Privacy Policy

Last updated: July 22, 2026

EUKENI & AINARA, S.L. is committed to respecting user privacy and the protection of personal data.

This Privacy Policy explains how personal data provided through the gelateriaboulevard.eus website, by email, telephone, or through Gelateria Boulevard’s social networks is collected, used, stored, and protected.

The processing of personal data will be carried out in accordance with the following regulations:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (GDPR).
  • Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights.
  • Law 34/2002, of July 11, on Information Society Services and Electronic Commerce.
  • Other applicable regulations.

1. Who is the data controller?

  • Data controller: EUKENI & AINARA, S.L.
  • NIF: B20817441
  • Registered office: Alameda del Boulevard, 20, 20003 Donostia-San Sebastián, Gipuzkoa, Spain.
  • Email address: gelateriaboulevard@gmail.com
  • Website: gelateriaboulevard.eus

Any inquiry regarding data processing or this Privacy Policy can be sent to that email address.

2. What personal data do we process?

Depending on the website and the user’s relationship with Gelateria Boulevard, the following categories of data may be processed:

Identification and contact data

  • Full name.
  • Email address.
  • Phone number.
  • Other contact data provided voluntarily by the user.

Communication data

  • Content of inquiries, requests, suggestions, or complaints.
  • Communications made by email, telephone, or social networks.
  • Documents or information provided by the user.

Commercial relationship data

  • Request or inquiry made.
  • Information about the requested product or service.
  • Billing and payment data when a commercial transaction is made.

Browsing and technical data

  • IP address.
  • Browser and device type.
  • Operating system.
  • Date and time of access to the website.
  • Pages visited.
  • Information collected through cookies or similar technologies.

Data from non-technical cookies will only be processed when the user has given prior consent.

Gelateria Boulevard will not ask the user for any special data that is not necessary to manage their inquiry or request. The user is requested not to send data regarding health, ideology, religion, ethnic origin, or other specially protected categories unless strictly necessary.

3. For what purposes do we process the data?

Personal data may be processed for the following purposes:

Responding to inquiries and requests

To receive and respond to inquiries, information requests, suggestions, or complaints made by the user via email, telephone, social networks, or any other means available on the website.

Managing the commercial or contractual relationship

To manage products or services requested by the user or customer, prepare quotes, process orders, billing, manage collections, and comply with legal obligations.

Sending commercial communications

When the user has given express consent, to send commercial information about Gelateria Boulevard’s products, services, news, promotions, or activities.

The user may withdraw consent at any time by using the unsubscribe mechanism indicated in the communication received or by writing to gelateriaboulevard@gmail.com.

Ensuring the security and operation of the website

To ensure the technical operation of the website, detect security incidents, prevent fraud or improper use, and maintain system stability.

Analyzing website usage

When the user has given consent, to compile statistics on website use, visits, and browsing habits, in order to improve the website’s content, usability, and performance.

4. What is the legal basis for processing the data?

The legal basis for data processing will depend on the purpose:

  • User consent: to respond to contact requests, send commercial communications, and use non-essential cookies.
  • Execution of a contract or application of pre-contractual measures: to manage orders, quotes, purchases, or service requests.
  • Compliance with legal obligations: to fulfill applicable obligations in tax, accounting, commercial, or consumer matters.
  • Legitimate interest of the data controller: to ensure website security, prevent fraud, respond to inquiries received, and defend the company’s rights, provided that the rights and freedoms of the data subject do not override these interests.

In processing based on consent, failure to provide consent will not have negative consequences, but it may not be possible to provide the corresponding service or functionality.

5. How long will we keep the data?

Personal data will be kept for the time necessary to fulfill the purpose for which it was collected.

