Privacy Policy

1. Who is responsible for your data

Data controller: —, autónoma (self-employed), NIF —, address: —, Valencia, Spain. Email for data questions: —.

2. What data we collect

Contact details: name, email, phone, address and delivery note, delivery area.

Order data: plan, period, delivery dates, side dish and soup choices, pauses, payments.

Health data: allergies, intolerances and foods you avoid — only if you provide them yourself and give separate explicit consent.

Technical data: a session cookie for signing in to your account. There is no analytics or advertising on the site.

Office requests: company name, contact person, phone, email, number of people, message.

3. Why, and on what legal basis

Preparing and delivering lunches, managing your subscription and contacting you about your order — performance of a contract (Art. 6.1.b GDPR).

Taking your allergies into account when cooking — your explicit consent (Art. 9.2.a GDPR). You can withdraw consent in your profile at any time; we then cannot guarantee that your allergies are taken into account.

Accounting and tax records — legal obligation (Art. 6.1.c GDPR).

Replying to an office request — steps taken at your request before entering into a contract (Art. 6.1.b GDPR).

4. Who else sees the data

The kitchen and the courier see only what they need to cook and deliver (name, address, order contents, allergens).

Service providers: a hosting server in the EU (—), an email service for sign-in code emails (—), the bank/Bizum for payments, and a gestoría for accounting. We have a data processing agreement with each of them.

We do not sell data or transfer it outside the EU.

5. How long we keep it

Customer data — while your account is active and for 12 months after your last order (the end of your last subscription) or sign-in. 30 days before that period ends we will send you a warning email; if you don’t come back, your profile will be anonymised automatically. A new sign-in or order restarts the countdown.

Allergy data — until you withdraw consent or delete your account.

After your account is deleted (or after 12 months of inactivity) we anonymise your profile: we erase your name, contact details, address, allergies, payment details, team notes, delivery photos and notes, contact details in office requests with the same email or phone, and emails not yet sent; unpaid orders are cancelled. Without your contact details, we keep records of subscriptions and payments (dates, amounts, payment method), dish choices and delivery statuses, and the date you accepted the terms — this is required for accounting and tax purposes (Art. 17.3.b GDPR). We keep a record of the deletion request itself (date and status) as proof that it was carried out.

Log of team access to customer data — 12 months.

Accounting documents — for the periods set by Spanish tax law (usually 4–6 years).

6. Your rights

You can access, rectify and erase your data, restrict or object to its processing, receive a copy in a portable format and withdraw your consent.

You can download a copy of your data (a JSON file, including team notes about you) or delete your account yourself: My account → Profile → “Your data”. If you have a paid subscription, deliveries continue until it ends and we delete the account the following night; while the request is open, no new orders can be placed, and you can withdraw the request there too. If you can’t sign in or have another request, email — from the address on your account; we will reply within one month.

If you believe your rights have been infringed, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es).

7. Security

The site works over HTTPS only, there are no passwords — you sign in with a one-time code, allergies are visible only to the kitchen and the administrator, and the database is backed up.