automated decision-making that affects you.

Why we are allowed to process it

Because you ask us to. The legal basis is your consent, which you give by ticking the box in the form, and handling the order or request you make (article 6(1)(a) and (b) of the General Data Protection Regulation).

Giving us your data is voluntary, but without it we cannot prepare your order or reply to you.

Alongside each order or request we store the date and the exact text you accepted: it is the proof of your consent.

How long we keep it

Orders are stored in our database and deleted automatically six months after the pick-up day.

Business quote requests are deleted automatically twelve months after they arrive.

The system itself does the deletion every day, without anyone having to remember. The notification and confirmation emails of each order also remain in the shop’s mailbox and in yours.

Database backups are kept for a maximum of twelve months and then destroyed, so data that has already been deleted may remain in a backup until then. Those backups are only used to restore the service if something fails.

If you ask us to delete your data sooner, we delete it.

Who else sees it

Nobody who does not need to. We do not sell or pass on data to third parties.

There are companies that provide us with technical services and, in doing so, process data on our behalf as data processors:

· Cloudflare: website hosting, network and forwarding of email sent to contacto@latarteta.com.

· Render: the website server, in Frankfurt (Germany).

· Supabase: the database where orders and requests are stored, in the European Union.

· Resend: sending the notification and confirmation emails.

· Backblaze: backups.

· Sentry: logging of technical errors on the website, in the European Union. It is set up not to receive the content of the forms.

· Umami: visitor measurement, only if you accept it (see the cookie policy). We run it ourselves: it is served from Vercel, in the United States, and its data is stored in the European Union.

Resend and Backblaze process data in the United States, backups included; Vercel, which serves the visitor measurement, is also in the United States; and Cloudflare may process it outside the European Economic Area because of how its network works. Render, Supabase and Sentry store data in the European Union, although they are companies with a US parent. Where there is an international transfer, it is made with the safeguards required by the regulation: the standard contractual clauses approved by the European Commission and, where the company has signed up to it, the EU-US Data Privacy Framework.

The map on the contact page is served by Google and only loads if you click “Load map”; from that moment Google’s privacy policy applies.

If you order home delivery through Glovo or Uber Eats, they are the ones processing your data, under their own policies.

What you can do with your data

You can ask us at any time to access it, correct it, delete it, restrict its use, object to its processing or receive it in a format you can take elsewhere. You can also withdraw your consent whenever you want, without affecting what was done until then.

To exercise any of these rights, just write to the email address shown above, saying what you want and, if it concerns an order, its reference number. If we need to check that it is you, we will ask. We reply within one month at most.

If you feel we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

How we protect the information

The website is encrypted (HTTPS). Orders and requests can only be seen by La Tarteta staff with access to the password-protected management panel; the database cannot be reached from the internet by anyone else.

The forms have sending limits and anti-spam filters.

No system is infallible, but we keep reasonable technical and organisational measures for the kind of data processed here.

Minors

The forms are intended for people over 14, the age from which Spanish law allows people to give consent themselves. If we find data from a minor under that age without authorisation from their parents or guardians, we delete it.

Changes to this policy

If the way we process data changes, we update this page and its date. We recommend checking it from time to time.