Privacy policy

1. Data controller

• Controller: Inna Didenko, self-employed (trabajadora autónoma), business name So Sweet Pastry
• Tax ID (NIF): Z1508040G
• Registered address: Av. de Sor Teresa Prat, 82, 29004 Málaga (Spain)
• Email: cakes@sosweetpastry.com

This policy explains how we process the personal data of people who visit this website and write to us through the contact form, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales, LOPDGDD).

2. What data we process

When you visit the website, the web server records every request it receives with your IP address shortened, without its last block. Only when a request fails with a server error does its record keep the full address. Both records are deleted after 14 days.

If you accept visit statistics, we count your visit with Umami, open-source software that the studio runs on its own servers in Málaga and that uses no cookies. Umami reads the screen size, the browser language, the address of the page without its query and the page you came from, and counts, without anything you write, whether you send the form and whether you click the contact links. Your IP address is used at the moment of the visit to derive the country, region and city and a session identifier that changes every month, and it is not stored. If you do not accept, none of this is collected. The cookie policy explains it in detail.

When you submit the form, we store what you have written: your names, your email address, your telephone number if you provide it, your preferred language, the occasion, the date, the venue or town, the number of guests, what you have in mind, any dietary requirements you choose to tell us about, and the budget range if you select one.

We also store the page from which the form was submitted, so that we know which language to reply in, and the browser identifier (user-agent), so that we can distinguish people from automated programs.

The form does not store your IP address with the request: it keeps it in memory for a maximum of one hour to prevent the same connection from sending dozens of requests.

3. Purposes and legal basis

Purpose	Legal basis
Responding to your request and preparing a quote	Taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and the consent you give by ticking the box on the form (Art. 6(1)(a) GDPR)
Taking into account any allergies or other dietary requirements you tell us about	Your explicit consent (Art. 9(2)(a) GDPR), which you give by voluntarily writing them in the form
Counting visits to learn which pages interest people (visit statistics)	Your consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE), which you give by pressing “Accept” and can withdraw at any time
Protecting the form against automated submissions	Legitimate interest in the security of the website (Art. 6(1)(f) GDPR)
Keeping the website secure and fixing its faults with the web server records	Legitimate interest in the security of the website (Art. 6(1)(f) GDPR)
Keeping the records of confirmed orders	Compliance with legal tax and accounting obligations (Art. 6(1)(c) GDPR)

We do not make automated decisions or create profiles using your data. We do not use it to send you advertising.

4. Retention period

Requests are kept for as long as they are useful for answering your enquiry or a possible order, until you ask for them to be deleted, which you may do at any time; once deleted, they may remain in backup copies until those copies are renewed. If a request becomes an order, the necessary data are kept for the periods required by commercial and tax legislation (six years under Article 30 of the Commercial Code (Código de Comercio) and four years under the General Tax Law (Ley General Tributaria)).

Visit statistics are kept for 25 months and then deleted automatically. The web server records are deleted after 14 days. Your choice about statistics is stored in your browser for 24 months.

5. Recipients and data processors

We do not sell or disclose your data to third parties, except where required by law. The following have access to it, as data processors and solely in order to provide their service to us:

• The website and its records, the visit statistics (Umami), the content management system that stores the requests and the studio's notification server run on servers located in Málaga (Spain) and managed by the studio.
• So that the studio hears about a request at once, its content is also sent as a notification to the studio's phones through ntfy (ntfy.sh), a push notification service created by Philipp C. Heckel. ntfy keeps the message on its servers for at most 12 hours and, according to its privacy policy, does not log its content.
• Email is sent and received through Microsoft 365 (Microsoft Ireland Operations Limited). If in any case the data are processed outside the European Economic Area, the transfer is covered by the safeguards provided for in the GDPR, such as the EU-U.S. Data Privacy Framework and the standard contractual clauses of the European Commission.

This website does not load any third-party analytics, advertising or social media tools. The visit statistics are the studio's own and are not shared with anyone.

6. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent you have given, without affecting the lawfulness of processing carried out before its withdrawal. Write to us at cakes@sosweetpastry.com from the address you used in your request, stating which right you wish to exercise. Consent to visit statistics is withdrawn with the “Statistics settings” button at the foot of every page, by pressing “Reject”: it is as easy as giving it.

If you consider that we have not processed your data correctly, you may lodge a complaint with the Spanish Data Protection Agency, Agencia Española de Protección de Datos (AEPD) (www.aepd.es).

7. Minors

The form is intended for people aged 14 or over. If you are under 14, please ask your mother, father or guardian to contact us.

8. Security

We apply appropriate technical and organisational measures to protect your data against loss, misuse or unauthorised access: the connection to the website is encrypted (HTTPS) and access to requests is restricted to the studio's staff.

9. Changes to this policy

If this policy changes, we will publish the new version on this page with its date of update. Requests that have already been answered are governed by the version in force at the time they were submitted.