Privacy policy
Last updated: 3 November 2026
How we handle your information when you browse the site, contact the bakery or place an order.
Who is responsible
Pan i Bulka operates this bakery in Torrefiel, Valencia, Spain and is responsible for the customer information used to manage its orders. Contact the bakery using the links below.
Information we collect
Your name, chosen contact details (phone, Instagram or Telegram), ordered products, quantities, pickup date and time, order notes and any promotional code. Hosting and security providers also process technical connection data such as IP addresses. Please avoid including sensitive personal information in order notes.
Purposes and legal bases
We use order and contact information to take steps at your request and fulfil your order (GDPR Article 6(1)(b)). Records required by tax or accounting law are processed to meet legal obligations (Article 6(1)(c)). Technical security processing relies on legitimate interests in keeping the site secure (Article 6(1)(f)). Optional Google Analytics measurement requires your consent (Article 6(1)(a)); refusing it does not prevent ordering. Required order fields are needed to process your request. We do not make automated decisions with legal or similarly significant effects.
Service providers
Aystra provides the website and ordering platform and processes order information for the bakery. Cloudflare provides hosting and delivery infrastructure. Order notifications are sent through Telegram. If you choose social messaging, that provider also handles your messages under its own terms. Google receives analytics information only if you accept analytics. We do not sell customer information.
Website and ordering platform provided by Aystra.
Data processing agreement (draft) Aystra publishes proposed processing terms. Publication alone does not establish an accepted agreement; customer-specific processing schedules and express acceptance are still required.
How long information is kept
Order information is kept for fulfilment, customer follow-up and the handling of claims. Records needed for tax, accounting or other legal obligations may need to be kept longer, with access restricted where appropriate. Browser storage remains on your device until cleared or replaced. The precise operational deletion schedule and provider backup periods are being reviewed; no automatic 12-month deletion is promised here.
Your data protection rights
You can request access, correction, erasure, restriction and portability of your data, and object to processing based on legitimate interests where applicable. You may withdraw analytics consent at any time using Cookie settings. Rights are subject to applicable legal conditions, including mandatory record retention. Contact the bakery using the links below; requests are normally answered within one month, with lawful extensions for complex requests.
You may lodge a complaint with Spain’s data protection authority (AEPD). www.aepd.es
Cookies and browser storage
The website stores your basket and previously entered checkout contact details in local storage on this browser to support ordering. These details may remain accessible to other people using the same browser. Clear site data in your browser to remove them. A separate preference records your analytics choice for six months. When you accept, Google Analytics can store _ga and _ga_* cookies for up to six months; rejecting analytics prevents the site from loading Google Analytics.
Providers and international processing
Customer and order data are stored on servers in Germany, inside the European Union. The messaging services you use to contact us (WhatsApp, Instagram, Telegram) and some infrastructure providers may process information outside the European Economic Area under their own policies.
Your choices
Use the cookie settings to accept or reject optional analytics. External social and platform links open third-party websites whose privacy practices apply there.