Privacy policy

This Privacy Policy provides clear and transparent information about how we collect, use, retain and protect your personal data when you visit cremacheesecakes.com, contact us, subscribe to our newsletter or make a purchase.

This policy governs the processing of the personal information of all individuals who interact with Crema Cheesecakes through this website.

Before using the website, we recommend that you read this Privacy Policy together with the Legal Notice, the Terms and Conditions of Sale and the Cookie Policy.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we hereby inform you of the conditions under which your personal data will be processed.

1. Who is responsible for processing your data?

Data controller: Crema Cheesecakes S.L.
Trading name: Crema Cheesecakes
Tax identification number: B-27538842
Registered office: P. I. Rebullón, s/n, 36416 Mos, Pontevedra, Spain
Email address: info@cremacheesecakes.com
Telephone:+34 886 40 10 27
Website: cremacheesecakes.com
Business activity: Production and online sale of cheesecakes and other baked goods.
Company registration details: Registered with the Commercial Registry of Pontevedra, entry 1, company record PO-76761, IRUS 1000470609552.

2. What personal data do we collect?

The personal data we collect depends on how you interact with Crema Cheesecakes and the products or services you request.

We may process the following categories of personal data:

Identification data: first name and surname.
Contact data: postal address, billing address, delivery address, email address and telephone number.
Contractual and commercial data: purchased products, order details, purchase history, incidents, returns, purchase-related communications and preferences expressed by the customer.
Billing data: name or company name, tax identification number, tax address and any other information required to issue an invoice.
Payment-related data: information required to manage, authorise and confirm payment for orders.
Browsing data: IP address, device type, operating system, browser, pages visited, date and time of access, activity carried out on the website and information obtained through cookies or similar technologies.
Subscription data: email address, name where provided, date and source of subscription, proof of consent and subscription status.
Data provided in enquiries: any information you voluntarily include in forms, messages or communications sent to Crema Cheesecakes.

Crema Cheesecakes S.L. does not directly store the full bank card details used to make payments. These details are processed by Shopify Payments, PayPal or the relevant financial institutions through their own secure systems.

3. How do we obtain your personal data?

We may obtain your personal data through the following channels:

When you make a purchase through the online store.
When you create or use a customer account.
When you complete a contact form.
When you contact us by email or telephone.
When you request an invoice, return, amendment or cancellation.
When you subscribe to our newsletter.
When you browse the website and consent to the use of cookies.
When the providers required to manage a payment, shipment or order send us information related to the transaction.

4. For what purposes do we process your data?

4.1. Purchase and order management

We will process your data to handle orders placed through cremacheesecakes.com, manage payment, prepare the products, arrange delivery and keep you informed about the status of your purchase.

This processing may include the following activities:

Confirming and processing the order.
Checking product availability.
Managing payment and verifying the outcome of the transaction.
Preparing, packaging and shipping the order.
Providing the necessary information to the transport company.
Providing shipment status and tracking information.
Issuing invoices, confirmations and receipts.
Managing amendments, cancellations, returns and refunds.
Handling incidents or complaints related to the purchase.
Complying with applicable tax, accounting and legal obligations.

4.2. Creation and management of customer accounts

Where the website allows customer accounts to be created, we will process the data provided in order to register and maintain the account, identify the user, provide access to its features and allow the user to view orders and personal information.

Users are responsible for keeping their login credentials confidential and for reporting any unauthorised use of their account.

4.3. Handling enquiries and requests

When you contact Crema Cheesecakes, we will use the data you provide to respond to your enquiries, requests, suggestions, complaints or incidents.

We may also use your data to maintain the communications required until the matter has been fully resolved.

4.4. Invoicing and compliance with legal obligations

We will process the data required to issue invoices, keep accounting and tax records and comply with the legal obligations applicable to Crema Cheesecakes S.L.

4.5. Newsletter subscription and marketing communications

When you subscribe to the Crema Cheesecakes newsletter, we will process your email address and, where applicable, your name and any preferences you have provided in order to send you news, promotions, discounts, product launches and other marketing communications related to Crema Cheesecakes.

We use Shopify Email, a tool integrated into the Shopify platform, to manage subscriptions and send communications.

Through Shopify Email, we may process your email address, name where provided, date and source of subscription, proof of consent, unsubscribe status and certain technical information related to delivery and interaction with the messages sent.

The legal basis for this processing is your consent, given by completing the subscription form or ticking the corresponding checkbox.

You may withdraw your consent and unsubscribe at any time by using the link included in each communication or by writing to info@cremacheesecakes.com .

Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

4.6. Security and fraud prevention

We may process certain data to ensure website security, protect user accounts, verify the legitimacy of transactions and prevent misuse, unauthorised access, fraud, non-payment or other unlawful activity.

4.7. Website analytics and improvement

Where you have consented to the use of analytics cookies, we will use measurement and analytics tools to understand how users interact with the website, analyse its performance, detect errors and improve its content, design, performance and browsing experience.

