Privacy policy

1. Introduction

This Privacy Policy explains how Borona Bistró collects, uses, shares, and protects personal data when you visit this website or place an order with us. We are committed to processing your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Spanish data protection law. Please read this policy carefully to understand our practices regarding your personal data.

2. Controller

The controller responsible for the processing of personal data on this website is:
Borona Bistró
Calle General Ezponda
10003 Cáceres, Spain
Email: contact@Boronas.shop
Phone: 34669842926

If you have any questions about this Privacy Policy or about how your personal data is processed, please contact us using the details above.

3. What Personal Data We Collect and Why

We only collect personal data that is necessary for the purposes described below. Depending on how you interact with our website, this may include the following categories of data.

3.1 When You Visit the Site

When you browse our website, our server temporarily logs certain technical information for security and reliability purposes, including your IP address, the date and time of access, the requested URL, the referring page, and information about your browser and operating system. This processing is based on our legitimate interest in ensuring the security and stable operation of our website (GDPR Art. 6(1)(f)).

3.2 When You Place an Order

To process and fulfill your order, we collect the information necessary to do so, including your name, billing and shipping address, email address, phone number (optional), and payment details. This data is processed because it is necessary for the performance of the contract between you and us (GDPR Art. 6(1)(b)).

3.3 When You Contact Us

If you contact us, for example by email or through a contact form, we store the content of your message together with your contact details so that we can respond to your enquiry. This processing is based on the performance of a contract or pre-contractual measures, and on our legitimate interest in handling and responding to enquiries directed to us (GDPR Art. 6(1)(b) and (f)).

3.4 Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, including to comply with any applicable legal, accounting, or reporting obligations. Once personal data is no longer required for these purposes, it is deleted or anonymized.

4. Sharing of Personal Data

We do not sell your personal data. We share personal data with third parties only in the following circumstances:

  • where you have given your explicit consent to the sharing;
  • where sharing is necessary to fulfill a contract with you, for example to deliver your order or process payment;
  • where we are subject to a legal obligation requiring disclosure; or
  • where we have a legitimate interest in sharing the data, in accordance with GDPR Art. 6(1)(f).

5. Cookies

Our website uses cookies that are strictly necessary for its technical functioning. These cannot be disabled without affecting the operation of the site. Optional cookies, such as those used for analytics or marketing purposes, are only placed on your device after you have given your consent through our cookie banner. You may withdraw this consent at any time.

6. Services We Use

This website is hosted on the Shopify platform, operated by Shopify Inc., 150 Elgin Street, Ottawa, ON, K2P 1L4, Canada. As a result, personal data processed through this website may be accessed or stored by Shopify in the course of providing its hosting services.

Payments made on this website are processed by our configured payment providers. Each payment provider processes your payment data under its own privacy policy, and we encourage you to review the relevant policy of the provider used at checkout.

7. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

  • the right to request access to your personal data (Art. 15);
  • the right to request correction of inaccurate or incomplete data (Art. 16);
  • the right to request deletion of your data (Art. 17);
  • the right to request restriction of processing (Art. 18);
  • the right to data portability (Art. 20);
  • the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)); and
  • the right to lodge a complaint with a supervisory authority (Art. 77), including the Spanish Data Protection Agency (Agencia Española de Protección de Datos), or the supervisory authority of your habitual residence, place of work, or place of the alleged infringement.

8. Right to Object

Where the processing of your personal data is based on our legitimate interest, you have the right to object to that processing at any time under GDPR Art. 21. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defense of legal claims.

9. Exercising Your Rights

To exercise any of the rights described above, or if you have any questions about how we process your personal data, please contact us at contact@Boronas.shop. We will respond to your request in accordance with applicable data protection law.