This policy explains which personal data we process in the Fresh Oranges Home Delivery online shop, why, on what legal basis, for how long, who we share it with and what your rights are. It applies to the five shops run by the same controller: naranjasdecullera.com, tarongesdecullera.com, orangenfrisch-nachhause.com, orangesfraiches-adomicile.com and freshoranges-homedelivery.com.
1. Who the controller is
- Data controller: RUTH PALOMERO S.L. ("Naranjas de Cullera" / "Fresh Oranges Home Delivery")
- Address: Carrer Riu Xúquer, 4 - Local 3, 46614 Favara (Valencia), Spain
- Email: info@naranjasdecullera.com
For any question about your data you can write to that address or use the My GDPR rights form.
2. What data we process, why and on what legal basis
We only process the data needed for each purpose. Mandatory fields in our forms are marked; if you leave them empty we will not be able to provide the corresponding service (for example, we cannot ship an order without an address). You are responsible for the data you give us being accurate and up to date.
2.1 Orders and customer account
- Data: first and last name, email, telephone, shipping and billing address, country, order history and chosen payment method. We do not store your card details: they are processed exclusively by the payment institution (section 2.2).
- Purpose: to process and deliver your order, issue the invoice, handle incidents, returns and warranty claims and, if you create an account, give you access to your orders and addresses. The account is optional: you can check out as a guest.
- Legal basis: performance of the sales contract (Art. 6(1)(b) GDPR) and compliance with tax and accounting obligations (Art. 6(1)(c) GDPR).
- Retention: account data, for as long as you keep the account open (you can close it at any time from My GDPR rights or by writing to us). Order and invoice data, for as long as Spanish commercial and tax law requires (at least 6 years from the last accounting entry, Art. 30 of the Spanish Commercial Code) and while needed to deal with claims or warranties.
- Recipients: payment institutions, the carrier and our hosting providers (section 4). Orders are also managed in our internal management system (ERP), hosted on the company's own server.
2.2 Payments
- Card and other gateway methods (currently, besides cards, iDEAL): handled by PAYCOMET, S.L.U. (Spain), a payment institution. You enter your payment details directly on its gateway; we only receive the payment confirmation and the data needed to match it to your order.
- PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). PayPal processes your data as an independent controller under its own privacy policy.
- Bank transfer (account holders only): we see the payer details shown on the bank statement for the transfer.
- Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Payment institutions also apply their own legal fraud-prevention obligations.
- Retention: the payment reference, together with the order (section 2.1).
2.3 Shipping your order
- Data: name, delivery address, telephone and email (for delivery notifications).
- Purpose: to deliver your order. The data is passed to the carrier for your destination (SEUR, DPD or GLS). You can also choose to collect your order at our pick-up point.
- Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
- Retention: together with the order (section 2.1). The carrier keeps the data under its own policy.
2.4 Customer service and enquiries
- Data: whatever you give us when you email info@naranjasdecullera.com (name, email address, content of the enquiry and, where relevant, order number). The website has no contact form.
- Purpose: to answer your enquiry and handle incidents.
- Legal basis: pre-contractual steps at your request or performance of the contract (Art. 6(1)(b) GDPR); for other enquiries, our legitimate interest in replying to people who write to us (Art. 6(1)(f) GDPR).
- Retention: for as long as needed to deal with the enquiry and follow it up.
2.5 Commercial communications (newsletter and offers)
- Data: email, name, language and shop, and proof of your consent (date, IP address and confirmation).
- Purpose: to send you news, offers and, where applicable, satisfaction surveys about our products and services. We do this only if you tick the box "I agree to receive commercial communications and personalised offers" and then confirm your subscription through the link we email you (double opt-in).
- Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 21 of the Spanish LSSI). You can withdraw it at any time from your account or through the unsubscribe link in every email; withdrawal does not affect earlier mailings.
- Retention: until you withdraw your consent. We then keep proof of the consent and of the withdrawal for as long as necessary to demonstrate them in the event of a claim.
- Recipients: emails are sent through Mailjet SAS (France, EU), a processor.
2.6 Availability alerts ("Notify me")
If you ask us to let you know when a sold-out fruit is back, we send you a single email alert. Full details of this processing are in section 12.
2.7 Prices and delivery times for your country (IP geolocation)
- Data: your IP address and the country it belongs to.
