1. Data controller
- Controller
- Maties G Toro Mercadal
- Tax ID
- 47665239Q
- Trading name
- Editorial Cuentos con Alegría
- Activity
- NACE/CNAE 5811 — Book publishing
- Business address
- Antonio Gaudí, 91, LC 2nd C, 08830 Sant Boi de Llobregat, Barcelona, Spain
- Telephone and WhatsApp
- 604 544 147
No data protection officer has been appointed because this is not mandatory given the current nature and scale of the activity.
2. Personal data we process
We may process identification and contact details you provide directly: first name, surname, telephone number, email, town or city, postal address and correspondence. For orders and invoicing, we may also process products, quantities, amount, order reference, payment method and status, delivery address, tax ID and billing address when an invoice is requested.
The basket stores selected titles and quantities on your device. When an order is completed, the server automatically records the customer’s full name, telephone number, delivery method, full address where applicable, books, quantities, amount, language, date, order number and processing status. These details are displayed only in the management area, protected by sign-in and authorisation.
Basic technical security and operational data, such as IP address, date, device or access logs, may also be processed when generated by the hosting infrastructure.
3. Purposes and legal bases
- Enquiries and support: responding to email, telephone, WhatsApp or social-media messages. Basis: pre-contractual steps, consent when contacting us and our legitimate interest in helping you.
- Orders, payment, delivery and after-sales: preparing, confirming and performing the purchase and managing incidents, returns and guarantees. Basis: performance of a contract and pre-contractual steps.
- Invoicing and legal duties: issuing invoices, maintaining accounts and responding to lawful requests. Basis: compliance with tax, accounting and consumer-law obligations.
- Marketing: sending publishing news only where separate, optional consent has been given, or where the law permits communications to customers about similar products, always with a simple opt-out. Basis: consent or legitimate interest where legally permitted.
- Security and technical improvement: preventing abuse, fixing errors and protecting the website. Basis: legitimate interest in maintaining a secure service.
We will not use personal data for incompatible purposes without informing you and, where required, obtaining fresh consent.
4. Required data
Fields marked as required are needed to answer your request or process the order. If they are not provided, we may be unable to continue. You must provide accurate, up-to-date information belonging to you, or have sufficient authority when acting for someone else.
5. Recipients and service providers
We do not sell your data. Where necessary, it may be accessed by website hosting and support providers; email providers; WhatsApp/Meta when you choose that channel; banks or Bizum; Correos, Packlink and selected carriers; tax or accounting advisers; and invoicing or management providers.
We may also disclose data to public authorities, courts or law enforcement where legally required. We require applicable contractual safeguards from processors.
6. International transfers
Some technology providers, particularly Meta/WhatsApp, may process information outside the European Economic Area. Where this occurs, processing will rely on an adequacy decision, standard contractual clauses or another valid GDPR safeguard. When you open WhatsApp or a social network, that platform’s own terms and privacy policy also apply.
7. Retention
Enquiries are kept for as long as needed to respond and, as a guide, for up to 12 months after the conversation ends, unless they lead to a contract or must be retained to address liabilities. Order, invoice, payment and delivery information is kept throughout the commercial relationship and then restricted for applicable legal periods—generally up to 6 years for commercial records and 4 years for tax obligations. Marketing data is kept until you withdraw consent or object.
When data is no longer needed, it is securely deleted or anonymised, without prejudice to restriction where needed to address potential liabilities.
8. Your rights
You may request access, rectification, erasure, objection, restriction and portability, and withdraw consent without affecting processing already carried out lawfully. Email cuentos@cuentosconalegria.com and state the right you wish to exercise. We may request reasonable information to verify your identity.
You may also lodge a complaint with the Spanish Data Protection Agency.
9. Children
Our stories are intended for families, but website forms, orders and contact channels must be used by adults. We do not knowingly collect children’s data through the website. If we discover that a child has provided data without the required involvement of a legal representative, we will take reasonable steps to delete it promptly.
10. Security and confidentiality
We apply proportionate technical and organisational measures to protect data against loss, unauthorised access, alteration or disclosure. No system is infallible; if a breach creates a relevant risk, we will act in accordance with our legal obligations.
11. Automated decisions and analytics
We do not make automated decisions or create profiles producing legal or similarly significant effects. With your consent, we use Google Analytics 4 to obtain aggregated statistics about visits, traffic sources, pages viewed and actions on the website. Analytics remains disabled if you reject it, and you can withdraw consent through the Cookie policy.
12. Changes and contact
We may update this policy to reflect legal, technical or processing changes. The version published on this page is the current version. For privacy questions, email cuentos@cuentosconalegria.com.
Last updated: 28 July 2026.