ESROEN

Menu

ESROEN

Privacy

Your data, with the same care as a glaze: only what is needed, and well kept

Updated on 13 October 2026

Informative translation. The legally binding text is the Spanish one: read the Spanish version.

Who is responsible

The controller of the data you give us is Moft. For anything about your data, write to us or drop by the display case.

Owner
Carla Luiza Mic
NIE
Y3506600B
Trade name
Moft, Pastelería Artesanal
Address
Plaza de la Constitución, 1, 11300 La Línea de la Concepción (Cádiz), Spain

What data we process

To browse this website we ask you for nothing. We only process data in these cases:

  • Reservations and orders by WhatsApp or phone: your name, your number, the message and the order details (product, collection date, number of people, ideas for the cake).
  • Allergies or intolerances, if you tell us so that your order is safe.
  • Contact form (Visit us), if you write to us from the website: your first name and surname, your email, your phone and the message.
  • Newsletter, if you subscribe: your first name, surname and email address, together with the date and the text you accepted when subscribing. We will also know whether you open our emails and which links you click. If you use your welcome coupon, we keep the date you redeem it.
  • Browsing, only if you accept the analytics or advertising cookies: the pages you visit, for how long, from what kind of device and where you come from (with your IP shortened). More in Cookies.
  • Instagram and other networks, if you write to us there: your username and your message.
  • In the shop, payment details are handled directly by the card terminal's bank; we do not keep them.

What we use them for and why

Reservations and orders
To prepare your order, confirm it and let you know when it is ready. Basis: handling the order you ask us for (art. 6.1.b GDPR).
Answering questions
To answer what you ask us. Basis: your consent when you write to us (art. 6.1.a GDPR).
Welcome coupon
To generate your personal coupon, check it and mark it as used when you redeem it in the shop. Basis: your consent when you subscribe (art. 6.1.a GDPR).
Newsletter
To send you news, offers and exclusives from the display case, and to know what interests you so the emails are useful. Basis: your consent when you subscribe (art. 6.1.a GDPR and art. 21 LSSI-CE).
Website statistics
To know how many people visit us and which pages work best. Basis: your consent in the cookie notice (art. 6.1.a GDPR and art. 22.2 LSSI-CE).
Advertising
To show you Moft adverts on Instagram or Facebook and measure whether they work. Basis: your consent in the cookie notice.
Invoices
To issue your invoice if you ask for one and to comply with the tax authorities. Basis: legal obligation (art. 6.1.c GDPR).

If you accept the advertising cookies, Meta may link your visit to your profile in its services to show you Moft adverts. We do not take automated decisions that significantly affect you.

The newsletter

We only write to you if you have subscribed yourself. When you sign up we send you a welcome email with your coupon, and every newsletter has a link to unsubscribe in one click. You can also ask us on WhatsApp or in the shop.

We send them with Mailchimp, which keeps your email address on our behalf and only uses it to send our newsletters.

Allergies and intolerances

Information about allergies is health data and we handle it with special care. We only use it to prepare your order safely, with your express consent when you tell us (art. 9.2.a GDPR), and we delete it when the order has been handed over. We never use it for the newsletter or for advertising.

You can withdraw that consent at any time; however, without that information we will not be able to adapt your cake.

How long we keep it

  • Conversations about reservations and orders: until you collect the order and, at most, 12 months after that, in case an incident or complaint has to be dealt with.
  • Allergy data: until we hand over the order.
  • Contact form messages: until we reply and, at most, 12 months after that.
  • Newsletter: until you unsubscribe. If you open none of our emails for 24 months, we will unsubscribe you ourselves.
  • Browsing statistics: 14 months, the period we set in Google Analytics.
  • Your cookie choice: 12 months; then we ask you again.
  • Invoices: the time required by tax law (generally 6 years).

Who we share it with

We do not sell your data to anyone. Only these third parties are involved, each for its own part:

  • WhatsApp (Meta), if you write to us there. WhatsApp processes your data according to its own privacy policy.
  • Our newsletter platform Mailchimp, if you subscribe.
  • Google (Analytics), only if you accept the analytics cookies, and Google Maps, only if you load the map in Visit us.
  • Meta (Facebook and Instagram), only if you accept the advertising cookies.
  • Supabase, which stores the newsletter and contact form data on servers in the European Union (Ireland) on our behalf.
  • Our web hosting provider Cloudflare, Inc., which keeps technical server logs.
  • Our accountant, for the bookkeeping and invoices.
  • Public authorities, only when the law requires us to.

Data outside the European Union

Google, Meta, Mailchimp, Cloudflare and Supabase (a US company, with servers in the European Union) may process data in the United States. They do so under the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

Your rights

You can ask us at any time for:

  • Access: to know what data of yours we hold.
  • Rectification: to correct any that are wrong.
  • Erasure: to delete them.
  • Objection and restriction: to stop using them, or to use them only for something specific.
  • Portability: to receive them in a format you can take with you.
  • Withdrawing your consent whenever you like: unsubscribing from the newsletter or changing your cookies in Cookie Settings.

Write to us at [email protected] or ask in the shop. We will reply within one month at most. If you think we have not looked after your data properly, you can complain to the Spanish Data Protection Agency at aepd.es.

Minors

We do not knowingly process the data of children under 14: they cannot subscribe to the newsletter. If you are a minor and want to order a cake, ask your mother, father or guardian to do it with you.

Changes to this policy

If we change anything important, we will update it here and change the date above. This policy is governed by the General Data Protection Regulation (EU 2016/679), Organic Law 3/2018 (LOPDGDD) and Law 34/2002 (LSSI-CE).