- Purpose: to show you, from your first visit, the prices, shipping costs and delivery times for the country we deliver to, without you having to choose it. On your first visit we look up the country of your IP with the Ipregistry service (Elaunira SARL, France); we keep the IP → country match in our database for 24 hours, after which it is deleted automatically. The chosen or detected country is also remembered in the
shipping_countrycookie for 1 year (see the cookie policy). You can change the country at any time with the shop's country selector. - Legal basis: our legitimate interest in correctly displaying the conditions of the market we sell to (Art. 6(1)(f) GDPR). The processing is minimal (IP and country only) and very short-lived.
2.8 Protection against bots and fraud (reCAPTCHA)
- Where: only on account registration, registration during checkout and the GDPR rights form.
- What happens: we use Google's reCAPTCHA v3 (Google Ireland Limited, Ireland). When those pages load, Google receives your IP address and data about your browser and your interaction with the page, and returns a score indicating whether the request looks automated. There is no challenge to solve.
- Legal basis: our legitimate interest in protecting the shop and our customers against mass registrations, abuse and fraud (Art. 6(1)(f) GDPR).
- Retention: we only use the verification result at the moment the form is submitted. Google processes the data under its privacy policy; a transfer to the United States may occur (section 5).
2.9 Google reviews shown on the website
On the Reviews page and in the home-page carousel we display public reviews from our Google Business Profile, with the reviewers' names and profile photos. The photos are loaded from Google servers (googleusercontent.com), so when you view those pages your IP address reaches Google. Legal basis: our legitimate interest in showing our customers' opinions (Art. 6(1)(f) GDPR). No cookies are set for this.
2.10 Google survey about your purchase (Google Customer Reviews)
- When: only if you have accepted the "Marketing" category in our cookie banner. If you have not, the Google Customer Reviews module is not loaded and no request is sent to Google.
- What happens: on the order confirmation page a Google module loads and asks whether you would like to receive a short Google survey about your purchase. For this, your email, the order number, the delivery country and the estimated delivery date are passed to Google. If you accept the survey, Google sends it to you after delivery; your answers are used to calculate the shop's public rating.
- Who processes the data: Google Ireland Limited (Ireland) and Google LLC (United States) as independent controllers, under the Google Ads Controller-Controller Data Protection Terms and Google's privacy policy.
- Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via "Cookie settings" in the footer.
2.11 Web analytics and advertising
With your consent we use Google Analytics 4 (website usage measurement) and Google Ads (conversion measurement). Which cookies are used, how long they last and how to accept or refuse them is explained in the cookie policy. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 22.2 of the Spanish LSSI).
2.12 Record of your consents
- Data: when you accept the terms of sale or this policy, subscribe to the newsletter, request a "Notify me" alert or accept, refuse or configure cookies, we store a record on our server with: your customer ID and email (or "anonymous" if you are not logged in), the type of consent, the action taken and where it came from (page or form), the IP address, the browser (user agent), the version of the policy accepted and the date.
- Purpose: to be able to demonstrate what you consented to, when and under which version of the text.
- Legal basis: our legal obligation to demonstrate consent (Art. 7(1) GDPR, in conjunction with Art. 6(1)(c)).
- Retention: records of your cookie choice are deleted after 25 months, and of your IP address we only keep the part that identifies the network (without the last block). The others are kept while the related relationship exists (account, subscription, alert) and afterwards for as long as necessary to demonstrate consent in the event of a claim.
2.13 Website security and server logs
- Data: IP address, requested page, date and time, browser and operating system, and response code.
- Purpose: to keep the website secure and running, detect attacks and abuse (including through a request rate limiter) and diagnose errors.
- Legal basis: our legitimate interest in network and information security (Art. 6(1)(f) GDPR, recital 49).
- Retention: 4 weeks.
2.14 Exercising your rights
When you exercise a right (section 9) we process your identification data and the content of your request in order to deal with it and to be able to show that we did. Legal basis: legal obligation (Arts. 12 to 22 GDPR; Art. 6(1)(c)). Retention: 3 years from our reply.
