Introduction
The personal data requested for the provision of the services offered via this website is subject to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), and to Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
La Zagaleta, S.L. undertakes to comply with its obligation of secrecy regarding the personal data provided and with the duty to treat such data confidentially, adopting the necessary technical and organisational measures to prevent its alteration, loss, unauthorised processing or access, in accordance with Article 32 of the GDPR.
1. Data controller
- Data Controller: La Zagaleta, S.L., Tax Identification Number (C.I.F.) B-29533932
- Registered office: Carretera de Ronda (A-397) km 38.5, 29679 Benahavís, Málaga, PO Box 244
- Telephone: 952 855 450
- Email: info@lazagaleta.com
- Data Protection Officer (DPO): dpo@lazagaleta.com
You may contact the Data Controller regarding any matter relating to the processing of your personal data via the postal address or the DPO’s email address provided above.
2. Purpose of processing
The purpose of the processing is specific to each of the personal data processing activities carried out by La Zagaleta, S.L., and is available, as required by Article 30 of the GDPR, in the Register of Processing Activities accessible on the website https://www.lazagaleta.com/records-of-processing-activities/.
3. Legal basis
The legal basis justifying the processing of personal data, in accordance with Article 6(1) of the GDPR, may be, depending on the processing activity in question: the existence of a contractual relationship with the data subject [Article 6(1)(b)]; compliance with legal obligations applicable to the data controller [Article 6(1)(c)]; the performance of tasks carried out in the public interest [Article 6(1)(e)]; the legitimate interests of the data controller, provided that the rights and interests of the data subject do not override those interests [Article 6(1)(f)]; or the consent of the data subject, given freely, specifically, in an informed manner and unambiguously by a clear affirmative action [Article 6(1)(a)]. The specific legal basis for each processing activity can be found in the Register of Processing Activities referred to in section 2.
4. Retention of personal data
In general, personal data will be retained for as long as necessary to fulfil the purpose for which it was collected and to determine any potential liabilities that may arise from that purpose, as well as for the duration of the applicable statutory limitation periods. The specific retention period for each processing activity can be found in the Register of Processing Activities referred to in section 2.
5. Disclosure of personal data
As a general rule, data will not be disclosed to third parties unless required by law or in response to requests from other companies or bodies acting in accordance with the law. The recipients of the data for each specific processing operation can be found in the Register of Processing Activities referred to in section 2.
6. International data transfers
The use of certain third-party analytics and advertising tools integrated into the website, in particular, from providers such as Google LLC or Meta Platforms, Inc., may involve the transfer of data to servers located outside the European Economic Area, primarily in the United States. Such transfers are carried out in accordance with the safeguards set out in Chapter V of the GDPR, currently through these providers’ adherence to the EU-US Data Privacy Framework or, alternatively, through standard contractual clauses approved by the European Commission. Details of these tools are set out in this website’s Cookie Policy.
7. Rights and obligations of data subjects
Data subjects may exercise their rights of access, rectification, erasure, restriction of processing, data portability, objection and the right not to be subject to a decision based solely on automated processing, including profiling, all of which are recognised by the GDPR (Articles 15 to 22). These rights may be exercised in person at the premises of La Zagaleta, S.L. located at Carretera de Ronda (A-397) km 38.5, 29679 Benahavís, Málaga, PO Box 244, or by sending an email to dpo@lazagaleta.com, attaching a copy of an identity document to verify the applicant’s identity.
In all cases, the data subject has the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
Where the processing is based on the data subject’s consent, they have the right to withdraw it at any time, without this affecting the lawfulness of the processing based on the consent given prior to its withdrawal.
The user must ensure the truthfulness, accuracy, authenticity and validity of the personal data provided, and shall be liable for any damages that may arise from any inaccuracies therein.
8. Cookies
The website uses first-party and third-party cookies to ensure it functions correctly, to improve the browsing experience and to compile statistics. Details of the cookies used, their purpose, duration and how consent is managed are set out in a separate document, the Cookies Policy, which can be accessed from the website’s footer.
9. Updates to the Privacy Policy
La Zagaleta, S.L. may amend this Privacy Policy in accordance with legislative or regulatory requirements, or in order to bring it into line with the guidelines issued by the Spanish Data Protection Agency. Users are advised to consult it periodically. This policy was last revised on 16 July 2026.
