Privacy policy

Data controller

[Pending: company name, NIF and registered address]

Contact for privacy requests

info@trompeloeilmadrid.com

Data we process

When you order: your name, email or phone number, the pastries ordered and your pickup day and window. Payment is handled by Square; we do not receive your card details.

When you write to us: your email address and the content of your message.

When you browse: our hosting provider records technical data such as your IP address to deliver and protect the site.

Purposes and legal basis

Preparing your order and having it ready at pickup: performance of the contract (article 6.1.b GDPR).

Invoicing and accounting: legal obligation (article 6.1.c GDPR).

Answering your messages: your request and our legitimate interest in replying (articles 6.1.b and 6.1.f GDPR).

Recipients

Square (payments, orders and pickup bookings) and Vercel (website hosting) process data on our behalf. Some processing may take place outside the European Economic Area, under the safeguards the GDPR provides, such as standard contractual clauses or the EU-US Data Privacy Framework.

We do not sell your data or share it for advertising.

Retention

Order data is kept while needed to complete your order and then for the periods required by tax and commercial law (generally four to six years). Messages are kept while we deal with your request.

Your rights

You can ask for access, rectification, erasure, objection, restriction and portability by writing to info@trompeloeilmadrid.com.

You can also complain to the Spanish Data Protection Agency (www.aepd.es).

Cookies

This site uses no analytics or advertising cookies. Your browser remembers your language and light or dark choice on your own device; this is not sent to us.

The Square payment page applies its own cookie policy.