Privacy policy

1. Who is responsible for your data

Owner: CATANOSTRUM
Tax ID (NIF): 38057778T
Address: C/ Fornals, 18, nau 7 · 08292 Esparreguera (Barcelona)
Email: info@catanostrum.com
Phone: +34 630 15 38 46

2. What data we process

• Orders and customer account: full name, delivery and billing address, phone number, email address and order history.
• Enquiries: the data you send us by email, phone or WhatsApp.
• Payment: we do not store card details. Payments are handled by PayPal or the bank; we only receive the confirmation.
• Browsing: the technical data the website needs to work (IP address, browser type, session). Only if you accept it in the banner, also a recording of how you browse the website (clicks, scrolling and form fields).

3. Why we use it and on what legal basis

• Handling your order (preparation, delivery, payment and after-sales service): performance of the purchase contract (Art. 6(1)(b) GDPR).
• Invoicing and accounting and tax obligations: compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Answering your enquiries: your request and our legitimate interest in answering it (Art. 6(1)(b) and 6(1)(f) GDPR).
• Sending you news and offers, only if you agree: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Recording browsing to improve the website, only if you accept it in the banner: your consent (Art. 6(1)(a) GDPR).

4. How long we keep it

Order data, for as long as you are a customer and then for the periods required by law (invoices and accounting records, 6 years). Enquiries, for as long as needed to answer them and at most one year. Browsing recordings, at most 12 months.

5. Who we share it with

• The courier, to deliver your order.
• PayPal or the bank, to process the payment.
• WhatsApp (Meta), only if you choose to send us your order or enquiry that way.
• The providers that host and maintain the website and online shop (including Glacom, which runs the browsing recording), acting as processors on our behalf.
• Public authorities, when required by law.

We do not sell or pass on your data to anyone for advertising purposes.

6. Transfers outside the European Economic Area

PayPal and WhatsApp may process data outside the European Economic Area, with the safeguards provided by the GDPR (EU-US Data Privacy Framework or standard contractual clauses). The browsing-recording library is loaded from jsDelivr only if you accept it.

7. Your rights

You can ask to access, correct or delete your data, object to or restrict its processing, request its portability and withdraw your consent at any time. Write to info@catanostrum.com or to the postal address in section 1, saying which right you want to exercise. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Minors

Children under 14 may not give us personal data. Alcoholic drinks are sold only to people aged 18 or over.

9. Security and changes

We apply technical and organisational measures to protect your data. If we change this policy, we will say so on this page with the date of the update.

See also our cookie policy and legal notice.

Last updated: 13 October 2026