Version 2026-10-10
How we process the data needed to prepare, take payment for and handle VOCA orders.
Data controller
We may process the collection name, time, products, customisations and order notes; payment identifiers and status; the email address or phone number provided during Checkout; customer service communications; IP address and technical security data; and any tax details the customer provides when requesting an invoice.
The data comes directly from the customer and, for payment status and contact details entered during Checkout, from Stripe.
We process the data to create, take payment for, prepare, deliver and handle the order because this is necessary to perform the contract. We retain tax and accounting information to meet legal obligations. We apply fraud prevention, security and claims defence controls on the basis of legal obligations and our legitimate interest in protecting the service, balanced against the customer's rights.
We do not send advertising by email or WhatsApp as a result of an order. If commercial communications are offered in future, consent will be requested separately or the relevant legal exception will apply, always with an easy, free way to unsubscribe.
When this option is available, you can separately request an order confirmation via WhatsApp using the optional checkbox in the basket. We will use the phone number you provide in the basket or to Stripe to send this confirmation, without advertising. You can leave the box unchecked and still place your order.
The embedded Google Maps map is optional and only loads when you select “Accept and load map”. You can choose “Continue without map” or withdraw your choice using “Withdraw consent”. Your choice is not saved in browser storage.
The website does not request medical records or need to know diagnoses. To ask about allergens, use the specific channel indicated before buying and avoid entering medical information in the notes. If a customer voluntarily tells the team about an allergy, that information will only be used to handle the immediate enquiry and will not be added to the standard order history.
The following are involved only when necessary: Stripe to process payment, request Checkout contact details and prevent fraud; the website's hosting and security provider; Twilio and Meta/WhatsApp when configured to automatically deliver the order to VOCA's operational channel, send the confirmation requested by the customer or when the user starts a conversation; accounting or legal advisers; and banks and public authorities where required.
Each provider may act as a processor or an independent controller, depending on the specific service. VOCA will enter into the required data processing agreements and limit access to the minimum necessary.
If you agree to load the map, your browser connects to Google, which receives your IP address and technical browser data and may use cookies or similar technologies in accordance with its Privacy policy. Google acts as an independent controller for this processing. Before you accept, the map does not connect to Google. Withdrawing consent removes the embedded map but does not delete cookies Google may have installed.
Some technology providers may process information outside the European Economic Area. Where this happens, the provider must rely on an adequacy decision, standard contractual clauses or another valid safeguard. Up-to-date information about Stripe, Twilio, Meta and Google is available in their respective privacy notices.
Operational data identifying the customer, including the collection name, notes and contact details, is automatically minimised after 90 days. Financial content, transaction identifiers, contractual acceptance and tax documentation are retained for the statutory limitation and commercial record-keeping periods, normally between four and six years. Enquiries are retained while being handled and for as long as necessary to defend against potential liabilities.
VOCA does not make automated decisions that have legal effects on the customer. Stripe may use automated fraud prevention or authentication systems in accordance with its own privacy information. A declined payment can be reviewed by contacting VOCA or using another payment method.
You can request access, rectification, erasure, restriction or portability, or exercise your right to object, by emailing vocafranquicia@gmail.com and stating the right you wish to exercise. Additional information to verify identity will only be requested where there are reasonable doubts; you do not have to attach a national identity document to every request.
You can also lodge a complaint with the Spanish Data Protection Agency.
Payments take place on Stripe's hosted page. VOCA uses HTTPS encryption, protection against forged requests, rate limiting, server-side amount validation, signed webhooks, idempotent event recording and encryption of stored personal data. No system is infallible; incidents will be handled and reported in accordance with the GDPR where applicable.
Significant changes will be published with a new version number. The version accepted for an order is retained with the transaction where necessary to demonstrate the information provided.
