Privacy Policy

The data controller is Fini Golosinas España SL, CTRA DE MADRID Km 380, 30500 Molina de Segura, Spain. You can reach us at [email protected].

• Account data: email address, password (stored encrypted), name and phone number.
• Order data: delivery address, items ordered, amounts, chosen currency, delivery and payment method, order notes.
• Communication data: messages you send through our contact form or by email.
• Technical data: IP address, browser type, device information and pages visited, collected through essential cookies and server logs.

• To perform our contract with you — processing, delivering and supporting your orders.
• To comply with legal obligations — accounting, tax and consumer-protection record keeping.
• Legitimate interests — keeping the site secure, preventing fraud and improving our service.
• Consent — optional cookies. You can withdraw consent at any time.

We never sell your personal data. We share it only with service providers who help us run the shop, under data-processing agreements:

• Hosting and database providers that store our website and order records.
• Delivery partners, who receive your name, address and phone number to deliver your parcel.
• Payment providers, when online card payment is used.
• Authorities, where required by law.

Some providers may process data outside your country. Where this happens we rely on adequacy decisions or Standard Contractual Clauses to protect your data.

Order and invoice records are kept for as long as tax law requires (typically 6–10 years). Account data is kept until you delete your account. Contact messages are deleted after 24 months.

You have the right to access, correct, delete, restrict or object to the processing of your data, and to receive it in a portable format. You may also lodge a complaint with your local data-protection authority.

To exercise your rights, email [email protected]. We reply within 30 days.

We use cookies and similar technologies as described in our Cookie Policy.

Data is transmitted over encrypted connections (HTTPS), passwords are hashed, and access to customer records is restricted so each customer can only see their own orders.

Our shop is not directed at children under 16, and we do not knowingly collect their data.

We may update this policy. The date at the top shows when it last changed; significant changes will be announced on the website.