Privacy Policy

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), this policy explains how personal data is processed on www.thegourmet-box.com.

1. Data controller

TENAS PARTNERS SL
Tax ID (NIF): B01927037
Registered at the Madrid Companies Register (Registro Mercantil de Madrid), Volume 40841, Folio 190, Sheet M-724539
Address: C/ Andrés Mellado 106, 6th floor, 28003 Madrid, Spain
Phone: +34 661 512 383
Email: contact@thegourmet-box.com

2. Data we process and purposes

• Proposal request form (name, company, business email, country, optional phone, number of boxes, desired date, message): to handle your request, prepare and send a commercial proposal and manage the subsequent B2B relationship.
• Live chat (Crisp), only if you accept cookies: to answer your questions in real time.
• Web analytics (Google Analytics 4), only if you accept cookies: to measure site usage in aggregate and improve it.
• Advertising (Google Ads), only if you accept cookies: to measure whether a visit from an ad ends in a proposal request. We do not run remarketing or personalised advertising.
• Technical browsing data (IP address, browser, pages visited): site security and hosting server logs.

We make no automated decisions with legal effects and do not profile you.

3. Legal basis

• Proposal requests and quotes: pre-contractual measures at your request (art. 6(1)(b) GDPR).
• Subsequent commercial relationship with professional contacts: legitimate interest (art. 6(1)(f) GDPR and art. 19 LOPDGDD). You may object at any time.
• Chat, analytics and ad measurement: your consent, given in the cookie banner (art. 6(1)(a) GDPR and art. 22.2 LSSI-CE), which you can withdraw at any time via "Cookie settings".
• Security and server logs: legitimate interest in keeping the site secure (art. 6(1)(f) GDPR).

4. Recipients and processors

Your data is not shared with third parties unless legally required. We use the following providers, acting as processors or recipients:

• EmailJS Inc. (USA): delivery of site forms to our mailbox.
• Vercel Inc. (USA): website hosting and access logs.
• Google Ireland Ltd. (Ireland) and Google LLC (USA): Google Analytics 4 and Google Ads, only with your consent.
• Crisp IM SAS (France): live chat, only with your consent.
• Trustpilot A/S (Denmark): reviews widget, only with your consent.
• Microsoft Ireland Operations Ltd.: corporate email (Microsoft 365) where requests are received and handled.

If you contact us via WhatsApp, WhatsApp Ireland Ltd. (Meta) processes your data under its own privacy policy.

5. International transfers

Some providers are established in the United States. Transfers rely on the European Commission adequacy decision on the EU-US Data Privacy Framework (10 July 2023) for certified entities (Google LLC, Vercel Inc.) and otherwise on the Standard Contractual Clauses approved by Implementing Decision (EU) 2021/914 (EmailJS Inc.). You can request a copy of the safeguards at contact@thegourmet-box.com.

6. Cookies, analytics and advertising

The site uses Google Consent Mode v2: until you accept, no Google cookie is set. With your consent, Google Analytics 4 measures site usage through a pseudonymous identifier and Google Ads measures conversions from our campaigns. Google Signals is disabled. Full details on cookies, retention and how to withdraw consent are in the Cookie Policy. You can also disable Google Analytics with the official add-on and manage Google advertising at adssettings.google.com.

7. Retention

• Requests without a contract: 12 months from the last contact.
• Customers: for the duration of the relationship and then 6 years (art. 30 Spanish Commercial Code) and 4 years for tax purposes (art. 66 LGT).
• Chat: per Crisp settings, maximum 12 months.
• Analytics: 14 months in Google Analytics; cookies as per the Cookie Policy.
• Server logs: maximum 12 months.

8. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent by writing to contact@thegourmet-box.com, stating the right you exercise and attaching proof of identity. We will reply within one month. You may object at any time to receiving commercial communications (art. 21(2) GDPR).

9. Right to lodge a complaint

You may lodge a complaint with the Spanish Data Protection Authority (AEPD), the supervisory authority of Tenas Partners S.L.: www.aepd.es. You may also contact the supervisory authority of your EU country of residence (art. 77 GDPR).

10. Data security

Tenas Partners S.L. applies appropriate technical and organisational measures (TLS encryption, access control, providers bound by contractual safeguards) to protect your data against loss, alteration or unauthorised access.

11. Updates

This policy is reviewed whenever processing, providers or the law change.

Last updated: September 2026 (v2: legal bases, recipients, transfers, Google Analytics and Google Ads with Consent Mode v2, retention, exercise of rights).