Summary
This Privacy Policy explains what personal data PongoTodo processes, for what purpose, for how long, and what rights you can exercise over it. It applies to anyone who visits pongotodo.com, creates an account, places an order, subscribes to our newsletter, interacts with us on social media, or contacts our customer service team, whether as an individual consumer or on behalf of a business.
We recommend reading the full document. If you have any questions, you can write to us at the contact address provided in Section 10.
Data Controller
The personal data collected through pongotodo.com is processed by:
Company name: PONGOTODO.S,L Tax ID (CIF): B21686290 Registered address: C/Eduard Toldrà nº11 local 5, Esplugues de Llobregat, 08950. Contact email: bakery@pongotodo.com.
What data we process, why, and on what legal basis
PongoTodo collects different categories of personal data depending on how you interact with us. Each processing activity is detailed below.
When you place an order
When you purchase a product through our online store — as an individual or on behalf of a business — we process your name, billing and delivery address, email, phone number, company details for B2B orders, and payment data (the latter handled directly by our payment gateway; PongoTodo does not store full card numbers).
We use this data to process your order and payment, coordinate delivery with our logistics providers, issue invoices, and handle returns or warranty claims. The legal basis is the performance of the sales contract; for invoicing, we also comply with a legal obligation under tax and accounting rules.
When you create a user account
If you create an account on pongotodo.com, we process your name, email address, password (encrypted) and associated order history, in order to let you manage your orders, saved addresses and preferences. The legal basis is the performance of the contract for the account service.
When you subscribe to our newsletter
If you voluntarily subscribe to our marketing communications, we process your name and email address to send you information about new products, collections, promotions and events. The legal basis is your consent, which you can withdraw at any time by clicking the unsubscribe link included in every communication or by writing to the address in Section 10.
If you are already a customer and have not objected to receiving marketing about similar products to those you purchased, we may send you such communications on the basis of our legitimate interest, in line with applicable e-commerce marketing rules. You can object to this processing at any time.
When you contact customer service
When you contact us through our contact form, email, chat or phone, we process the data you provide (name, contact details and the content of your enquiry) to respond to you and, where applicable, to keep a record of your interactions in our customer relationship management (CRM) tool. The legal basis is the performance of pre-contractual or contractual measures, or our legitimate interest in providing good after-sales support.
When you purchase as a business (B2B customers)
If PongoTodo sells to you as a professional or business (for example, interior design or architecture studios, or distributors), we also process your job title, company name and professional contact details, to manage the business relationship. The legal basis is the performance of the contract and, where applicable, our legitimate interest in developing and maintaining B2B relationships.
Browsing, analytics and advertising
When you browse our online store, we collect certain technical browsing information (IP address, device and browser type, pages visited, interaction with the site) through cookies and similar technologies, for the purposes of running the site, analytics and, where you consent, personalised advertising. The details of these technologies, their purposes and how to manage your preferences are explained in our Cookie Policy, which forms an integral part of this document.
Social media
PongoTodo maintains profiles on social media platforms (for example, Instagram, Pinterest or TikTok). When you interact with us through these platforms — comments, direct messages, mentions — the processing of your data is also governed by the relevant platform’s own privacy policy. PongoTodo processes the information visible from such interactions to manage our community and respond to your messages, based on our legitimate interest.
Who we share your data with
To provide our services, we share certain data with providers acting as data processors — meaning they process the data following our instructions, under a contract that guarantees confidentiality and security. Depending on the case, these providers include:
- The platform that hosts and manages our online store.
- The payment entities and gateways that process your order payments.
- The shipping and logistics companies responsible for delivering your products.
- Our web analytics and digital marketing tools.
- Our newsletter and marketing communications platform.
- Our customer service and customer relationship management (CRM) tool, where used.
- External advisors (accountants, auditors, lawyers), when necessary.
- Public authorities and competent bodies, when legally required.
PongoTodo does not sell your personal data to third parties and does not disclose it for purposes other than those described in this document, except where legally required.
International data transfers
Some of the providers mentioned above may be located outside the European Economic Area (EEA), for example in the United States, in connection with web hosting, analytics or marketing services. Where this occurs, PongoTodo ensures the transfer is backed by an appropriate safeguard under the GDPR, such as a European Commission adequacy decision or Standard Contractual Clauses, so that your data receives a level of protection equivalent to that within the European Union.
Retention periods
- Order and invoicing data: [PENDING — typically up to 6 years from the last accounting entry, under Spanish commercial and tax law]. Governed by the Spanish Commercial Code and applicable tax rules.
- User account: for as long as the account remains active. Deleted or anonymised upon account closure request.
- Newsletter / marketing: until you withdraw your consent. You may unsubscribe at any time.
- Customer service enquiries: [PENDING — e.g. 2 years from the last interaction]. To be confirmed per internal policy.
- Analytics and advertising cookies: as detailed in the Cookie Policy. Varies by provider.
Once the periods above have elapsed, data is deleted or irreversibly anonymised, unless it must be retained for a further period to comply with legal obligations or to exercise or defend legal claims.
Security measures
PongoTodo applies reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or destruction, including encryption of communications with the website, restricted staff access to information, and the selection of providers that offer adequate security guarantees. No system is entirely infallible, however, so we also recommend that you protect your own account credentials.
Your rights
As a data subject, you have the right to:
- Access: find out what data we hold about you and obtain a copy of it.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request deletion of your data when it is no longer needed or you withdraw your consent.
- Restriction of processing: request that we temporarily limit the use of your data in certain circumstances.
- Objection: object to processing based on our legitimate interest, including direct marketing.
- Portability: receive your data in a structured, commonly used format, or request that it be transmitted to another controller.
- Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before the withdrawal.
You can exercise these rights by writing to us at the address in Section 10, attaching a copy of a document proving your identity. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if you believe the processing of your data does not comply with applicable law.
Children
PongoTodo’s products and services are aimed at adults. We do not knowingly collect data from minors. If you become aware that a minor has provided us with personal data without the authorisation of a parent or guardian, please let us know so that we can delete it.
Changes to this policy
We may update this Privacy Policy to reflect changes in our practices, in the services we offer, or in applicable law. The date of the last update appears at the top of this document. In the event of significant changes, we will inform you through appropriate channels, for example a prominent notice on the online store or by email.
Contact
For any query relating to this Privacy Policy or the processing of your personal data, you can write to us at bakery@pongotodo.com or by post at C/ Eduard Toldrà nº11 local 5, Esplugues de Llobregat, 08950