Privacy policy

At Gumen Catering, S.L. we treat your personal data with the utmost care, in compliance with EU Regulation 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). This policy explains how we collect, use and protect your data.

1. Data controller

• Identity: Gumen Catering, S.L. — VAT B63264915
• Postal address: Carrer de Tamarit, 10, 08205 Sabadell, Spain
• GDPR contact: rgpd@gumen-catering.com
• Phone: 93 717 83 35

2. Purposes of processing

We process your data for the following purposes:

• Enquiry handling: answering questions you send us via the form, phone or email.
• Sales management: producing quotes, samples and negotiating catering contracts.
• Service delivery: providing the contracted school or business catering service (order management, invoicing, deliveries).
• Legal compliance: tax, accounting, food-safety (HACCP / APPCC) and employment obligations.
• Marketing communications: only with explicit consent (newsletter, news).

3. Lawful basis

• Performance of a contract: for active customers who have hired the service (Art. 6.1.b GDPR).
• Legitimate interest: answering pre-contractual enquiries (Art. 6.1.f).
• Consent: for marketing communications and analytics cookies (Art. 6.1.a).
• Legal obligation: invoicing, taxation, food-safety regulation (Art. 6.1.c).

4. Categories of data

We process only the data that is strictly necessary for each purpose:

• Identification: first name, surname, role, organisation.
• Contact: email, phone, postal address of the organisation.
• Pupil data (schools): food allergies and intolerances, communicated by the school management under their responsibility as joint controller.
• Payment data: bank account, billing details.

We do not process special-category data (health, religion, etc.) other than the food allergies and intolerances strictly necessary for safe service delivery, under the data-minimisation principle.

5. Data retention

• Pre-contract enquiries: 1 year from the last communication.
• Active customers: for the duration of the contract plus 5 years afterwards (tax obligations).
• Invoices: 6 years (Spanish Commercial Code).
• Health-related data: destroyed at the end of each school year.

6. Recipients and transfers

We share data with the following data processors, all bound by an Art. 28 GDPR data-processing agreement:

• Brevo (email and CRM) — EU
• Google Workspace (professional email, calendar) — EU/USA with Standard Contractual Clauses
• Anthropic (AI assistant) — USA with Standard Contractual Clauses
• OpenAI (voice transcription) — USA with Standard Contractual Clauses
• Payroll and tax advisors — Catalonia, Spain
• Payment companies/bank for transactions

We do not pass data to third parties for marketing purposes. Transfers outside the EEA are covered by the Standard Contractual Clauses (SCC) approved by the European Commission.

7. Your rights

You can exercise your rights by writing to rgpd@gumen-catering.com:

• Right of access to your data
• Right to rectify inaccurate data
• Right to erasure ("right to be forgotten")
• Right to object to processing
• Right to data portability to another controller
• Right to restriction of processing
• Right not to be subject to automated decisions with legal effects

If you believe the processing does not comply with regulations, you can file a complaint with the Autoritat Catalana de Protecció de Dades (APDCAT) at apdcat.gencat.cat.

8. Security measures

We apply technical and organisational measures proportionate to the risks: encryption in transit (HTTPS), access control, automatic backups, business continuity plans and annual data-protection training for staff.

9. Changes to this policy

We may update this policy to reflect regulatory or operational changes. The current version is dated at the top of the document. If we make substantial changes we will notify you through the usual channels.

10. Related links

• Legal notice
• Cookie policy