In general:

  • Data related to an information request or inquiry will be kept until the inquiry is answered and the necessary follow-up is completed. Subsequently, it may be kept blocked during the legal periods for claiming liabilities.
  • Customer and supplier data will be kept for the duration of the commercial relationship and during the applicable legal periods to comply with tax, accounting, or commercial obligations.
  • Data for commercial communications will be kept until the user withdraws consent or objects to receiving communications.
  • Data collected through cookies will be kept for the period indicated in the Cookie Policy or in the configuration panel of each cookie.
  • Website security logs will be kept for the time necessary to detect and investigate security incidents.

When data is no longer necessary, it will be deleted or properly anonymized, without prejudice to compliance with applicable legal obligations.

6. To whom may we disclose the data?

Personal data will not be sold to third parties.

Data may be disclosed to the following recipients:

  • To the Tax Administration, Social Security, courts, security forces, or other public administrations, when legally required.
  • To banking and payment institutions, when necessary to manage a payment or collection.
  • To professionals providing advisory, accounting, tax, or legal services.
  • To providers offering web hosting, email, security, IT maintenance, analytics, or other technological services.

Service providers will process the data as data processors, following Gelateria Boulevard’s instructions and complying with confidentiality, security, and data protection obligations.

7. International data transfers

Gelateria Boulevard may use the services of technological providers with headquarters or infrastructure outside the European Economic Area, for example, for email, web analytics, or social media management services.

In these cases, international data transfers will be carried out in accordance with applicable data protection regulations, including:

  • Through adequacy decisions of the European Commission.
  • Through standard contractual clauses approved by the European Commission.
  • Through other applicable appropriate safeguards.

When the user uses third-party social networks or platforms, the privacy policies of those platforms will also apply.

8. What rights does the user have?

The user has the following rights:

  • Right of access: to know if their data is being processed and to receive a copy of the data.
  • Right to rectification: to correct inaccurate or incomplete data.
  • Right to erasure: to request the deletion of data when it is no longer necessary or the processing is unlawful.
  • Right to restriction of processing: to limit the use of data in cases established by law.
  • Right to object: to object to processing based on legitimate interest.
  • Right to data portability: to receive data based on consent or a contract in a structured, commonly used, and machine-readable format.
  • Right to withdraw consent: in processing based on consent, to withdraw consent at any time, without affecting the lawfulness of the processing carried out previously.
  • Right not to be subject to automated decisions: not to be subject to automated decisions that produce legal effects or similarly significant effects, in cases provided for by law.

To exercise these rights, a request must be sent to:

gelateriaboulevard@gmail.com

The request must indicate the following:

  • Full name of the data subject.
  • The right to be exercised.
  • Contact address.
  • Information necessary to identify the request.

If there are reasonable doubts about identity, additional information to verify identity may be requested.

9. Filing a complaint with the supervisory authority

If the user believes that their personal data has not been processed correctly or their request for rights has not been properly addressed, they may file a complaint with the Spanish Data Protection Agency.

However, before filing a complaint, the user may contact Gelateria Boulevard to analyze the situation and find a solution.

10. Data of minors

The website is not specifically aimed at minors under fourteen years of age.

Those under fourteen years of age must not send their personal data without the consent of their parents or legal representatives.

If the owner becomes aware that they have received data from a minor without the necessary consent, they will take appropriate measures to delete such data.

11. Data security

EUKENI & AINARA, S.L. will implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration, or disclosure.

However, internet security cannot be fully guaranteed. Therefore, the user is recommended to protect their devices, use secure passwords, and not send particularly sensitive information via regular email.

12. Accuracy of data

The user guarantees that the data provided is true, accurate, complete, and up to date.

The user must notify any change that occurs in their data. The user will be responsible for any damages that may be caused as a result of providing false, inaccurate, or third-party data without the necessary consent.

13. Changes to the Privacy Policy

EUKENI & AINARA, S.L. may modify this Privacy Policy to adapt it to legal changes, criteria of the competent authorities, website functionalities, or data processing carried out.

Changes will be effective from the time they are published on the website. When significant changes are made, users will be notified appropriately.