Last updated: 15 October 2026
At Drip Café we take the protection of your personal data seriously. This policy explains how we handle it under Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on Personal Data Protection and the guarantee of digital rights (LOPDGDD).
1. Data controller
- Identity: [COMPANY NAME / FULL NAME], Tax ID [NIF/CIF]
- Address: [FULL ADDRESS], Marbella (Málaga), Spain
- Email: info@dripcafe.es
- Phone: +34 686 764 503
- Data Protection Officer: [Not appointed / contact details]
- EU representative (if applicable): [details]
2. What data we process, why and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Answer enquiries from the contact form, email or phone | Name, email, phone and message | Consent (Art. 6.1.a GDPR) |
| Send news (newsletter), if you subscribe | Name and email | Consent (Art. 6.1.a GDPR and Art. 21 LSSI-CE) |
| Handle bookings or orders, if offered | Name, contact and order details | Performance of a contract (Art. 6.1.b GDPR) |
| Handle job applications, if received | CV data | Consent (Art. 6.1.a GDPR) |
| Website security and legal obligations | Technical connection data | Legitimate interest (Art. 6.1.f) and legal obligation (Art. 6.1.c GDPR) |
| Statistics and advertising through non-essential cookies | Browsing data | Consent, see the Cookie Policy |
Fields marked with an asterisk in forms are mandatory. If you do not provide them, we cannot handle your request. We do not take automated decisions or create profiles with legal effects on you.
3. Retention period
- Contact enquiries: for as long as needed to handle them and then up to [12 months] for possible claims.
- Newsletter: until you withdraw consent or unsubscribe.
- Job applications: up to [12 months].
- Data kept for legal obligations (for example, tax): for the periods set by law.
After these periods, data is blocked and kept only for the authorities during the limitation period for liabilities, and then deleted.
4. Recipients of the data
We do not sell your data. Service providers acting on behalf of Drip Café may access it under a data processing agreement (Art. 28 GDPR):
We may also disclose data to public authorities, judges and courts where there is a legal obligation.
5. International transfers
If any provider is outside the European Economic Area, the transfer will use appropriate safeguards: an adequacy decision (for example, the EU-US Data Privacy Framework for certified companies) or standard contractual clauses approved by the European Commission. [Complete according to the actual providers].
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time (without affecting the lawfulness of earlier processing). To do so, write to info@dripcafe.es stating the right you are exercising and attaching a copy of your ID. We will reply within one month at most.
If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es.
7. Minors
The Website is not aimed at children under 14. If you are under 14, you need the consent of your parents or guardians to give us personal data.
8. Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration, including an encrypted connection (HTTPS).
9. Social networks
We have Instagram and Facebook profiles. When you interact with them, your data is also handled under each platform’s privacy policy.
10. Changes to this policy
We may update this policy to reflect legal or service changes. The current version is always the one published on this page.