This Privacy Policy applies to any processing of personal data carried out by Pastelería Mandul, S.L.U. or by any company within its corporate group (hereinafter, “Pastelería Mandul” and the “Policy”, respectively).

The purpose of this Policy is to address any questions you may have regarding the processing of your personal data as a data subject. If you require further information, you may contact:: rrhh@mandul.com

Please read this Policy carefully, as it provides the information you need to make an informed decision when providing us with your personal data.

What definitions should I know to better understand the Policy?

To help you, below are definitions of certain terms used in this document:

• “Activities, Products and/or Services”: invitations to commercial, informative, sporting, recreational or leisure events; information about promotions, competitions, prize draws; and commercial information relating to food and gastronomy.
  
  
• “Anonimización”.– uso de un conjunto de técnicas destinadas a suprimir la capacidad de asociar los datos a una persona física identificada o identificable mediante un esfuerzo «razonable». Esta «prueba de razonabilidad» debe tener en cuenta tanto los aspectos objetivos (tiempo, medios técnicos) como los elementos contextuales, que pueden variar de un caso a otro (carácter excepcional de un fenómeno teniendo en cuenta, por ejemplo, la densidad de la población y la naturaleza y volumen de los datos).
  
  
• “Disclosure of data”: any disclosure of data to a natural or legal person, public authority, agency or other body, whether or not it is a Third Party.
  
  
• “Standard Contractual Clauses”: a mechanism that enables the regulation of international transfers of personal data to countries outside the European Economic Area by means of a contract based on the model approved by the European Commission.
  
  
• “Consent”: a freely given, unambiguous, specific and informed indication of the data subject’s wishes authorising the processing of personal data.
  
  
• “Cookies”: small files or devices installed in the user’s browser in order to store, retrieve or update information. They allow a website publisher to learn users’ browsing preferences on its site and to tailor the services offered accordingly. You can find more information in Pastelería Mandul’s Cookie Policy here.
  
  
• “Personal data”: any information relating to a natural person that identifies them or makes them identifiable (first and last name, address, telephone number, email, etc.).
  
  
• “Data Protection Officer” (DPO): a data-protection specialist who informs and advises the Pastelería Mandul group and the employees who carry out processing on the obligations incumbent on them under the GDPR.
  
  
• “Recipient”: a natural or legal person, public authority, agency or other body to whom personal data are disclosed, whether or not a Third Party.
  
  
• “Profiling”: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
  
  
• “Pastelería Mandul group companies with a commercial activity that receive Personal Data”: those companies within its group included in the relevant list, to which the disclosure of customers’ personal data is limited.
  
  
• “Processor”: a natural or legal person, public authority, agency or other body which processes personal data on behalf of and under the instructions of another (the Controller). In some cases Pastelería Mandul acts as processor for all its subsidiaries or third-party providers, given the centralised management of many organisation and business matters.
  
  
• “Geolocation”: any data processed within an electronic communications network indicating the geographic position of the terminal equipment of a data subject of a publicly available electronic communications service.
  
  
• “Mayrit Group”: the group of companies, for the purposes of Article 42 of the Spanish Commercial Code, to which Pastelería Mandul belongs.
  
  
• “Data Subject”: for the purposes of this Policy, any natural person who is the holder of the data being processed.
  
  
• “Binding Corporate Rules” (BCRs): the personal data-protection policies adopted by a controller or processor established in the territory of a Member State for transfers or sets of transfers of personal data to a controller or processor in one or more third countries, within a corporate group or a group of enterprises engaged in a joint economic activity.
  
  
• “Pseudonymisation”: the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
  
  
• “Controller”: a natural or legal person, public authority, agency or other body which determines the purposes and means of the processing of personal data. For the purposes of this Policy, the companies of the Mayrit Group.
  
  
• “Online Services”: includes any website, environment, channels, applications and promotions.
  
  
• “Third Party”: a natural or legal person, public authority, agency or body other than the Data Subject, the Controller, the Processor and the persons who, under the direct authority of the Controller or Processor, are authorised to process personal data.
  
  
• “International Transfers”: instances in which personal data are processed outside the European Economic Area.
  
  
• “Processing”: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  
  
• “Pastelería Mandul Unique User”: the user account you create when you register in Pastelería Mandul’s Unified Register in order to access the Online Services of any entity of the Pastelería Mandul group, the content of which is included in your user account in the Unified Register (“Your Account”).

Pursuant to Article 13 of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, you are hereby informed that your data will be processed by Pastelería Mandul as the controller.

The purpose of the processing is the management and control of contacts regarding content downloaded from Pastelería Mandul. This processing is based on the consent provided, which may be withdrawn at any time without affecting the lawfulness of processing carried out prior to its withdrawal.

Data will not be disclosed to third parties, except to companies of the Mayrit Group, or where required by a court order or by law-enforcement authorities.

The data collected will be kept for three years and, in any case, for as long as necessary to comply with applicable legislation.

If you do not authorise or accept these terms, it will not be possible to manage your contact on behalf of Pastelería Mandul.

You may exercise your rights of access, rectification, erasure, restriction or objection, as well as the right to data portability, by sending a written request to Pastelería Mandul via the email address provided.

If you consider that the processing does not comply with current regulations, you may lodge a complaint with the supervisory authority at AGPD