Privacy Policy

Last updated: 18 September 2026

This Privacy Policy explains how we process and protect the personal data of users and customers that may be collected while browsing, buying a product or contracting a service through our website https://gimmesabor.com (the “Website”), and through the marketplaces where we sell our products.

We comply with the applicable data protection legislation: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

By using the Website you acknowledge this Privacy Policy.

Identity of the Data Controller

Data Controller: Guimarana Dream Food S.L.
Tax ID (NIF): B09987017
Address: Avenida Reino de Murcia 174, E1, P01 C, Zarandona, Murcia, Spain.
Email: info@gimmesabor.com
Phone: +34 601 43 74 01
Website: https://gimmesabor.com

Principles applied to data processing

When processing your personal data we apply the following principles of the GDPR:

Lawfulness, fairness and transparency: we process personal data only on a valid legal basis and inform you beforehand, transparently, of the purposes of the processing.
Data minimisation: we request only the data strictly necessary for each purpose.
Storage limitation: we keep personal data only for as long as necessary for the purposes of the processing, and inform you of the applicable retention period. Inactive subscription records are reviewed periodically and deleted.
Integrity and confidentiality: personal data is processed in a way that guarantees its security and confidentiality, and we take the necessary precautions to prevent unauthorised access or misuse by third parties.

Who we are and how we obtain personal data

You can browse the Website without providing any personal data. We collect personal data when you contact us, subscribe to our newsletter, leave a comment, create an account or place an order on the Website. We also receive order data (see “Data received through marketplaces” below) when you buy our products on third-party marketplaces.

What personal data we collect and why

Orders and purchases

When you buy a product or contract a service we may ask for your full name, tax identification number (where required for invoicing), email address, postal address, phone number and payment details. We use this data to maintain the commercial relationship, ship your orders, provide the contracted services, and handle invoicing and payment.

Contact forms and email

If you write to us through a form or by email we use your name, email address and message to answer your enquiry.

If you subscribe to our newsletter we use your email address (and name, if provided) to send you information about our products and activities. You can unsubscribe at any time using the link included in every message.

Comments

When visitors leave comments on the Website we collect the data shown in the comment form, as well as the visitor’s IP address and browser user-agent string to help detect spam. An anonymous string created from your email address (a hash) may be provided to the Gravatar service to check whether you are using it. Gravatar’s privacy policy is available at https://automattic.com/privacy/. After your comment is approved, your profile picture is publicly visible in the context of your comment.

User accounts

If you register on the Website we store the personal information you provide in your user profile. You can view, edit or delete your personal information at any time (except your username). Website administrators can also view and edit that information.

Media

If you upload images to the Website, you should avoid uploading images that include location data (EXIF GPS). Visitors can download and extract any location data from images on the Website.

Other purposes

To ensure compliance with applicable law and to keep the Website secure, including detecting spam and abuse.
To support and improve the services offered through the Website.
To analyse browsing. We collect non-identifying data through cookies stored on your device when you browse the Website, as described in our Cookie Policy.
To manage our social media presence. If you follow our social media profiles, the processing of your data is governed by this section and by the terms, privacy policies and access rules of the relevant social network. We never use follower profiles to send individual advertising. Privacy policies of the main networks:

Data received through marketplaces (including TikTok Shop)

We sell our products on third-party marketplaces, including TikTok Shop [CONFIRM: add or remove marketplaces, e.g. Miravia, Temu]. When you place an order there, the marketplace shares with us the data necessary to fulfil it (for example name, delivery address, phone number and order details). In relation to this data:

We use it exclusively to process, ship, invoice and provide after-sales support for your order, and to comply with our legal obligations. We do not use it for any other purpose.
We process it in our order-management and accounting systems, protected by access controls, encrypted connections and role-based permissions.
We support requests from users, sellers and marketplaces to access, update, delete or provide personal data, and respond to them as described in the “Your rights” section.
When our cooperation with a marketplace ends, we delete the customer data received through it, except where we are legally required to keep it (for example, accounting and tax records).
If we become aware of a personal data breach affecting this data, we will notify the affected marketplace without undue delay and, where required, within 72 hours.

Legal basis for processing

Consent of the data subject (for example, newsletter, comments, analytics cookies).
Performance of a contract or pre-contractual measures, in order to provide the product or service you purchased.
Compliance with legal obligations (for example, invoicing and tax obligations).
Legitimate interest in keeping the Website secure and preventing spam and fraud.

Categories of personal data

Identification and contact data.
Transaction data (orders, invoices, payment method).
Technical data (IP address, browser information).
We do not process special categories of personal data.

Data retention

Order, invoicing and payment data is kept for the periods required by Spanish accounting and tax legislation, and then deleted.
Contact enquiries are kept for as long as needed to handle them and for a reasonable period afterwards.
Newsletter data is kept until you unsubscribe or ask us to delete it, and inactive subscriptions are periodically removed.
Comments and their metadata are kept indefinitely so that we can recognise and approve later comments automatically, unless you ask us to delete them.
User account data is kept until you delete your account or ask us to delete it.

