On this page we explain what personal data we process when you visit cafeslacaribena.com or buy from the shop, what we use it for, how long we keep it, who we share it with and how you can exercise your rights. This policy is governed by the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”) and Law 34/2002 on Information Society Services and Electronic Commerce (“LSSI”).
1. Who the data controller is
- Data controller: Café los González S.L. (Cafés La Caribeña)
- Tax identification number (CIF): B04237624
- Address: Polígono Industrial Rubira Sola, parcela V-2, 04867 Macael (Almería)
- Email: info@cafeslacaribena.com
For any question about your data, write to us at that address.
2. What data we process and what for
When you buy
To prepare, take payment for and send your order, we need your full name, your billing and delivery addresses, your email address and your phone number, as well as the products, the amounts and any notes you add to the order. The IP address and the browser you placed the order from are also saved automatically with each order. We use this data to manage the purchase, take payment for it, send it, keep you informed by email of its progress, issue the invoice and deal with returns and guarantees.
You can buy without creating an account. If you already have a customer account, we also keep your login details, your addresses and your order history so that you can view them in “My account”.
Legal basis: the contract of sale (Art. 6(1)(b) GDPR) and our accounting and tax obligations (Art. 6(1)(c) GDPR). For the IP address and the browser, our legitimate interest in being able to prove the purchase and prevent fraud (Art. 6(1)(f) GDPR).
When you pay
Payment is processed by Stripe through WooPayments. Your card details go directly to Stripe: they do not pass through our servers and we do not store them. If you pay with Apple Pay or Google Pay, Apple or Google are also involved, under the terms of your wallet.
To prevent fraudulent payments, Stripe and Sift (WooPayments’ anti-fraud service) analyse technical data about your device and your browser, and your IP address, and may ask for an hCaptcha check to confirm that the person paying is not a robot. This assessment is automated and may lead to a payment being declined. If this happens to you, write to us: a person will review it with you.
Legal basis: the contract (Art. 6(1)(b) GDPR) and the legitimate interest, both ours and that of the people who buy from us, in preventing fraud (Art. 6(1)(f) GDPR).
When we send you your order
We pass your name, your delivery address, your phone number and your email address to GLS so that they can deliver the parcel and let you know about the delivery. For the map of GLS collection points, the checkout loads a style sheet from unpkg.com and, when the map is shown, the images from OpenStreetMap: both receive your IP address, as happens with any website you visit.
Legal basis: the contract (Art. 6(1)(b) GDPR).
When you answer “How did you hear about us?”
If you answer this optional question at checkout, we save your answer with the order so that we know which channels bring us customers. It is optional and makes no difference to your purchase.
Legal basis: the consent you give by answering (Art. 6(1)(a) GDPR).
When you write to us
If you leave your details in the contact form, we save your name and your email address on the website and they reach us by email so that we can contact you. If you also tick the marketing communications box, we save that authorisation. If you write to us by email or on WhatsApp, or phone us, we use what you tell us to reply to you. WhatsApp is a Meta service, which processes your data under its own terms.
Legal basis: your consent when you write to us and, for marketing communications, the consent you give by ticking the box (Art. 6(1)(a) GDPR). You can withdraw it whenever you like.
When you subscribe to the newsletter
If you subscribe using the newsletter form or by ticking the box at checkout, we add your email address, and your name if you give it to us, to Mailchimp, the tool we use to send the newsletter. Mailchimp may record whether you open the emails and which links you click. You can unsubscribe whenever you like using the link in every newsletter or by writing to us.
Legal basis: your consent (Art. 6(1)(a) GDPR).
The shop’s connection to Mailchimp
The shop is connected to Mailchimp: every order (your name, your email address, the products and the amounts) is also sent there. If you have not subscribed to the newsletter, Mailchimp stores you as a “transactional” contact, to whom no marketing communications are sent.
Legal basis: our legitimate interest in managing our relationship with our customers from a single tool (Art. 6(1)(f) GDPR). You can object by writing to us.
When you leave a review
To leave a product review, we ask for your name and your email address. We publish the review with your name; your email address is not published. The IP address and the browser you sent the review from are also saved with it, to filter out spam.
Legal basis: your consent (Art. 6(1)(a) GDPR).
