Privacy Policy

Last updated: 1 October 2026

1. Summary

This Privacy Policy explains what personal data PongoTodo processes, why, for how long and what rights you have over it. It applies to everyone who visits pongotodo.com, creates an account, places an order, signs up to our newsletter, contacts us or interacts with us on social media, whether as an individual or on behalf of a business.

If you have any questions, write to us at bakery@pongotodo.com (see section 12).

2. Who is responsible for your data

• Company name: PongoTodo S.L.
• Tax ID (CIF): B21686290
• Registered address: C/ Eduard Toldrà 11, local 5, 08950 Esplugues de Llobregat (Barcelona), Spain
• Email: bakery@pongotodo.com

3. What data we process, why and on what legal basis

When you place an order

We process your name, billing and delivery address, email, phone number, company details for business orders, and payment details. Payments are handled directly by our payment provider: PongoTodo never stores your full card number.

We use this data to process and deliver your order, issue invoices and handle returns and guarantee claims. The legal basis is the performance of the sales contract and, for invoicing, our legal obligations under tax and accounting rules.

When you create an account

We process your name, email, password (stored encrypted), saved addresses and order history so that you can manage your orders and preferences. The legal basis is the performance of the contract for the account service.

When you save products to your wishlist

If you have an account, we save the products you add to your wishlist so you can find them later (performance of the account contract). We also use this information, in aggregate, to understand which products interest our customers. If you are subscribed to our newsletter, we may use it to send you news about those products, such as restocks or new colours; you can object at any time.

When you sign up to our newsletter or welcome offer

If you sign up voluntarily, for example through our 10% welcome pop-up, we process your name, email, preferred language and country to send you news about products, collections, promotions and events, and to create your personal single-use discount code. The legal basis is your consent, which you can withdraw at any time using the unsubscribe link in every email or by writing to us.

If you are already a customer and have not objected, we may also send you emails about products similar to the ones you bought, based on our legitimate interest. You can object at any time.

When you contact us

When you write to us through the contact form, by email, by phone or on social media, we process your name, contact details, the topic you choose and the content of your message to answer you and, where applicable, to follow up on your request. The legal basis is taking the steps you ask for before or under a contract, or our legitimate interest in giving you good support.

Shops, businesses and press

If you contact us or buy from us on behalf of a shop, studio, distributor or media outlet, we also process your company name, job title and professional contact details to manage that relationship. The legal basis is the performance of the contract and our legitimate interest in maintaining professional relationships.

Browsing, analytics and advertising

When you browse our website we collect technical information (IP address, device and browser, pages visited and how you use the site) through cookies and similar technologies, to make the website work, to measure its use and, if you agree, to show you personalised advertising. You can find all the details, and how to manage your choices, in our Cookie Policy.

Social media

We have profiles on Instagram, TikTok and LinkedIn. When you interact with us there (comments, messages, mentions), we process the information visible to us to manage our community and reply to you, based on our legitimate interest. Each platform also processes your data under its own privacy policy.

4. Who we share your data with

We only share your data with providers that help us run the shop. They act as data processors: they follow our instructions under a contract that guarantees confidentiality and security. These are:

• Website hosting and the online store platform.
• Payment providers (such as Stripe), which process your payments.
• Shipping and courier companies, which deliver your orders.
• Our newsletter tool (MailPoet), which sends our emails.
• Analytics and advertising services (Google and Meta), only as explained in our Cookie Policy.
• External advisers (accountants, auditors, lawyers) when necessary.
• Public authorities, when the law requires it.

PongoTodo does not sell your personal data and does not use it for purposes other than those described here.

5. International transfers

Some of these providers (for example Google, Meta or Stripe) may process data outside the European Economic Area, mainly in the United States. In those cases the transfer is covered by an appropriate safeguard under the GDPR, such as the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

6. How long we keep your data

• Orders and invoices: 6 years, as required by Spanish commercial and tax law.
• Account and wishlist: while your account is active. We delete or anonymise them when you ask us to close it.
• Newsletter and welcome offer: until you unsubscribe or withdraw your consent.
• Enquiries: up to 2 years after our last interaction, unless they relate to an order.
• Cookies: for the periods indicated in our Cookie Policy.

After these periods, we delete your data or anonymise it irreversibly, unless we must keep it longer to comply with a legal obligation or to defend ourselves against claims.

7. Security

We apply reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration: encrypted connections (HTTPS), restricted access for our team and providers that offer adequate security guarantees. No system is completely infallible, so we also recommend that you keep your password safe.

8. Your rights

You have the right to:

• Access: know what data we hold about you and get a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed or you withdraw your consent.
• Restriction: ask us to limit the use of your data in certain cases.
• Objection: object to processing based on our legitimate interest, including direct marketing.
• Portability: receive your data in a structured, commonly used format or have it sent to another company.
• Withdraw your consent at any time, without affecting the processing carried out before.

To exercise them, write to bakery@pongotodo.com indicating which right you want to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to verify it. If you are not satisfied with our answer, you can file a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

9. Minors

Our shop is aimed at adults. We do not knowingly collect data from children under 14. If you believe a minor has given us personal data without the consent of their parents or guardians, please let us know and we will delete it.

10. Cookies

We use cookies and similar technologies as explained in our Cookie Policy.

11. Changes to this policy

We may update this policy to reflect changes in our practices, our services or the law. The date of the last update is shown at the top of this page. If the changes are significant, we will let you know through the website or by email.

12. Contact

For any question about this policy or your data, write to us at bakery@pongotodo.com or by post to PongoTodo S.L., C/ Eduard Toldrà 11, local 5, 08950 Esplugues de Llobregat (Barcelona), Spain.