Skip to content

Privacy policy

This English text is a courtesy translation. In the event of any discrepancy between this translation and the Spanish version, the Spanish version shall prevail.

At cazorla.online we process your personal data with respect and in accordance with Reglamento (UE) 2016/679, General de Protección de Datos (RGPD) (EU General Data Protection Regulation, ‘GDPR’), and Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD) (Spanish Data Protection and Digital Rights Act). In this policy we explain who processes your data, for what purposes, on what legal basis, for how long, to whom it is disclosed and what your rights are.

1. Who is the controller of your data?

  • Controller: Manuel Bello Vázquez (cazorla.online)
  • Tax ID (NIF): 26473416W
  • Postal address: Plaza Santa María, 5, 23470 Cazorla, Jaén
  • Email: ventas@cazorla.online
  • Telephone: 711 52 34 70

2. For what purposes do we process your data, on what legal basis and for how long?

We only process the data that you yourself provide to us, for the purposes set out below:

Enquiries and requests for information

  • Purpose: To respond to the enquiries you send us via the contact form, by email, by telephone or through social media and, where applicable, to send you the information you request.
  • Legal basis: Your consent when you send us the enquiry (Art. 6(1)(a) GDPR) and, where the enquiry is made prior to entering into a contract with us, the taking of pre-contractual steps at your request (Art. 6(1)(b) GDPR).
  • Retention: For as long as necessary to deal with your enquiry and, thereafter, for up to one year, unless a business relationship is established.
  • Is providing the data mandatory? In order to reply to you, we need at least your name and a means of contact.

WhatsApp messages

  • Purpose: To deal with the enquiries and bookings you send us via WhatsApp.
  • Legal basis: Your consent when you write to us through this channel (Art. 6(1)(a) GDPR).
  • Retention: For as long as necessary to deal with your message and, thereafter, for up to one year, unless a business relationship is established.
  • Recipients: WhatsApp Ireland Limited (Meta group), which provides the messaging service and may process data in the United States with the safeguards of the EU-U.S. Data Privacy Framework.

Customers and invoicing

  • Purpose: To manage the relationship with our customers: provision of the service or sale, invoicing, collection of payments and after-sales service.
  • Legal basis: The performance of the contract (Art. 6(1)(b) GDPR) and compliance with legal tax and accounting obligations (Art. 6(1)(c) GDPR).
  • Retention: For the duration of the relationship and, thereafter, for the statutory periods: six years for accounting records (art. 30 del Código de Comercio (Spanish Commercial Code)) and four years for tax purposes (Ley General Tributaria (Spanish General Taxation Act)).
  • Recipients: The Administración Tributaria (Spanish tax authorities), banks and payment institutions for the collection of payments and, where applicable, the tax and accounting advisory firm as data processor.
  • Is providing the data mandatory? Invoicing data are required by law.

Online shop orders

  • Purpose: To manage the orders you place in the online shop: account registration (if you create an account), payment, shipping, returns, warranty and after-sales service.
  • Legal basis: The performance of the contract of sale (Art. 6(1)(b) GDPR) and compliance with legal tax, accounting and consumer-protection obligations (Art. 6(1)(c) GDPR).
  • Retention: For as long as you hold an account or have orders in progress and, thereafter, for the statutory periods: six years for accounting records and four years for tax purposes, and for the duration of the product warranty period.
  • Recipients: Transport and courier companies for delivery, payment institutions for the collection of payment (which process your card details; we do not see them) and the Administración Tributaria.
  • Is providing the data mandatory? Without your shipping and invoicing details we cannot process the order.

Once the retention periods have expired, the data are blocked for as long as liability arising from the processing may be claimed and are then erased.

We do not take automated decisions or carry out profiling using your data.

3. What data do we process?

Identification and contact data (name, email address, telephone number) and any data you include in your messages or requests, as well as the shipping and invoicing details of your orders. We do not ask you for special categories of data (health, ideology, ethnic origin…); please do not include them in your messages.

If you provide us with data relating to other people (for example, other people in your company or your family), you undertake to have informed them and to have obtained their consent.

4. To whom do we disclose your data?

We do not disclose your data to third parties, except where required by law (for example, to the Administración Tributaria or to the courts and tribunals) or where necessary to provide the service you request from us, as indicated for each purpose.

In order for the website and our services to function, we rely on providers that process data on our behalf (data processors), with whom we have signed the contracts required by Article 28 GDPR:

  • Web hosting: Hostinger International Ltd., with servers in the European Union.
  • Website design, development and maintenance: VeoVirtual (Fernando Martínez Marín).

In addition, the website uses the following third-party services:

5. International transfers

Some of the providers listed may process data outside the European Economic Area. In such cases, the transfer is based on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework, for participating companies) or on the standard contractual clauses approved by the European Commission (Art. 46 GDPR), which guarantee a level of protection equivalent to that in Europe.

6. What are your rights?

You have the right to:

  • Access: find out whether we process your data and obtain a copy.
  • Rectification: have inaccurate or incomplete data corrected.
  • Erasure: request that we delete your data where, among other grounds, they are no longer necessary.
  • Restriction: request that we retain your data solely for the exercise or defence of claims.
  • Objection: object to our processing of your data on grounds relating to your particular situation.
  • Portability: receive the data you have provided to us in a structured, commonly used format, or have us transmit them to another controller.
  • Withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
  • Not be subject to decisions based solely on automated processing.

You may exercise these rights by writing to ventas@cazorla.online or by post to Plaza Santa María, 5, 23470 Cazorla, Jaén, stating the right you are exercising and providing proof of your identity. We will reply within one month. On the website of the Agencia Española de Protección de Datos (Spanish Data Protection Agency) you will find template forms for exercising your rights (opens in a new tab).

If you consider that we have not processed your data correctly, you may lodge a complaint with the Agencia Española de Protección de Datos (opens in a new tab) (C/ Jorge Juan, 6, 28001 Madrid). We would be grateful if you would contact us beforehand so that we can try to resolve the matter.

7. Minors

The website is not directed at children under the age of 14. If you are under that age, do not provide us with any data without the consent of your parents or guardians (Art. 7 LOPDGDD).

8. Accuracy and security of data

You warrant that the data you provide to us are true and undertake to notify us of any changes. For our part, we apply appropriate technical and organisational measures to protect your data against loss, unauthorised access or alteration, including the website’s encrypted connection (HTTPS).

9. Changes to this policy

We may update this policy to adapt it to changes in the law or in our services. We recommend that you review it periodically; the date of the last update is shown at the end.

Last updated: 3 November 2026.