Privacy policy

Introduction

This policy explains what personal data we process when you place an order on tokachi.es, create an account or take part in the loyalty programme, why we process it and what rights you have over it.

Processing is governed by Regulation (EU) 2016/679 (GDPR) and by Spanish Organic Act 3/2018 on data protection and the guarantee of digital rights (LOPDGDD).

Data controller

[PENDING: owner tax details — registered company name, tax ID (CIF), registered address]

Trading name: TOKACHI. Data protection contact email: [PENDING: contact email address].

No data protection officer has been appointed, as none of the circumstances set out in article 37 GDPR apply.

Data we process

Identification and contact data: first name, surname, email address and phone number, needed to handle your order and keep you informed about it.

Delivery data: address, postcode, town and, if you provide them, instructions for the courier.

Order data: products, amounts, order type, assigned restaurant, notes and chosen payment method.

Account and loyalty data, if you create an account: sign-in credentials managed by our authentication provider, order history and points balance.

Payment data: when you pay by card, the details are entered directly into Stripe’s secure environment. TOKACHI never receives or stores the full card number; it only keeps the transaction identifier and the last digits for reconciliation and refunds.

Purposes of processing

Order management: receiving, preparing, charging, delivering or handing over the order and invoicing it.

User account: registration, authentication, order history and saved addresses.

Loyalty programme: earning and redeeming points linked to your orders.

Operational communications: order confirmation, status updates, delivery incidents and replies to your enquiries. These are part of the service and are not marketing messages.

Marketing communications: news, promotions and offers, only if you give your express consent. You can withdraw it at any time using the unsubscribe link in every message.

Security and fraud prevention: detecting abnormal use of the platform and keeping minimal technical logs.

Legal basis

Performance of a contract or pre-contractual steps (art. 6.1.b GDPR): managing the order, the user account and the loyalty programme, and the related operational communications.

Consent of the data subject (art. 6.1.a GDPR): sending marketing communications. Withdrawing consent does not affect the lawfulness of prior processing and does not prevent you from ordering.

Compliance with a legal obligation (art. 6.1.c GDPR): accounting, tax and invoicing obligations.

Legitimate interest (art. 6.1.f GDPR): platform security and fraud prevention, following the corresponding balancing test.

Recipients and processors

Supabase: database and user authentication, with data hosted in the European Union.

Stripe Payments Europe, Ltd.: processing of online card payments.

Resend: delivery of the transactional emails about your order.

Vercel Inc.: website hosting and delivery.

All of them process data on behalf of the controller under a processing agreement compliant with article 28 GDPR, and with the safeguards required for international transfers where these occur. In addition, the strictly necessary data is passed to the restaurant staff preparing the order and to the person delivering it. Apart from these cases, no data is disclosed to third parties unless legally required.

Retention periods

Order and invoicing data: for the duration of the contractual relationship and, afterwards, blocked for the applicable limitation periods — four years for tax purposes and six years for commercial documentation (art. 30 of the Spanish Commercial Code).

Account, address and loyalty point data: while the account remains active. If you request erasure, the data is deleted except where it must be kept to meet a legal obligation.

Data processed on the basis of your consent for marketing: until you withdraw it.

Your rights

You may exercise the rights of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right not to be subject to automated individual decisions.

To exercise them, write to [PENDING: contact email address] stating which right you wish to exercise and attaching a document proving your identity. We will reply within a maximum of one month.

You may withdraw any consent you have given at any time, without this affecting the lawfulness of processing carried out beforehand.

If you believe the processing does not comply with the rules, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), calle Jorge Juan 6, 28001 Madrid, www.aepd.es. You are welcome to contact us first so we can try to resolve the matter.

Security and minors

We apply appropriate technical and organisational measures to protect the data: encryption in transit, role-based access control in the database and minimisation of the data each profile can reach.

The service is not aimed at children under 14. If we find that a minor’s data has been provided without the consent of their guardian, we will delete it.