Privacy Policy

Who we are — Data Controller

The data controller responsible for your personal data is:

• Company: Spisa Shop S.L.
• Trading name: Spisa Foodmarket
• CIF: B10923845
• Registered address: Avenida de Manolete 1, puerta 33, 29660 Marbella (Málaga), Spain
• Commercial address: Avenida de Manolete 1, Centro Plaza, 29660 Marbella (Málaga), Spain
• Email: spisamarb@spisa.shop
• Website: spisa.shop

What personal data we collect

Data you provide directly

When you contact us by email or any contact form, we collect:

• Your name
• Your email address
• The content of your message or enquiry
• Any other information you choose to include

Newsletter subscription

If you sign up to our newsletter (via Mailchimp), we collect:

• Your email address
• Your expressed consent and the date it was given
• Language preference (if indicated)

Website usage data

When you visit our website we may collect, through cookies and similar technologies:

• Your IP address (anonymised where possible)
• Browser type and version
• Pages visited and time spent on each page
• Referring URL
• Device type and operating system

See our Cookie Policy for full details of what cookies we set.

Data we do not collect

We do not collect payment card data (all transactions on our online shop, if applicable, are handled directly by the payment processor). We do not collect special categories of personal data (Article 9 GDPR) unless you explicitly provide them in a message to us.

Why we use your data & legal basis

Responding to enquiries

When you contact us, we use your data to reply to your message and manage our relationship with you. The legal basis is legitimate interest (Article 6(1)(f) GDPR) — it is in our mutual interest to handle your enquiry effectively.

Newsletter and marketing communications

If you have subscribed to our newsletter, we send you news about products, promotions, events and offers. The legal basis is your freely given consent (Article 6(1)(a) GDPR). You may withdraw this consent at any time by clicking the unsubscribe link in any email or by writing to us.

Operating and improving our website

We use website analytics data to understand how visitors use our site and to make improvements. Where this involves the use of analytics cookies, we rely on your consent (Article 6(1)(a) GDPR). Strictly necessary processing (e.g. server logs for security) is based on legitimate interest (Article 6(1)(f) GDPR).

Legal obligations

In some circumstances we may be required to process your data to comply with a legal obligation (Article 6(1)(c) GDPR), for example if required by a court order or regulatory authority.

How long we keep your data

• Contact enquiries: We retain email correspondence for up to 3 years from the date of our last exchange, after which it is deleted.
• Newsletter subscribers: We retain your email address for as long as you remain subscribed. When you unsubscribe, your data is deleted from our mailing list within 30 days.
• Analytics data: Aggregated and anonymised analytics data is retained for up to 26 months.
• Legal and accounting records: Where required by Spanish tax law (Ley 58/2003, General Tributaria), certain records are retained for a minimum of 5 years.

Who we share your data with

We do not sell your personal data. We share it only with the following third-party service providers who act as data processors on our behalf, under written data processing agreements:

Mailchimp (The Rocket Science Group LLC)

We use Mailchimp to manage our newsletter mailing list and send email communications. Your email address and subscription preferences are stored on Mailchimp's servers in the United States (see §6 on international transfers). Mailchimp's privacy policy is available at mailchimp.com/legal/privacy.

Google LLC

We embed Google Maps on our website to help you find our stores. Google may collect data when the map is loaded. Google's privacy policy is available at policies.google.com/privacy.

If we use Google Analytics, Google processes anonymised usage data on our behalf under a data processing agreement.

Hosting provider

Our website is hosted by WP Engine, Inc. The hosting provider processes technical data (server logs, IP addresses) solely for the purpose of providing the hosting service. WP Engine's privacy policy is available at wpengine.com/legal/privacy.

Legal requirements

We may disclose personal data to public authorities or law enforcement agencies when required to do so by applicable law or a court order.

International transfers

Some of our service providers are based in the United States or other countries outside the European Economic Area (EEA). When we transfer personal data outside the EEA, we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR. These safeguards may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The provider's participation in a recognised data transfer framework

You may request a copy of the safeguards applicable to a specific transfer by contacting us at the address in §11.

Your rights under GDPR

As a data subject under GDPR, you have the following rights. To exercise any of them, please write to us at spisamarb@spisa.shop (or by post to the address in §11), indicating the reference "Derechos RGPD" and enclosing a copy of your ID document so we can verify your identity. We will respond within 30 days.

Right to withdraw consent

Where processing is based on your consent, you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to lodge a complaint

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the Spanish data protection authority:

Security

We implement appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures include encrypted connections (HTTPS/TLS), access controls, and regular security reviews.

However, no internet transmission is completely secure. If you have reason to believe that your data has been compromised, please contact us immediately at spisamarb@spisa.shop.

Children's data

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data about a child, please contact us so we can delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.

Continued use of our website after any changes constitutes acceptance of the updated policy.

How to contact us

For any questions or requests related to this Privacy Policy or your personal data, please contact us:

• Email: spisamarb@spisa.shop
• Post: Spisa Shop S.L., Avenida de Manolete 1, Centro Plaza, 29660 Marbella (Málaga), Spain

We will acknowledge your request within 5 working days and aim to respond fully within 30 days as required by Article 12 GDPR.