1. Data controller
- Trading name: Bacallá Fit
- Owner: Dina Esther Calle Quispe
- Spanish ID (NIE): Y0795182V
- Address: Calle Picasso 10, tienda 2, 08980 Sant Feliu de Llobregat, Barcelona
- Data protection email: bacallafit@gmail.com
2. Personal data we process
We process the data you provide through the following channels:
- Contact form: name, phone number, email address and message.
- Purchase process: full name, delivery address, phone number and email address. Payment data is processed directly by Stripe and is not stored by Bacallá Fit.
3. Purposes and legal basis for processing
Order management and home delivery
Legal basis: performance of a contract (Art. 6.1.b GDPR). Data is necessary to process and deliver your order.
Handling enquiries
Legal basis: legitimate interest of the controller (Art. 6.1.f GDPR) / user consent (Art. 6.1.a GDPR).
Website traffic analysis (Google Analytics 4)
Legal basis: explicit consent (Art. 6.1.a GDPR). Only active if you accept all cookies.
4. Data retention periods
- Order data: 5 years from the transaction date, in compliance with tax and commercial regulations.
- Contact form data with no subsequent commercial relationship: 2 years from the last communication.
- Analytics data: in accordance with Google Analytics retention settings (maximum 14 months).
5. Recipients of personal data
Personal data may be shared with the following data processors, with whom appropriate GDPR-compliant data processing agreements have been signed:
- Stripe, Inc. — Payment processing. Privacy policy available at stripe.com/privacy.
- Supabase, Inc. — Order database storage. Privacy policy available at supabase.com/privacy.
- Google LLC — Web analytics via Google Analytics 4 (consent-based only).
- Resend, Inc. — Transactional email delivery (order confirmations).
No data transfers are made to third parties for commercial purposes or outside the European Economic Area without appropriate safeguards.
6. Your rights
You have the right to:
- Access: find out what data we hold about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request deletion of your data when it is no longer necessary.
- Objection: object to processing based on legitimate interests.
- Restriction: request that the use of your data be restricted.
- Portability: receive your data in a structured, machine-readable format.
- Withdraw consent: at any time, without affecting the lawfulness of prior processing.
To exercise any of these rights, send an email to bacallafit@gmail.com with the subject "Data protection", including your full name and a copy of your identity document.
If you believe your data is not being processed in accordance with applicable law, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.