I. Privacy and data protection policy
The company undertakes to adopt the necessary technical and organisational measures, at a level of security appropriate to the risk posed by the data collected.
Laws incorporated into this privacy policy
This policy complies with the following regulations:
- Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (GDPR).
- Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPD-GDD).
- Royal Decree 1720/2007, of 21 December.
- Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).
Identity of the data controller
- Data controller: Irene Rubio Sánchez
- DNI: 05308190-C
- Address: C/ Echegaray n.º 5, local comercial, 29015, Málaga
- Telephone: 625 07 50 57
- Email: info@labodegadelmasaje.com
Registration of personal data
The personal data collected will be incorporated into files in order to facilitate, expedite and fulfil the commitments established, or to respond to the user's requests and enquiries. A record of processing activities is maintained specifying the purposes, as established in the GDPR.
Principles applicable to the processing
The processing is subject to the principles of Article 5 of the GDPR and of Articles 4 et seq. of the LOPD-GDD: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
Categories of personal data
Only identifying data are processed. No special categories of personal data within the meaning of Article 9 of the GDPR are processed.
Legal basis for the processing
The legal basis is consent. The company undertakes to obtain the user's express and verifiable consent for the processing of their data for specific purposes. The user has the right to withdraw their consent at any time, and withdrawing it is as easy as giving it. Where the user must provide data through forms, they will be informed whether the completion of certain fields is mandatory.
Purposes of the processing
The data are collected and managed to facilitate, expedite and fulfil the commitments established; to maintain the relationship established through forms; and to respond to requests or enquiries. Likewise, they may be used for commercial purposes of personalisation, operations and statistics; for activities inherent to the corporate purpose; for marketing studies; to tailor the content to the user; and to improve quality, functioning and navigation.
Retention periods
The data are retained for the minimum time necessary and, in any event, for 12 months or until the user requests their erasure.
Recipients of the personal data
The data may be shared with Google Spain, S.L. (Paseo de la Castellana, 216, planta 7, 28046 Madrid). Should the company intend to transfer data to a third country or international organisation, the user will be informed about that country or organisation and about the existence or absence of an adequacy decision by the Commission.
Data of minors
In accordance with Article 8 of the GDPR and Article 7 of the LOPD-GDD, only those over 14 years of age may give their consent to the processing of their data. For those under 14 years of age, the consent of their parents or guardians is required.
Secrecy and security of the data
The company undertakes to adopt the necessary technical and organisational measures at a level of security appropriate to the risk, guaranteeing the security of the data and preventing their accidental or unlawful destruction, loss or alteration. The website has an SSL certificate, which ensures the secure and confidential transmission of the data through encryption. The data are treated as confidential.
User rights
The user may exercise the rights of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection, and not to be subject to decisions based solely on automated processing (including profiling).
Exercise of rights
The user may exercise their rights by written communication addressed to the data controller with the reference "RGPD-https://labodegadelmasaje.com/", stating name, surname(s) and a copy of the DNI; the request together with its grounds; the address for notifications; the date and signature; and the documents evidencing the request.
- Postal address: C/ Echegaray n.º 5, local comercial, 29015, Málaga
- Email: info@labodegadelmasaje.com
Links to third-party websites
The website may include hyperlinks to third-party pages not operated by La Bodega del Masaje. Their owners have their own data protection policies and are responsible for their own files and privacy practices.
Complaints to the supervisory authority
If the user considers that there is a problem in the processing of their data, they have the right to lodge a complaint with the supervisory authority. In Spain, the supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos).
II. Acceptance of and changes to this policy
Use of the website implies acceptance of this privacy policy. The company reserves the right to modify it at its discretion or as a result of legislative, case-law or doctrinal changes. It is recommended that you consult this page periodically.
Last updated: 13 February 2025.