Privacy Policy
Last updated: June 2025
1. Data Controller
The data controller responsible for your personal data is Mercado 46 Distribución Selecta S.L. (CIF B26769018), with registered address at Calle Francisco Quevedo 1, Mercado Municipal Marbella, Puesto 46, 29601 Marbella, Málaga, Spain. Contact: info@mercado46.com. You may also contact our Data Protection contact point at the same address.
2. Data We Collect
We collect the following personal data when you use our services:
- Name and surname
- Email address
- Delivery address
- Phone number
- Payment data (processed by Stripe, not stored by us)
- Order history
- Browsing data and preferences (anonymised analytics, if consented)
3. Purpose and Legal Basis
Order processing: Execution of the purchase contract (Art. 6.1.b GDPR).
Customer account: Provision of the contracted service (Art. 6.1.b GDPR).
Newsletter: Your explicit consent, which you may withdraw at any time (Art. 6.1.a GDPR).
Legal compliance: Tax and commercial obligations under Spanish law (Art. 6.1.c GDPR).
4. Data Retention
We retain your data only for as long as necessary for each purpose:
| Purpose | Retention period |
|---|---|
| Orders & invoices | 5 years (tax obligation) |
| Active customer account | Duration of the relationship + 3 years inactive |
| Newsletter subscription | Until unsubscribe |
| Contact messages | 1 year |
| Server & security logs | 12 months |
| Cookie analytics data | 13 months (if consented) |
5. Your Rights (GDPR)
You have the right to:
- Access your personal data
- Rectify inaccurate data
- Request erasure ("right to be forgotten")
- Object to or restrict processing
- Data portability
- Withdraw consent at any time
- Not be subject to automated decision-making (see section 8)
To exercise these rights, contact us at info@mercado46.com. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
6. Data Processors
We share your personal data only with the following processors, who provide services necessary for operating the platform:
| Processor | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Payment processing | USA (DPF certified) |
| Google / Firebase | Authentication, database, storage | USA (SCCs + DPF) |
| Cloudinary | Image storage and optimisation | USA (SCCs) |
| Resend | Transactional emails | USA (SCCs) |
| Holded | Invoicing and order management | Spain (EU) |
| Packlink | Shipping logistics | Spain (EU) |
| Cloudflare Turnstile | Bot protection | USA (SCCs) |
7. International Data Transfers
Some of the processors listed above are based in the United States. These transfers are covered by one or more of the following safeguards:
- EU–US Data Privacy Framework (DPF) certification — for Stripe and Google
- Standard Contractual Clauses (SCCs) approved by the European Commission (2021/914) — for all US processors
- Adequacy decisions for other third countries where applicable
You may request a copy of the applicable safeguards by contacting us at info@mercado46.com.
8. Automated Decision-Making
Our platform uses automated processes in the following contexts, none of which produce legal or similarly significant effects:
- AI Sommelier: wine recommendations generated by artificial intelligence based on your stated preferences. These are suggestions only and do not affect prices, access, or any right.
- Personalised suggestions in the catalogue: based on browsing and purchase history to improve the shopping experience.