3. How long we keep your data (summary)
| Data | Period |
|---|---|
| Customer account | While you keep it open; you can close it at any time |
| Orders, invoices and payments | As required by Spanish commercial and tax law (at least 6 years, Art. 30 Commercial Code) and while needed for claims or warranties |
| Email enquiries | As long as needed to deal with them and follow them up |
| Rights requests | 3 years from the reply |
| Newsletter and offers | Until you withdraw consent; afterwards, the proof for as long as needed to demonstrate it |
| "Notify me" | See section 12 |
| IP → country cache | 24 hours |
| IP address used to access your account | 12 months |
| Record of cookie choice | 25 months |
| Other consent records | While the relationship exists and afterwards for as long as needed to demonstrate consent |
| Server logs | 4 weeks |
| Backups | Daily backups 7 days, weekly 4 weeks, monthly 12 months and one yearly backup for up to 6 years; deleted data may remain in them until then, unused. |
Once no longer needed, data is deleted or anonymised.
4. Who can access your data
We do not sell or pass your data to third parties for their own purposes. We only disclose it to those who need to process it to provide you the service, to bodies entitled to it by law, and to providers working for us as processors under a contract compliant with Art. 28 GDPR:
| Provider | What for | Country | Role |
|---|---|---|---|
| OVH SAS | Hosting of the shop, database, email and backups | France (EU) | Processor |
| Mailjet SAS | Sending the newsletter and "Notify me" alerts | France (EU) | Processor |
| Elaunira SARL (Ipregistry) | Country of your IP address (section 2.7) | France (EU) | Processor |
| PAYCOMET, S.L.U. | Card payments and other gateway methods | Spain (EU) | Payment institution (controller of its own processing) |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | PayPal payments | Luxembourg (EU) | Independent controller |
| SEUR, DPD, GLS | Transport and delivery of your order | Depending on destination | Controllers of their own processing |
| Google Ireland Limited / Google LLC | reCAPTCHA, Google Analytics 4, Google Ads, Google Customer Reviews, review photos | Ireland (EU) / United States | Processor (Analytics) or independent controller (Ads, Customer Reviews, reCAPTCHA) |
We may also disclose data to the Spanish tax authority, to banks and to courts or authorities where a legal rule requires it.
5. International transfers
Our servers and those of our main processors are in the European Union. There are three cases in which your data may leave the European Economic Area:
- Google: Google services (sections 2.8 to 2.11) may involve processing by Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and, as a fallback, applies the Commission's standard contractual clauses.
- PayPal: an independent controller; transfers within its group are governed by its own privacy policy and safeguards.
- Deliveries outside the EEA: if your order is to be delivered outside the European Economic Area, passing your data to the carrier is necessary for the performance of the contract (Art. 49(1)(b) GDPR).
6. Cookies
We use essential cookies to make the shop work and, only with your consent, Google analytics and marketing cookies. You can accept, refuse or configure them by category in the banner and change your decision at any time via "Cookie settings" in the footer. Full information is in the cookie policy.
7. Security
We apply technical and organisational measures appropriate to the risk to prevent loss, unauthorised access or alteration of your data: encrypted connection (HTTPS) across the whole site, passwords stored only as hashes (they cannot be decrypted), access control, firewall and request rate limiting, security updates and regular backups. Your card details never pass through our systems.
8. Automated decisions and minors
We do not make decisions based solely on automated processing that produce legal effects on you, nor do we build profiles for that purpose. The shop is not aimed at children under 16; if we detect a minor's data without parental or guardian authorisation, we will delete it.
9. Your rights
You can exercise, at any time and free of charge, the rights granted to you by the GDPR:
- Access: to know which of your data we process and obtain a copy.
- Rectification: to have inaccurate or incomplete data corrected.
- Erasure: to have your data deleted when it is no longer needed (except data we must keep by law, which will be blocked).
- Objection: to object to processing based on our legitimate interest, on grounds relating to your particular situation, and in any case to processing for advertising purposes.
- Restriction: to ask us to suspend processing in the cases set out in Art. 18 GDPR.
- Portability: to receive the data you provided to us in a structured, commonly used format, or to have it transmitted to another controller.
- Withdrawal of consent: for processing based on it, without affecting the lawfulness of the processing carried out before.
How to exercise them: through the My GDPR rights form, by email to info@naranjasdecullera.com or by post to the address in section 1. If we have reasonable doubts about your identity, we may ask you to prove it. We will reply within one month at most, extendable by two further months in complex cases.
