Privacy policy

1. Data controller

• OKOME
• Contact: hola@okome.es · +34 695 477 234

2. Data we process

• Orders: name, email, phone, address and postcode (delivery only), chosen day and time, products, amount and comments.
• Contact form: name, email, topic and message.
• Technical data: your IP address is used for a few minutes to limit abuse and is not stored.

If you tell us about an allergy or intolerance in a comment, you are giving us health data. We use it only to prepare your order safely, with your explicit consent when you write it, and for nothing else.

3. Purposes and legal basis

• Managing, preparing and delivering your order and sending the confirmation: performance of a contract (art. 6.1.b GDPR).
• Meeting accounting and tax obligations: legal obligation (art. 6.1.c GDPR).
• Answering your enquiry: your request and consent (art. 6.1.a and 6.1.b GDPR).
• Protecting the website from abuse: legitimate interest (art. 6.1.f GDPR).
• Taking into account allergies you tell us about: explicit consent (art. 9.2.a GDPR).

We do not send advertising, sell your data or build profiles.

4. How long we keep it

• Orders: while needed to manage them, then blocked for the legal retention periods (up to 6 years under article 30 of the Spanish Commercial Code).
• Contact enquiries: as long as needed to reply, and one year at most.
• IP address used to limit abuse: a few minutes, not stored.

5. Who can access it

We do not share your data with third parties unless required by law. We work with providers that process it on our behalf with GDPR safeguards:

• Hostinger: hosting of the website, database and email.
• Google: only if you choose to load the Google Maps map. This may involve transfers to the United States covered by the EU-US Data Privacy Framework.

6. Your rights

You can request access, rectification, erasure, objection, restriction and portability of your data, and withdraw your consent at any time, by writing to hola@okome.es and stating which right you wish to exercise. If you believe your request was not properly handled, you can complain to the Spanish Data Protection Agency (www.aepd.es).

7. Security

We use encrypted connections, ask only for the data we need, and access to orders is restricted to staff with a password.

8. Minors

Orders and the contact form are intended for people aged 14 or over.

9. Changes

We may update this policy. The date of the latest update is shown at the top of the page.