When you accept Google’s survey about your purchase
When you finish your purchase, on the order confirmation page, a Google window asks whether you would like Google to send you a survey about your purchase by email (Google Customer Reviews). Only if you accept does the website share with Google LLC your email address, the order number, the delivery country, the estimated delivery date and, if there are any, the barcodes (GTINs) of the products. Google sends you the survey and publishes your rating as part of the shop’s seller rating. For this survey, Google processes your data as an independent data controller, under its privacy policy, and may process it in the United States, under the EU-US Data Privacy Framework (section 5).
Legal basis: your consent, which you give in that window (Art. 6(1)(a) GDPR). You can withdraw it whenever you like.
Analytics and where orders come from, only if you accept
If you accept analytics cookies, Google Analytics 4 counts visits and how the website is used (pages viewed, device, approximate location and where your visit came from), without contact details. We do not use Google Signals or Google advertising.
If you accept marketing cookies, WooCommerce saves with your order which website or campaign you came from (the source, the medium, the campaign and the first page you saw), and Mailchimp may link your visit to its campaigns and remember your basket if you leave it unfinished.
Legal basis: your consent (Art. 6(1)(a) GDPR), which you give and withdraw in the cookie notice. The details are in the Cookie policy.
Website security
Like any web server, ours logs every request: the IP address, the date and time, the page requested and the browser. We use this to keep the website secure, for example to block unauthorised access attempts, and to fix errors. Some browser security reports are sent automatically to the company that maintains the website.
Legal basis: our legitimate interest in protecting the website and the people who use it (Art. 6(1)(f) GDPR).
3. How long we keep the data
- Orders and invoices: for as long as the relationship lasts and then for six years, the period required by Article 30 of the Spanish Commercial Code (Código de Comercio) for accounting records.
- Customer account: for as long as you keep it. You can ask us to delete it; orders are kept for the period above.
- Contact form: for as long as needed to deal with your request, up to a maximum of 12 months.
- Newsletter: until you unsubscribe.
- Reviews: for as long as they remain published.
- Google Analytics: a maximum of 14 months.
- Server logs: about two weeks.
4. Who we share your data with
We do not sell your data or pass it on to anyone for their own purposes, except where the law requires it (for example, to the Spanish Tax Agency or to a court) or where you agree to it, as with Google’s survey about your purchase. For the shop to work, the following providers process it on our behalf:
- Stripe and Automattic (WooPayments): taking payment and preventing fraud, with Sift and hCaptcha.
- GLS: transport and delivery.
- Mailchimp (The Rocket Science Group, an Intuit company): the newsletter and the connection with the shop.
- Google: Google Analytics, only if you accept it.
- acens: email.
- Quantum Howl S.L.: development, hosting and maintenance of the website, on Hetzner Online GmbH servers in Germany.
If you pay with Apple Pay or Google Pay, Apple or Google process the payment data under their own terms.
5. Transfers outside the European Economic Area
Stripe, Automattic, Sift, hCaptcha, Mailchimp and Google may process data in the United States. They do so under the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), in the case of companies that participate in it (DPF), or under the standard contractual clauses approved by the Commission. You can ask us for a copy of those clauses by writing to info@cafeslacaribena.com.
6. Your rights
At any time, you have these rights:
- access to your data;
- its rectification, if it is inaccurate;
- its erasure;
- restriction of processing;
- portability of the data you gave us;
- objection to what we do on the basis of legitimate interest;
- and withdrawal of your consent, without this affecting anything done before.
Write to us at info@cafeslacaribena.com telling us which right you want to exercise. We will reply within one month; if we need to confirm your identity, we will ask you to do so. If you believe we have not dealt with your request properly or that we are not processing your data properly, we invite you to write to us first at info@cafeslacaribena.com so that we can try to resolve it. In any case, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) whenever you like, without having to write to us first.
7. Minors
The shop is not aimed at minors under the age of 14 and we do not knowingly collect their data. If you are a parent or guardian and believe that a minor has given us their data, write to us and we will delete it.
8. How we protect your data
The website only works over an encrypted connection (HTTPS), the shop’s administration area is used only by the people who need it, we make backups every day and card details never reach our servers.
9. Changes to this policy
If we change how we process your data, we will update this page and the date you see above. If the change is significant, we will let you know.