Privacy Policy

1. Data Controller

Holiday Fridge S.L. is the data controller responsible for processing your personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR) and Spain's Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPD-GDD).

2. Categories of Personal Data We Collect

Depending on your interaction with our services, we may collect the following categories of personal data:

• Identifying data: Name, surname, email address, telephone number, postal/delivery address
• Accommodation details: Holiday rental address, property access information, arrival dates
• Transaction data: Order history, payment information (processed securely via our payment provider), invoices
• Preferences: Dietary requirements, product preferences, language settings
• Technical data: IP address, browser type, device information, cookies
• Communication data: Correspondence with our customer service team

3. Purposes and Legal Basis for Processing

We process your personal data for the following purposes:

4. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account data: Until you request account deletion, plus any legally required retention period
• Order and transaction data: 6 years from the transaction date (Spanish tax law requirement)
• Marketing communications: Until you withdraw consent or unsubscribe
• Customer service communications: 3 years from the last interaction
• Cookies: Maximum 24 months, as per AEPD guidelines

5. Data Recipients and Transfers

We do not sell your personal data. We may share your data with the following categories of recipients, acting as data processors on our behalf:

• Delivery partners: To fulfill grocery deliveries to your accommodation
• Payment processors: To securely process your payments (e.g., Stripe)
• Cloud service providers: For secure data hosting and storage
• Analytics providers: To help us understand and improve our services
• Email service providers: To send transactional and marketing emails

We may also disclose your data to Spanish law enforcement authorities or courts when required by law.

Some of our service providers may be located outside the European Economic Area. In such cases, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses or adequacy decisions by the European Commission.

6. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right of Access (Art. 15): Obtain confirmation of whether we process your data and request a copy
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your data when no longer necessary
• Right to Restriction (Art. 18): Request limitation of processing under certain circumstances
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw any consent given at any time, without affecting prior processing
• Right to Automated Decisions (Art. 22): Not be subject to solely automated decision-making with legal effects

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond within one month of receiving your request.

7. Cookies

Our website uses cookies to enhance your browsing experience. In accordance with AEPD (Spanish Data Protection Agency) guidelines:

• Essential cookies: Required for website functionality (no consent needed)
• Analytics cookies: Help us understand how visitors use our site (require consent)
• Marketing cookies: Used to deliver relevant advertisements (require consent)

You can manage your cookie preferences at any time through our cookie settings panel. Consent is valid for a maximum of 24 months, after which we will request it again.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit using SSL/TLS protocols
• Encryption of sensitive data at rest
• Regular security assessments and updates
• Access controls limiting data access to authorized personnel
• Secure payment processing through PCI-DSS compliant providers

9. Filing a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD):

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting a notice on our website or sending you an email. The "Last updated" date at the top indicates when this policy was last revised.

11. Contact Us

For any questions about this Privacy Policy or our data practices, please contact us: