Privacy policy

F&P Digital Consulting SL, NIF B70973193, Avenida Navarra 18-20, 8º 2ª, 08911 Badalona (Barcelona), Spain, is the controller of its own processing operations described here. Contact for privacy and rights: hello@fp-dc.eu.

This policy covers the data of visitors, people who contact F&P, merchants' account holders and contact persons, and users of F&P's own services. For orders placed with a store, the seller identified in it is the controller of the processing it decides on in order to sell, serve the buyer and manage its campaigns or loyalty schemes. F&P acts as its processor for the processing entrusted to it, not as the commercial owner of its customer file. The seller's policy explains that processing.

Buyer accounts. The identity and record of each buyer belong to the sphere of the merchant with whom the buyer deals. There is no global Don Barrio buyer account that brings together the records of different merchants. A single merchant may manage several stores, and the store serves as the context for browsing and service. The same person who buys from two merchants has independent records; sharing an email address does not authorise merging identities or revealing purchases or rewards held with others. F&P provides this management on behalf of the merchant, without any commercial reuse between merchants.

We process the data you provide to us when you contact us or sign up: identification, contact details, professional activity, representation, tax and billing data, the plan contracted and communications. We also process the technical logs necessary for access to and security of the service, within the scope and periods of our inventory. When the company you work for provides your contact details, we use them to manage that professional relationship and we inform you on the terms legally required.

Contracting and service. We manage registration, access, plan, payments, support and necessary communications. The legal basis is the performance of the contract or pre-contractual measures requested where you are a party, and the legitimate interest in dealing with the entity you represent when you act as its professional contact. We do not fictitiously apply another party's contract as the basis for all of its employees.

Legal obligations. We process the information necessary to invoice, keep accounts and comply with valid requests, on the basis of the corresponding legal obligation. The defence of claims is limited to the data necessary and to the legal basis that applies.

Our own security. We protect accounts and infrastructure and prevent abuse on the basis of legitimate interest, after a balancing assessment, and of the applicable obligations. This does not turn all processing of orders into a purpose of F&P's own: security carried out on behalf of the merchant remains within the scope of the processing assignment.

Enquiries. We handle the requests you send to F&P on the basis of pre-contractual measures you request or of the legitimate interest in replying to a communication. You do not need to consent to advertising in order to receive a reply.

Commercial communications from F&P. They will be sent to those who have requested or authorised them and, in the strictly permitted cases under the LSSI, to previous customers about similar services of our own, with a simple means of objection from the point of collection and in every message. We do not reuse the data of store buyers for this purpose. Consent may be withdrawn without affecting the lawfulness of earlier processing; objection to direct marketing will be respected without any need to give a reason.

Cookies and similar technologies. Their purpose, legal basis and management are explained in the cookie policy. Technologies subject to consent are not activated merely because you use the site.

Required fields will be identified as such; without the essential data it may not be possible to provide the function requested. Optional data is not presented as mandatory. The processing does not include the commercial sale of buyer records or their use to train AI for F&P's own purposes.

Allergies and identifiers in stores. When a store offers the optional field for allergies or intolerances, personal indications are collected for the specific order on behalf of the merchant. The store must provide its specific information and obtain the necessary explicit consent before collecting them, unless another applicable legal basis and exception applies. They are not the declared allergens of the product. We do not use them for our own prospecting, sale of records, commercial uses between merchants or training of models for our own purposes. Identity document numbers that may be requested for a justified function are not mandatory for every purchase and are not used as a password. The merchant's information will identify its need, legal basis and retention period; a full copy of the document is not presumed to be necessary.

Access is given to authorised F&P staff and to the providers that actually take part in hosting, communications, support and other services, under the contract and role that applies to them. These are the providers involved as of the date of this policy: Clever Cloud SAS (France), for hosting the application, the database and file storage, in the Paris region; Mailgun, of the Sinch group, for sending transactional email, in the European Union region; Sentry (Functional Software, Inc., United States), for technical error logging, in the European Union region (Germany); Stripe Payments Europe, Limited (Ireland), for payments; and OpenAI Ireland Ltd. (Ireland), for the artificial-intelligence assistance functions that the merchant enables. F&P's support is provided from Spain. Payment providers may act as independent controllers for verifications, regulatory compliance and operations of their own; their role will be reported specifically, without presenting all of them as processors.

We may disclose data to authorities where there is a legal obligation, and to advisers or courts when necessary for a claim and there is a legal basis. We do not transfer buyer records to other businesses for them to exploit.

Where there are transfers outside the European Economic Area, information will be given on the following. Sentry's and Stripe's processing may involve transfers to the United States: both declare their adherence to the EU-U.S. Data Privacy Framework, with the European Commission's standard contractual clauses as a fallback safeguard. Mailgun (Sinch) applies standard contractual clauses and, for Sinch Email, that same Framework. OpenAI Ireland Ltd. applies standard contractual clauses or a European Commission adequacy decision. These are the safeguards the providers themselves publish in their terms and data processing agreements, and F&P applies no additional supplementary measures of its own. You can request information about these safeguards at hello@fp-dc.eu.

We keep the operational data of the relationship for as long as it is necessary to provide it; when it ends we apply the relevant exit and erasure procedures. Accounting documents and supporting records subject to Article 30 of the Spanish Commercial Code are kept, as a general rule, for six years from the last entry, without prejudice to special obligations. The ordinary four-year tax limitation period does not amount to a universal deletion period and may be affected by interruptions or by later tax effects.

Documentation necessary for claims is kept for the applicable periods, restricted or blocked where appropriate, and not as an active marketing base. The minimum list of objections is kept for as long as necessary to respect them. Actual retention periods as of the date of this policy, by type of data: commercial presentation requests are kept for twenty-four months after they are closed and are then deleted automatically; support references expire after 72 hours and are deleted automatically thirty days after expiry; messages sent through the contact form reach the product's support mailbox and do not yet have an automatic deletion period, so you can ask for their deletion at hello@fp-dc.eu. Retention periods of technical and security logs, by type: Sentry error reports are kept for between 30 and 90 days, depending on the plan contracted with that provider; expired temporary accesses to tax documents are deleted automatically; audit logs of the actions carried out in the service (who did what and when) are kept for as long as the relationship lasts and do not yet have an automatic deletion period; and server operation logs depend on the hosting provider. F&P has not set a single period for all logs. The retention of a log is extended only in the event of a specific incident or legal duty, and only for the time strictly necessary.

Buyer data processed on behalf of a store follows the merchant's instructions and retention periods, the data processing agreement and the exit rights. F&P's own accounting obligations do not justify keeping all the orders and customers of each store.

You may request access, rectification, erasure, restriction, objection and portability where applicable, withdraw consents and request information about a legitimate interest balancing assessment, by writing to hello@fp-dc.eu. Identify the processing and your request; we will ask for additional proof of identity only when it is necessary and proportionate. We will deal with the request within the legal time limits, normally one month, with the reasoned legal extension where applicable.

For data relating to a purchase, you may contact the seller identified in the store. If you contact F&P about processing it carries out as a processor, we will forward the request to the controller and help it to handle the request. You may lodge a complaint with the Spanish Data Protection Agency (AEPD) or the competent supervisory authority, without waiving other remedies.

Automated decisions and profiling. Don Barrio does not take decisions about individuals based solely on automated processing that produce legal effects concerning them or similarly significantly affect them. The service's AI assistance functions only propose drafts that the person reviews before using them.

We will publish the date and version of the policy in force and will communicate material changes by appropriate means. An informational update does not by itself create a new legal basis or replace a consent that is required.