Privacy policyPrivacy policy

Pastelería Kerrico (Kerrico S.L., B72765365, Calle Hermano Pedro 22, 38670 Adeje, Santa Cruz de Tenerife, Spain). Contact for privacy matters: kerricotenerife@gmail.com.

The only form on this website is the cake-order configurator (the "Order a cake" page). Filling it in involves processing: your name, your phone number, your email if you provide one, the cake or flavour you request, the number of servings, the date, the message on the cake, any allergies or things to avoid you tell us, where you will collect the order, and any notes you add. The purpose is single and specific: to manage and confirm your order, and to be able to contact you about it.

Allergy information is health data (a special category under GDPR art. 9): it is only collected if you choose to provide it, it is only used to prepare your order safely, and it is not shared with anyone outside the preparation of the order.

Your explicit consent, given by ticking the form's checkbox before submitting it, and the performance of pre-contractual steps needed to fulfil your order (GDPR art. 6.1.a and 6.1.b). For allergy data, the basis is your explicit consent (GDPR art. 9.2.a), and we only process it if you choose to provide it.

When you submit the form, your order is saved in our database, and WhatsApp opens with the message already written so that you send it yourself from your own WhatsApp account. That last step is your own decision and action: the moment you hit send inside WhatsApp, that data also becomes subject to the systems of WhatsApp Ireland Limited / WhatsApp LLC (Meta), governed by their own privacy policy, which we recommend reading. We mention this here because it is a real disclosure to a third party, even though the act of sending it is yours.

We also use technology providers who process data on our behalf (data processors) to host the website and images: application and database hosting on Railway, and photo storage on Cloudflare R2. Data is never sold or shared with anyone for advertising purposes.

WhatsApp/Meta may transfer data outside the European Economic Area. That transfer is carried out by your own WhatsApp account when you send the message, not by our server, and is governed by the safeguards Meta states in its privacy policy (standard contractual clauses or another valid mechanism under GDPR chapter V).

Order data is kept for as long as the order is active (until it is delivered or cancelled) and, after that, for as long as needed to handle any claims or meet legal obligations (accounting or tax-related, where applicable) — and no longer.

You can access your data, ask us to correct or delete it, request that we limit its processing, object to it, or ask for portability, by writing to kerricotenerife@gmail.com. You can also withdraw your consent at any time, without affecting anything done before the withdrawal. You also have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es) if you believe we have not handled your data correctly.

This form is intended to be filled in by an adult placing an order. It is not deliberately directed at children under 14, and their data is not knowingly collected.

We apply reasonable technical and organisational measures to protect your data (encrypted connection, password-restricted access to the internal panel). No system is completely invulnerable, but we do not keep more data than necessary, nor for longer than necessary.

We may update this policy if the way we process your data changes. The date of the last update appears at the bottom of this page.