Privacy Policy

Who we are

Art Bakery, S.L. (“Art Bakery”, “we”, “us”) operates the cafés and bakery at Marbella, Estepona, Arroyo de la Miel (Benalmádena), and San Pedro de Alcántara on the Costa del Sol, Spain, and this website (artbakery.es). We are the data controller for the personal data described in this policy. You can reach us at office@artbakery.es or by visiting any of our locations.

What personal data we collect

We collect personal data when you:

• Contact us — through the Contact or Partner forms: your name, email, phone number, and the content of your message.
• Apply as a content creator — through the Content Creator application form: your name, email, phone, city/country, social media handles and follower counts, audience data you provide, portfolio links, and any files you upload (media kit, audience screenshots).
• Order a cake — through our online cake shop: the cake, size, and extras you choose, your pickup or delivery details (including a delivery address if you choose home delivery), your order notes, and payment information. Payment is processed entirely by Stripe — we never see or store your card details.
• Browse our website — if you accept cookies via the banner shown on your first visit, we use Google Analytics and Google Tag Manager to understand how the site is used, and the Meta (Facebook/Instagram) Pixel to measure the performance of our Instagram and Facebook ads. None of this loads unless you accept. Separately, a strictly necessary session cookie keeps our internal team logged into our private admin dashboard; it is not set for visitors browsing the public site and doesn’t require consent.

Cookies and analytics

The first time you visit, a banner asks whether you accept analytics and advertising cookies. If you accept, we set:

• Google Analytics 4 / Google Tag Manager — cookies that help us understand traffic and how visitors use the site.
• Meta Pixel — a cookie that lets us measure and improve the performance of our Instagram and Facebook advertising.

If you decline, none of these are set, and no data is sent to Google or Meta for analytics/advertising purposes. You can change your choice at any time using the “Cookie preferences” link in the footer of every page.

How we use your data

We use your personal data to:

• Respond to your enquiries and process your cake orders (performance of a contract).
• Review content-creator collaboration applications (your consent, given when you submit the form).
• Send you order confirmations and, if you opt in, occasional updates about Art Bakery (consent, which you can withdraw at any time).
• Keep our records, prevent fraud, and comply with our legal and tax obligations (legal obligation / legitimate interest).

Who we share it with

We share personal data only with the service providers who help us run the site and business, under their own data protection terms:

• Stripe (payment processing) — for cake orders.
• Resend (transactional email) — to send order and application confirmations.
• Netlify (website hosting and form storage) — stores form submissions (including uploaded files) and hosts the site.
• Google (Places API) — to display our public Google review score on our location pages; this only reads publicly available review data and does not involve your personal data.
• Google Analytics / Google Tag Manager and Meta (Facebook/Instagram) Pixel — only if you accept cookies via our consent banner; see “Cookies and analytics” above.

Some of these providers are based outside the European Economic Area (notably the United States). Where that’s the case, they provide appropriate safeguards for international data transfers (such as Standard Contractual Clauses), as required by GDPR.

We never sell your personal data.

How long we keep it

We keep enquiry and application data for as long as needed to respond to you and, after that, for a reasonable period in case you follow up. We keep order records for as long as required by Spanish tax and commercial law (generally several years). You can ask us to delete data sooner where we’re not legally required to keep it — see “Your rights” below.

Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Ask us to delete your data (“right to be forgotten”), where applicable.
• Object to or restrict certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email us at office@artbakery.es. If you’re not satisfied with our response, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).

Changes to this policy

We may update this policy from time to time — for example, as we add new features to the site. We’ll update the date below when we do.

Last updated: 1 August 2026.