Privacy Policy
Effective date: [ДАТА]. The fields in square brackets are filled in by the shop owner.
1. Who processes your data
The owner of the True Food online shop at https://truefood-shop.com and the controller of personal data is [ПОЛНЫЕ ФИО], a sole trader (autónomo) registered in Spain, NIF/NIE: [НОМЕР]. Address: [ПОЛНЫЙ АДРЕС]. Email for data protection matters: [EMAIL]. Phone: [ТЕЛЕФОН]. Referred to below as «we» or «True Food».
2. What data we collect and why
Registration and account: name, email, sign-in details, saved addresses, order history - performance of a contract, Art. 6(1)(b) GDPR. Orders and delivery: full name, phone, email, address, order contents, recipient, delivery instructions - Art. 6(1)(b) GDPR. Payment: amount, currency, status and transaction identifier, refund details, and the limited payment-method data available to the shop - Art. 6(1)(b) and Art. 6(1)(c) GDPR. Accounting and tax records: order, invoice and payment data, and customer details where required - Art. 6(1)(c) GDPR. Support: contact details, correspondence and materials you provide - Art. 6(1)(b), other enquiries - Art. 6(1)(f) GDPR. Security: technical logs, IP address, sign-in events and transaction details to the extent necessary - Art. 6(1)(f) GDPR. Google Analytics: identifiers, visit events, device and interaction data within the service settings - consent, Art. 6(1)(a) GDPR.
Required fields and recipient data
Required fields are marked in the relevant form. Without the data needed for an order or delivery we cannot complete the purchase. Declining analytics does not prevent purchases. If you name another recipient, tell them about this policy and share only the data needed for delivery. We use the recipient details provided by the buyer to arrange delivery and give the recipient information about the processing within the periods required by law. [РЕКЛАМНАЯ РАССЫЛКА: наличие, сервис, данные, основание обработки и способ отписки.]
3. Payments through Stripe
Payments are processed through Stripe. Stripe receives the data needed to take the payment, verify the transaction and prevent fraud. Depending on the transaction, Stripe acts either as a processor on the shop's instructions or as an independent controller. Details are available in Stripe's policy (https://stripe.com/privacy). The Stripe entity serving this shop: [ЮРИДИЧЕСКОЕ ЛИЦО]. Payment-method data available to True Food: [ПЕРЕЧЕНЬ ДАННЫХ].
4. Who we share data with
Access to the necessary data may be given to providers of hosting and technical maintenance, payments, delivery, email, support and accounting. Data is disclosed to public authorities where there is a legal basis. Processors act under contract and within the tasks assigned to them; independent controllers carry out their own data protection duties. Our service providers: [НАЗВАНИЯ И ФУНКЦИИ ПОСТАВЩИКОВ].
5. Processing outside the EEA
Some providers may process data outside the European Economic Area. Such transfers are permitted where a GDPR basis exists: an adequacy decision or appropriate safeguards such as standard contractual clauses and any necessary supplementary measures. Information about the applicable safeguards and a copy of them can be requested at [EMAIL]. International transfer details: [ПОСТАВЩИК, СТРАНА, ПРИМЕНИМОЕ ОСНОВАНИЕ И ССЫЛКА НА ГАРАНТИИ].
6. Retention periods
Account data: while the account is active; after closure we delete or anonymise data that is no longer needed within [СРОК]. Orders, invoices and payments: for the mandatory tax and accounting retention periods and the applicable limitation periods; [СРОКИ ХРАНЕНИЯ УЧЁТНЫХ ДОКУМЕНТОВ]. Support enquiries: until the matter is resolved, then [СРОК], unless a dispute or the law requires longer. Security logs: [СРОК]; data about a specific incident until its review is complete and the applicable limitation period ends. Google Analytics data: [ФАКТИЧЕСКАЯ НАСТРОЙКА И ЕЁ ОБЛАСТЬ ДЕЙСТВИЯ]. Records of consent: for the period of the relevant processing and as long as needed to demonstrate its lawfulness - [КРИТЕРИЙ/СРОК]. Where further retention is mandatory, we limit the use of the data to that purpose. Deleting an account does not immediately delete documents we must keep by law. Backup deletion cycle: [СРОК].
7. Your rights
Where the GDPR provides for it, you may request access, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interests. For direct marketing, the right to object applies at any time. Consent can be withdrawn without affecting the lawfulness of processing carried out beforehand. Write to [EMAIL]. If there are reasonable doubts about the identity of the person making the request, we will ask only for the additional information needed. We normally reply within one month; if an extension is permitted, we will tell you and explain why within the first month. You may contact the Agencia Española de Protección de Datos (https://www.aepd.es/) or the competent supervisory authority, in particular where you habitually live or work.
8. Cookies, automated decisions and updates
Information about cookies, their providers, purposes, lifetimes and consent management is available in the Cookie Policy (/en/cookies). Settings can be changed through the Cookie settings button at the bottom of any page. Analytics is enabled only after the corresponding consent. Automated decisions producing legal or similarly significant effects: [НАЛИЧИЕ; ПРИ ПРИМЕНЕНИИ - ЛОГИКА, ПОСЛЕДСТВИЯ И ПРАВА ПОЛЬЗОВАТЕЛЯ]. We update this policy when our processing changes. The current version and its date are published on this page. If a change requires new consent, we will ask for it separately.