Privacy policy

Controller: CRD La Petita Vegana, Sociedad Limitada.

Tax ID: B26962860.

Address: Carrer d'Anna Maria Martinez, 23, Horta-Guinardo, 08041 Barcelona.

Privacy contact email: admin@lapetitavegana.es.

Forms may process name, email, phone if provided, preferred location, event date, guest count, subject, message and technical metadata needed to receive the request.

Menu notifications process email, preferred location and communication consent.

Unsubscribe requests process the email and optional message to record the request.

Contact form: answer general questions, orders, collaborations or location enquiries.

Catering form: prepare and reply to quotes for events or groups.

Menu notification and newsletter forms: send new menus, news, seasonal dishes or promotions when accepted by the user.

Unsubscribe form: stop sending communications to the email provided.

Contact, catering and requested orders: pre-contractual steps requested by the user or replies to enquiries initiated by them.

Menu, newsletter and promotional communications: explicit consent through an unchecked box or voluntary request, with the option to withdraw consent at any time.

Unsubscribe requests: compliance with withdrawal of consent and minimum proof retention to show the request was respected.

Technical security: legitimate interest in keeping the site working, preventing abuse and protecting forms and systems.

Legal obligations: when a request becomes a commercial relationship, data needed for tax, accounting or legal-claim obligations may be retained.

Operational recommendation: keep contact and catering enquiries for up to 12 months after the last interaction, unless there is a contractual relationship, legal obligation or incident that justifies longer retention.

Communication contacts are kept until consent is withdrawn or the user unsubscribes.

Consent or unsubscribe evidence should be kept for up to 3 years after unsubscribe or the last communication, only to prove that the request was respected.

Technical security logs should be kept for up to 12 months unless there is an incident.

Form answers are sent to the technical endpoint configured for La Petita Vegana and routed, depending on form type, to email, request management or communications lists.

The current endpoint uses AWS services in European regions to receive the request and send the email: API Gateway and Lambda in eu-south-2, and Amazon SES in eu-central-1.

Data may be processed through technical providers for hosting, forms, email, analytics and communications management, acting as processors where applicable.

Personal data will not be sold to third parties or used for incompatible purposes.

An international transfer exists if a provider processes or may access personal data from outside the European Economic Area. This can happen with Google, email, form or CRM tools if they use global infrastructure.

The forms endpoint is configured in European AWS regions. Even so, each final provider's contractual documentation should be checked to confirm whether access or support from outside the European Economic Area exists and which safeguards apply, such as an adequacy decision, the EU-US Data Privacy Framework or standard contractual clauses.

You can request access, rectification, erasure, objection, restriction, portability and withdrawal of consent by writing to the privacy email.

You may also lodge a complaint with the Spanish Data Protection Agency at https://www.aepd.es/.

This policy is based on the GDPR, Spanish Organic Law 3/2018 on data protection and digital rights, and Spanish Law 34/2002 on information-society services and electronic commerce.