GDPR Information

Last updated: August 2024

This page provides information about how Casa del Té complies with the General Data Protection Regulation (GDPR) for individuals in the European Economic Area.

Data Controller

Casa del Té is the data controller responsible for your personal data. Our contact details are:

Casa del Té
Calle de la Paz 42
28012 Madrid, Spain
Email: [email protected]

Legal Basis for Processing

We process your personal data based on the following legal grounds:

Consent: When you submit a contact form or subscribe to communications, you provide consent for us to process your data for those purposes.
Contract: When you make a purchase, we process your data as necessary to fulfill our contractual obligations.
Legitimate Interest: We may process data for website analytics and security purposes based on our legitimate business interests.
Legal Obligation: We may process data to comply with applicable laws and regulations.

Your Rights Under GDPR

As a data subject in the European Economic Area, you have the following rights:

Right of Access: You have the right to request a copy of the personal data we hold about you.
Right to Rectification: You have the right to request that we correct inaccurate or incomplete personal data.
Right to Erasure: You have the right to request deletion of your personal data in certain circumstances.
Right to Restriction: You have the right to request that we restrict processing of your personal data in certain circumstances.
Right to Data Portability: You have the right to receive your personal data in a structured, commonly used format and to transmit it to another controller.
Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw that consent at any time.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. We may need to verify your identity before processing your request.

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected. Customer inquiry data is typically retained for two years. Transaction records are retained for the period required by tax and accounting regulations.

International Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area. When this occurs, we ensure appropriate safeguards are in place to protect your data in accordance with GDPR requirements.

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, and regular security assessments.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

Supervisory Authority

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In Spain, the relevant authority is:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid
www.aepd.es

Changes to This Information

We may update this GDPR information from time to time. Any changes will be posted on this page with an updated revision date.