PRIVACY POLICY

I. PRIVACY POLICY AND DATA PROTECTION

In accordance with current legislation, CoffeeAndHouses (hereinafter referred to as “the Website”) is committed to adopting all necessary technical and organizational measures to ensure an appropriate level of security for the data it collects.

Applicable laws

This privacy policy complies with current Spanish and European regulations on the protection of personal data, specifically:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, or GDPR).
Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPD-GDD).
Royal Decree 1720/2007 of 21 December, which implements Organic Law 15/1999 on the Protection of Personal Data.
Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).

Data controller

The controller responsible for the processing of personal data collected through this Website is Leticia Andrade, with tax ID Y2263479V, registered in the Commercial Registry of Madrid, represented by Leticia Andrade (hereinafter, “the Data Controller”).

Contact details:
Address: C/ Mayor, 4, 5th Floor, Office 3, Madrid 28013
Phone: +34 618 968 224
Email: atencionalcliente@spanishhome.es

Personal data records

In compliance with the GDPR and LOPD-GDD, we inform you that any personal data collected through the forms on this Website will be incorporated into our data files for the purpose of facilitating, managing, and maintaining the commitments established between CoffeeAndHouses and the User, or to respond to a specific request or inquiry.

In accordance with Article 30.5 of the GDPR, a record of processing activities is maintained, specifying the purposes, nature, and scope of data processing activities.

Principles governing data processing

Personal data processing at CoffeeAndHouses follows the principles set out in Article 5 of the GDPR and Article 4 of Organic Law 3/2018:

Lawfulness, fairness, and transparency: User consent will always be obtained after providing clear and transparent information about the purpose of data collection.
Purpose limitation: Data will be collected for specific, explicit, and legitimate purposes.
Data minimization: Only data strictly necessary for the stated purposes will be collected.
Accuracy: Data must be accurate and kept up to date.
Storage limitation: Data will be kept only for as long as necessary to fulfill its purpose.
Integrity and confidentiality: Data will be processed securely and confidentially.
Accountability: The Data Controller is responsible for ensuring compliance with all these principles.

Categories of personal data

Only identification data are collected. No special categories of personal data, as defined by Article 9 of the GDPR, are processed.

Legal basis for processing

The processing of personal data is based on the User’s consent.

CoffeeAndHouses will always seek the User’s explicit and verifiable consent for one or more specific purposes.

Users may withdraw their consent at any time as easily as they granted it. Withdrawal of consent will not affect the legality of processing carried out prior to its withdrawal.

When data are requested through a form (for example, to make an inquiry or request information), Users will be informed which fields are mandatory to ensure proper handling of their request.

Purpose of data collection

Personal data are collected and processed by CoffeeAndHouses to manage and fulfill commitments between the Website and its Users, respond to requests or inquiries, and maintain user relationships.

Additionally, data may be used for commercial, analytical, or statistical purposes related to CoffeeAndHouses’ business activities — including marketing research and improvements to Website content, functionality, and navigation.

Data retention period

Personal data will only be retained for the minimum time necessary for the purposes of processing and, in any case, no longer than two years, unless the User requests deletion sooner. At the time of collection, Users will be informed about the retention period or, when not possible, the criteria used to determine it.

Data recipients

User data may be shared with specific third parties or categories of recipients when necessary for the stated purposes. If data are to be transferred outside the EU, Users will be informed in advance of the destination country or organization and whether there is an adequacy decision in place.

Data of minors

In compliance with Article 8 of the GDPR and Article 7 of Organic Law 3/2018, only individuals over the age of 14 may give valid consent for their personal data to be processed by CoffeeAndHouses.

For minors under 14, parental or guardian consent is required, and data processing will only be lawful to the extent that such consent has been provided.

Data security and confidentiality

CoffeeAndHouses implements all necessary technical and organizational measures to ensure the security of personal data and prevent its destruction, loss, alteration, or unauthorized access.

The Website uses an SSL (Secure Socket Layer) certificate to guarantee secure and encrypted data transmission between the server and the User.

However, as no online transmission is completely secure, CoffeeAndHouses cannot fully guarantee that the Website is immune from unauthorized access or hacking. In the event of a data breach likely to result in a high risk to users’ rights and freedoms, the Data Controller will promptly notify affected Users as required by law.

All personal data will be treated as confidential, and the Data Controller will ensure that confidentiality is maintained by all employees, partners, and anyone granted access to the data.

User rights

Users of CoffeeAndHouses have the following rights under the GDPR and Spanish data protection laws:

Right of access: to know whether their personal data is being processed and to obtain a copy.
Right of rectification: to correct inaccurate or incomplete data.
Right of erasure (“right to be forgotten”): to request deletion of their data under certain conditions.
Right to restrict processing: to limit how their data is used in specific circumstances.
Right to data portability: to receive their data in a structured, machine-readable format or transfer it to another controller.
Right to object: to stop processing their data for certain purposes.
Right not to be subject to automated decisions, including profiling.

To exercise these rights, Users must send a written request referencing “GDPR-spanishhome.es”, including:

Full name, copy of ID, and proof of representation (if applicable).
Specific reason or request.
Contact address for notifications.
Date, signature, and supporting documents.

Requests can be sent to:
Postal address: C/ Mayor, 4, 5th Floor, Office 3, Madrid 28013
Email: atencionalcliente@spanishhome.es

Links to third-party websites

The Website may include links to third-party sites not operated by CoffeeAndHouses. Each of these sites is responsible for its own privacy practices and data protection policies.

Complaints

If a User believes their data is being processed unlawfully, they may file a complaint with the relevant supervisory authority. In Spain, this is the Spanish Data Protection Agency (AEPD) — www.aepd.es.

II. ACCEPTANCE AND CHANGES TO THIS POLICY

By using this Website, Users confirm that they have read and agree with this Privacy Policy, authorizing CoffeeAndHouses to process their data for the purposes and within the timeframes described herein.

CoffeeAndHouses reserves the right to update or modify this Privacy Policy at any time, whether due to legal, judicial, or regulatory changes. Users are encouraged to review this page periodically to stay informed of the latest updates.

This Privacy Policy was last updated to comply with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on Data Protection and Digital Rights.