Complaints: if you believe we have not handled your rights properly, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD, C/ Jorge Juan, 6, 28001 Madrid, Spain; www.aepd.es), the lead supervisory authority for our company, or with the supervisory authority of the country where you live, for example the Data Protection Commission in Ireland, the Autoriteit Persoonsgegevens in the Netherlands or the Autorité de protection des données / Gegevensbeschermingsautoriteit in Belgium. You are welcome to write to us first so we can try to resolve the matter.
10. Do you no longer want advertising, or want to withdraw your consent?
You can object to the use of your data for advertising, satisfaction surveys or market research, and withdraw any consent, at any time and without retroactive effect: from your customer account, through the unsubscribe link in every commercial email, by writing to info@naranjasdecullera.com or, for cookies, via "Cookie settings" in the footer.
11. Changes to this policy
We will update this policy whenever the processing, the providers or the law change. The version in force is always the one published on this page, with its version date at the end. If a change affects processing based on your consent, we will expressly ask for it again.
12. Availability alerts ("Notify me")
What data and why. If you ask us to let you know when a fruit is back, we process your email address, the fruit and type of farming (conventional or organic) you are interested in, the shop and language of your request and, as proof, the date, IP address and browser of the request and of the confirmation. We use them only to send you one alert when that fruit is available again. This is not a newsletter subscription and you will not receive advertising because of it.
Legal basis. Your consent (Art. 6(1)(a) GDPR), given when you click "Notify me" and confirmed through the link we email you (double opt-in). If you do not confirm within 48 hours, the link expires and we will not send you any alert.
Who processes the data. FRESH ORANGES HOME DELIVERY (Ruth Palomero, S.L.) as controller. The alert is sent via Mailjet SAS (France, EU), our email delivery provider, and the data is hosted on servers of OVH SAS (France, EU); both act as processors on our behalf.
How long. Unconfirmed requests are deleted after 7 days. Confirmed requests are kept until the alert is sent and deleted 12 months after the alert or your unsubscription (or 12 months after confirmation if the fruit never comes back). Proof of your consent is kept for 3 years so we can demonstrate it in the event of a claim.
Unsubscribing. At any time, with one click on the unsubscribe link in every email, or by writing to info@naranjasdecullera.com. If you request the deletion of your data from "My GDPR rights", we will also delete your alerts. You can exercise your other rights and lodge a complaint with a supervisory authority as described in section 9.
Version of this section: avisame-v1-2026-10.
13. AI assistant ("Nara")
In the shop you can chat with Nara, the family's artificial intelligence assistant. Using it is optional: you can shop and write to us without it.
- Purpose: to answer your questions about the fruit, prices, delivery and orders, and to help you prepare a purchase (filling the basket and getting the checkout ready). Nara does not confirm orders or take payments: you review, accept and pay for the order yourself at the checkout. If you ask, it passes the conversation on to the family, who reply by email.
- Data: the messages you write and the replies; the shop's language and delivery country, the page you are writing from and the contents of your basket; if you are logged in, your customer ID, your name and your orders (date, status, contents, amount, delivery country and shipping and delivery dates), so that Nara can answer questions about them; of your saved addresses, only the reference of the one you choose for delivery and, when the payment is prepared, its name, postcode and town; if you ask to talk to the family, the name and email address you give. To limit abuse we keep an encrypted fingerprint of your IP address, not the address itself. Nara does not ask for or need payment details: please do not type card details or other sensitive data in the chat.
- Legal basis: taking steps at your request before entering into a contract and performance of the contract (Art. 6(1)(b) GDPR), and our legitimate interest in answering enquiries and protecting the service against abuse (Art. 6(1)(f) GDPR).
- AI provider: the replies are generated by a model from Anthropic (Claude), to which the messages of the conversation are sent through its API as a data processor. Anthropic does not use this data to train its models. Processing may take place in the United States, with the safeguards of the European Commission's standard contractual clauses.
- Retention: conversations are deleted after 90 days; if the conversation was passed on to the family, after 180 days.
- Your rights: the same as for the rest of your data (section 9), by writing to info@naranjasdecullera.com or from "My GDPR rights". You can also ask us to delete a conversation.
- It is an AI and can make mistakes: its replies are generated automatically and may contain errors. What counts is what the shop and the checkout show (price, estimated date and conditions) and our published terms. Nara does not take decisions with legal effects concerning you.
Version: 2026-10-16