Recipients of personal data

We do not sell your personal data. We only share it with the following categories of recipients, and only when necessary:

Service providers (data processors) acting on our behalf under a data processing agreement: website hosting ([CONFIRM: hosting provider]), email and newsletter tools, order-management and accounting software (ERP), payment processors and shipping/logistics companies [CONFIRM: complete with the real providers].
Marketplaces where you place your order, when needed to manage that order.
Public authorities, where we are legally required to do so.
Google Analytics, a web analytics service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics uses cookies to help us analyse how users use the Website. The information generated by the cookie (including your IP address) may be transmitted to and stored by Google on servers in the United States. More information: Google Privacy Policy. Types of cookies used by Google: here. How Google uses cookies in advertising: here.

International data transfers

Some of our providers, such as Google, may process data outside the European Economic Area. In such cases we rely on appropriate safeguards under the GDPR, such as the EU-US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.

Web browsing and analytics

When you browse the Website, non-identifying data may be collected, such as IP address, approximate geolocation, a record of how the services and sites are used, browsing habits and other data that cannot be used to identify you directly. We use Google Analytics as a third-party analytics service. We use this information to obtain statistics, analyse trends, administer the Website, study browsing patterns and gather demographic information.

Cookies

The Website uses cookies, which are small pieces of information stored in your browser. You can find full information about the cookies we use in our Cookie Policy.

If you leave a comment you may choose to save your name, email address and website in cookies, which last one year. If you have an account and log in, we set a temporary cookie to determine whether your browser accepts cookies (deleted when you close the browser), login cookies (which last two days, or two weeks if you select “Remember me”) and screen options cookies (which last one year). If you edit or publish an article, an additional cookie containing only the article ID is saved and expires after one day. Login cookies are deleted when you log out.

Content from other websites

Pages on this Website may include embedded content (for example videos, images or articles). Embedded content from other websites behaves exactly as if you had visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking and monitor your interaction with that content, including if you have an account and are logged in to that website. We are not responsible for the processing of personal data carried out by the websites you access through links on our Website.

Your rights

You have the right to:

Access the personal data we hold about you.
Request rectification of inaccurate data or its erasure.
Request restriction of the processing of your data.
Object to the processing of your data.
Request data portability, i.e. receive your data in a structured, commonly used and machine-readable format.
Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, send your request to info@gimmesabor.com, together with a copy of your ID or equivalent proof of identity so that we can verify who you are. Rights are personal and must be exercised by the data subject. We will respond within one month of receiving your request (this period may be extended in complex cases, as allowed by the GDPR).

The exercise of these rights does not extend to data that we are required to keep for administrative, legal or security purposes.

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) and to seek effective judicial protection.

Data security

To protect your personal data we take all reasonable precautions and follow industry best practices to prevent its loss, misuse, unauthorised access, disclosure, alteration or destruction. These include encrypted connections (HTTPS/TLS), role-based access control limited to authorised personnel, multi-factor authentication on administrative accounts, regular software updates and malware scanning, and regular backups [CONFIRM each measure before publishing].

The Website is hosted by [CONFIRM: hosting provider], which applies its own security measures. You can consult its privacy policy for more information.

Procedure in case of a data breach

We keep an internal procedure to detect, contain, assess and record any security incident affecting personal data. If a personal data breach occurs, we will:

Take immediate steps to contain it and limit its impact.
Notify the Spanish Data Protection Agency without undue delay and, where feasible, within 72 hours, when required by the GDPR.
Notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms.
Notify affected marketplaces and business partners (including TikTok Shop where its data is involved) without undue delay.

Sources of the data we process

We obtain personal data directly from you (forms, orders, emails, comments) and, in the case of marketplace orders, from the marketplace where you bought the product.

Automated decision-making and profiling

We do not take decisions based solely on automated processing, and we do not carry out profiling that produces legal effects on users. Comments may be checked by an automated spam-detection service.

Regulatory disclosure requirements

We will disclose personal data to public authorities only when required by law or by a valid legal request.

Accuracy of personal data

You agree that the data you provide is correct, complete, accurate and up to date, and you are solely responsible for the accuracy of the data you submit.

Acceptance and consent

By using the Website you declare that you have been informed of the conditions on personal data protection and you accept the processing of your data by the Data Controller in the manner and for the purposes described in this Privacy Policy. To contact us, subscribe to the newsletter or post comments on the Website you must accept this Privacy Policy.

Changes to this Privacy Policy

We may modify this Privacy Policy to adapt it to legislative or case-law developments and to industry practices. The current version is always the one published on this page, and the date of the last update is shown at the top.