We use the following tools:

Google Analytics 4: a web analytics service that provides statistical information about the use of the website, such as pages visited, session duration, device used, approximate location and user interactions.
Microsoft Clarity: a behavioural analytics tool that provides information about how users interact with the website through clicks, scrolling, cursor movements, heatmaps and session recordings.

Fields and elements that may contain personal or sensitive information must be configured so that their content is hidden or masked in the analytics tools.

These tools will only be activated after the user has given consent through the cookie settings panel, unless a specific feature may lawfully be used without consent under the applicable regulations.

You may withdraw your consent or change your preferences at any time through the cookie settings panel. Further information is available in our Cookie Policy.

5. What is the legal basis for processing your data?

The legal bases that authorise the processing of your data are:

Performance of a contract or implementation of pre-contractual measures: where processing is necessary to manage an order, process a payment, deliver products, maintain a customer account or respond to a request related to a potential purchase.
Compliance with a legal obligation: where we are required to retain or process data in order to comply with tax, accounting, administrative, health, consumer protection or other legally enforceable obligations.
Consent of the data subject: for sending marketing communications, installing non-essential cookies or carrying out any other processing that requires prior authorisation.
Legitimate interests: to protect the website and its users against misuse and fraud, ensure system security, manage complaints and defend the rights and interests of Crema Cheesecakes S.L.

6. How long will we retain your data?

We will retain your personal data only for as long as necessary to fulfil the purpose for which it was collected and, afterwards, for the legally required periods needed to address any potential liabilities.

Customer and order data: for the duration of the contractual relationship and afterwards for the applicable statutory periods.
Accounting records and invoices: for a general period of six years, without prejudice to any other tax or legal periods that may apply.
Data required to comply with tax obligations: for the period established by applicable tax legislation.
Enquiries and requests: for the time required to resolve them and afterwards for as long as necessary to address any potential liabilities.
Customer account data: while the account remains active and until the user requests its deletion, unless the data must be retained to comply with legal obligations.
Marketing communications: until the user withdraws consent or requests to unsubscribe.
Proof of consent for communications: for the period necessary to demonstrate that the subscription was validly completed and to address any potential liabilities.
Data obtained through cookies: for the periods indicated in the Cookie Policy.

Once the data is no longer required, it will remain blocked for the applicable limitation periods and will subsequently be securely deleted.

7. Who will receive your data?

Crema Cheesecakes S.L. does not sell or disclose your personal data to third parties for their own marketing purposes.

However, in order to manage the online store and provide the requested services, certain providers may access your data or receive the information strictly necessary to perform their functions.

7.1. E-commerce platform

The online store is hosted and managed through Shopify.

Shopify may process identification, contact, browsing, account, order, billing, delivery and transaction data in order to host the store, enable browsing, manage customer accounts, process orders and provide the platform's features.

Where Shopify processes data on behalf of Crema Cheesecakes S.L. in order to provide the online store services, it will be subject to the relevant contractual data protection obligations.

7.2. Payment service providers

We use the following providers to process payment for orders:

Shopify Payments: Shopify's integrated payment processing platform. It may process the identification, contact, transaction, device and payment data required to authorise the transaction, process payment, prevent fraud, manage refunds and comply with applicable legal obligations.
PayPal: when you select PayPal as your payment method, the data required to process the transaction will be disclosed to the relevant PayPal group entities. PayPal will process the information in accordance with its own terms and privacy policy.

Crema Cheesecakes S.L. does not access or store full bank card details. These details are entered and processed directly by the payment service providers through their secure environments.

7.3. Transport and delivery of orders

We use MRW to ship and deliver orders.

MRW may receive the information strictly necessary to manage transport, such as the recipient's name and surname, delivery address, telephone number, email address, order number and any information required to coordinate delivery or resolve incidents.

Depending on the agency or company that actually provides the service, it may process certain data under its own responsibility in order to manage transport and delivery.

7.4. Website analytics

Where you have accepted analytics cookies, the following providers may receive or process information about your browsing:

Google Analytics 4: to obtain statistics about website traffic, visits and use.
Microsoft Clarity: to analyse user interactions, generate heatmaps and replay browsing sessions for the purpose of improving the user experience.

These services may process, among other information, online identifiers, IP addresses, browser and device information, pages visited and interactions carried out within the website.

7.5. Newsletter management

We use Shopify Email, a tool integrated into the Shopify platform, to manage subscriptions and send newsletters.

Shopify Email may process email addresses, names where provided, the date and source of subscription, proof of consent, unsubscribe status and certain technical information related to delivery and interaction with the messages sent.

This information will be used to manage subscriptions and send news, promotions, discounts, product launches and other marketing communications related to Crema Cheesecakes, provided that the user has given prior consent.

7.6. Development, support and maintenance

Companies or professionals responsible for the development, support and maintenance of the website may occasionally access certain data where necessary to resolve incidents, carry out updates or ensure the proper operation and security of the store.

These providers will be subject to the relevant confidentiality and data protection obligations.

7.7. Other recipients

Where necessary, the following parties may also receive or access the data:

Hosting, security and technology infrastructure providers.
Email and transactional communications providers.
Tax, accounting, administrative or legal advisers.
Public authorities, law enforcement agencies, courts, tribunals and other authorities where there is a legal obligation to disclose the data.

