Your privacy matters to us. This policy explains how Magda Sweet Cakes processes the personal data you provide, in accordance with the EU General Data Protection Regulation (GDPR) 2016/679 and Spanish Organic Law 3/2018 (LOPDGDD).
Data controller
Magdalena Rejón Ruiz (Magda Sweet Cakes) — NIF 74687039J
Calle Prosperidad 114, Local 7, 18004 Granada (Spain)
Email: hola@magdasweetcakes.com · Phone: +34 722 360 476
What data we process and why
When you fill in the quote request form or contact us by email or WhatsApp, we process the data you provide —name, email, phone and your event details (date, place, number of guests and preferences)—. When you buy from the weekly shop, we also process the contents and value of your order, your collection slot, its status and the references needed to reconcile the payment or issue a refund.
If you choose to create a customer account, we process your name, email address, password protected with a non-reversible hash, verification date and latest access records. An account is optional and you may check out as a guest.
We use this data:
- To answer your enquiry and prepare and send your personalised quote.
- To manage and follow up the relationship prior to a possible order (tastings, design proposals).
- To keep the contact needed to provide the contracted service, where applicable.
- To reserve stock, charge, prepare and fulfil weekly-shop orders, and to manage changes, cancellations and refunds.
- To create and protect your account, verify your email and show you only your own orders.
- To prevent abuse, unauthorised access and payment fraud.
Card details are entered directly in Stripe's secure environment; Magda Sweet Cakes does not store the complete card number or security code. We do not request special categories of personal data.
Legal basis
For enquiries and quotes, the legal basis is your consent and the application of pre-contractual measures requested by you (Art. 6.1.a and 6.1.b GDPR). Processing orders, payments, collections and an account you request is necessary to perform our contract (Art. 6.1.b). We retain documents required by legal obligations (Art. 6.1.c) and apply security and fraud-prevention measures on the basis of our legitimate interests (Art. 6.1.f).
Retention
We keep your data for as long as needed to handle your request and provide the service. Orders and supporting records are retained for the applicable tax, commercial and potential-claim periods. Account data is retained while the account remains active or until you request its deletion, without prejudice to restricting any information that must be kept by law. If no contractual relationship arises, we delete the data when it is no longer needed or when you withdraw your consent.
Recipients and processors
We do not sell or disclose your data to third parties except where legally required. To provide the service, we use processors with access limited to the data they need: our VPS hosting provider (website and Honoré system), Cloudflare (authoritative DNS only; it does not act as a proxy or CDN for the public website), Stripe (payments and fraud prevention), and Google Ireland Limited / Google LLC (Gmail for verification, order and customer-service emails). See the privacy policies of Cloudflare, Stripe and Google.
Some providers may process data outside the European Economic Area. Where applicable, the safeguards required by the GDPR are used, such as adequacy decisions, the EU–US Data Privacy Framework or Standard Contractual Clauses, depending on the service.
Only if you accept analytics cookies do Google Ireland Limited / Google LLC (Google Analytics 4) and Microsoft Corporation (Microsoft Clarity) also take part. See policies.google.com/privacy and privacy.microsoft.com.
Analytics (only with your consent)
We use Google Analytics 4 (ID G-DM9DB0D9WM) and Microsoft Clarity (ID xm00zfzxz8) to understand how the site is used and to improve it. They are loaded only if you accept analytics cookies in the banner. When accepted, they set first-party cookies such as _ga, _ga_*, _gid (Google) and _clck, _clsk, CLID, ANONCHK, MR (Microsoft) lasting up to 2 years. They may involve international transfers to the US under the EU-US Data Privacy Framework and Standard Contractual Clauses. You can withdraw consent at any time via the banner (switch to “Reject”) or by deleting cookies in your browser. Without acceptance, no analytics are loaded.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time, by writing to hola@magdasweetcakes.com stating the right you wish to exercise. If you believe your request has not been properly handled, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
Security
We apply reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration. Passwords are not stored in readable form, and the customer session uses a secure, server-only cookie with a limited lifetime.
Last updated: 24 August 2026. Includes the weekly shop, customer accounts, Stripe, Gmail and direct VPS hosting.