Delivery to mainland Spain and the Balearic Islands

Bona Brasa Buy

Privacy policy

The Spanish version of this text is legally binding. This English version is provided for information.

This policy explains which personal data we process when you visit bonabrasa.es or buy from our shop, what we use it for and what rights you have. We apply Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR, in Spanish RGPD), and Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD).

Data controller

Danyel André Maus (Bona Brasa), Cami des Jardi den Ferrer 72, 07141 Marratxí (Illes Balears), Spain. Tax ID (NIF/VAT): ESX7770719P. Email: hola@bonabrasa.es.

We are not required to appoint a data protection officer. For any question about your data, please write to us at the address above.

What data we process, why and on what legal basis

1. Visiting the website

When you open our pages, the server technically logs your IP address, the date and time, the page requested, your browser and your operating system. We need this to show you the website and keep it secure. Legal basis: our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). We do not use analytics, advertising or tracking tools.

2. Orders

When you make a purchase, we process your name, delivery and billing address, email address, telephone number (if you provide it), the products, the amounts and the order history. We use this data to process your order, deliver it, keep you informed about it and handle guarantee claims and returns. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with legal obligations, in particular tax and accounting obligations (Art. 6(1)(c) GDPR). Without this data we cannot accept the order.

3. Payment

Payment takes place on Stripe’s secure page. Your card details or other payment details are received and processed directly by Stripe; we neither see nor store them. Stripe informs us of the payment result and of the contact and delivery details you enter there. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Stripe also processes data to prevent fraud under its own responsibility; please see the Stripe privacy policy.

4. Online withdrawal

If you use the “Withdraw from contract here” function, we process your name, email address, order number, your comment and the date and time of submission in order to process the withdrawal and send you the acknowledgement of receipt. Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR) and performance of the contract (Art. 6(1)(b) GDPR).

5. Contact by email

If you write to us, we process your email address and the content of your message in order to reply. Legal basis: performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR) or our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR).

Recipients

  • Web hosting and email: ALL-INKL.COM, Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, as data processor. The servers are located in Germany (European Union).
  • Payments: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.
  • Delivery: the carrier delivering your order receives your name, delivery address and, where needed to notify you of the delivery, your telephone number or email address.
  • Tax advisers and public authorities: where required by law, for example the Spanish Tax Agency (Agencia Estatal de Administración Tributaria).

We do not sell your data or pass it on for advertising purposes.

International transfers

Stripe may process data in the United States through Stripe, Inc. This transfer is based on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, under which Stripe, Inc. is certified, and additionally on the European Commission’s standard contractual clauses.

Retention periods

  • Order and invoice data: 6 years from the end of the financial year, in accordance with Article 30 of the Spanish Commercial Code (Código de Comercio) and tax legislation.
  • Withdrawal statements: kept together with the order they relate to, for the same period.
  • Enquiry emails: for as long as necessary to deal with your enquiry and, at most, for the limitation periods of any possible claims.
  • Technical server logs: for the period set by the hosting provider for security reasons, usually a few days.
  • Login attempts to the administration area: 24 hours.
  • Copy of the text of the emails we send you (sending log): 90 days; date, recipient and subject are kept together with the order.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time by writing to hola@bonabrasa.es. We will reply within one month. Where processing is based on our legitimate interest, you can object on grounds relating to your particular situation.

If you believe that we are not processing your data correctly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

Cookies

We only use strictly necessary technical cookies. You will find the full list in our Cookie policy.

Automated decision-making

We do not make decisions based solely on automated processing of your data, nor do we carry out profiling.

Security

The website is served over an encrypted connection, and we apply appropriate technical and organisational measures to protect your data against loss, unauthorised access or misuse.

Last updated: 26 October 2026