Providers acting as data processors will be subject to the corresponding data processing agreement, requiring them to process the data in accordance with the instructions of Crema Cheesecakes S.L., maintain confidentiality and implement the security measures required by law.

8. International data transfers

Some of the technology providers used by Crema Cheesecakes S.L., particularly Shopify, Google, Microsoft and PayPal, may form part of international corporate groups, maintain infrastructure outside the European Economic Area or allow certain data to be processed from third countries.

Shopify provides both the e-commerce platform and the Shopify Email tool used to manage marketing communications.

Where international transfers of personal data take place, they will be carried out in accordance with the mechanisms provided for under the General Data Protection Regulation, including, where applicable:

An adequacy decision adopted by the European Commission.
Certification of the recipient entity under the EU-US Data Privacy Framework, where applicable.
Standard Contractual Clauses approved by the European Commission.
Binding corporate rules or other appropriate safeguards recognised under applicable data protection law.

Crema Cheesecakes S.L. will take reasonable measures to verify that such transfers have a valid legal basis and provide an appropriate level of protection.

You may request further information about providers, international transfers and the safeguards applied by writing to info@cremacheesecakes.com .

9. What are your rights?

Everyone has the right to obtain confirmation as to whether Crema Cheesecakes S.L. is processing personal data concerning them.

You may exercise the following rights:

Right of access: to find out what personal data we process about you.
Right to rectification: to request the correction of inaccurate or incomplete data.
Right to erasure: to request the deletion of your data where it is no longer required or where any of the circumstances provided for by law apply.
Right to object: to request that we stop processing your data in certain circumstances.
Right to restriction of processing: to request that processing be restricted in the cases provided for by law.
Right to data portability: to receive your data in a structured, commonly used and machine-readable format and transmit it to another controller where applicable.
Right to withdraw consent: to withdraw consent given for a specific purpose at any time.
Right not to be subject to solely automated decisions: not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you, where applicable.

To exercise any of these rights, you may submit a request to:

Email address: info@cremacheesecakes.com
Postal address: Crema Cheesecakes S.L., P. I. Rebullón, s/n, 36416 Mos, Pontevedra, Spain.

The request should include:

The data subject's first name and surname.
The right they wish to exercise.
The information required to locate the relevant data.
A valid address or means of receiving the response.

Where there are reasonable doubts regarding the identity of the person making the request, we may ask for additional information in order to verify their identity.

Where you act through a representative, the representation must be properly evidenced.

10. Right to lodge a complaint

If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with the Spanish Data Protection Agency.

Further information is available on the official website of the Spanish Data Protection Agency: www.aepd.es .

Before lodging a complaint, you may contact Crema Cheesecakes S.L. at info@cremacheesecakes.com so that we can address your request.

11. Children's data

This website is not intended for children under the age of 16.

Individuals under the age of 16 must not provide personal data or make purchases without the authorisation of their parents, guardians or legal representatives.

If Crema Cheesecakes S.L. becomes aware that it has collected personal data from a child without the corresponding authorisation, it will take the necessary measures to delete that data.

12. Accuracy and truthfulness of the data

Users are responsible for ensuring that the personal data they provide is truthful, accurate, complete and up to date.

Users undertake to notify us of any changes to their data and not to provide information relating to third parties without having a lawful basis to do so.

Crema Cheesecakes S.L. will not be liable for any harm arising from false, inaccurate or outdated information provided by the user.

13. Security and confidentiality

Crema Cheesecakes S.L. implements the technical and organisational measures required to protect personal data against destruction, loss, alteration, unauthorised access, disclosure or processing.

The website uses an SSL certificate and the HTTPS protocol to encrypt the transmission of information between the user's browser and the server.

Employees, collaborators and providers authorised to process personal data will be subject to the corresponding confidentiality obligations.

However, users should be aware that no system connected to the Internet can guarantee absolute security against every possible threat.

14. Data breaches

In the event of a personal data breach, Crema Cheesecakes S.L. will take the necessary measures to contain it, analyse its effects and reduce any potential risks.

Where legally required, the incident will be reported to the Spanish Data Protection Agency and the affected individuals will be informed without undue delay.

15. Withdrawal of consent

Consent given for the processing of personal data may be withdrawn at any time by writing to info@cremacheesecakes.com .

Withdrawal of consent will not have retroactive effect and will not affect the lawfulness of processing carried out before consent was withdrawn.

16. Links to third-party websites

The website may contain links to services or websites operated by third parties. Crema Cheesecakes S.L. does not control the privacy policies or data protection practices of those third parties.

Before providing personal information on an external website, we recommend that you review its privacy policy.

17. Changes to this Privacy Policy

Crema Cheesecakes S.L. reserves the right to amend this Privacy Policy in order to adapt it to legislative, case-law or technical developments, or to changes in the processing activities carried out through the website.

Where changes are significant, users will be informed through the website itself or by other appropriate means.

Last updated: 6 August 2026.