Legal Information

Privacy policy

Learn how Cortijo de Suerte Alta handles your personal data in accordance with the GDPR and the LOPDGDD.

Table of contents

1. Data controller
2. Purposes and legal basis
3. Data we collect
4. Retention period
5. Data sharing and processors
6. International transfers
7. Your rights
8. Security measures
9. Minors
10. Changes

At Cortijo de Suerte Alta we take the privacy of the people we interact with very seriously. This policy transparently explains, in accordance with the Regulation (EU) 2016/679 (GDPR) and the Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), how we collect, use and protect your personal data.

Data Controller

The controller responsible for the processing of your personal data is:

Company name	Cortijo de Suerte Alta, S.L.
Tax ID (NIF/CIF)	B84487529
Registered address	Ctra. Baena-Zuheros Km 5, 14850 Baena (Córdoba), Spain
Contact	Email: info@suertealta.es · Phone: +34 957 690 052
Commercial Registry	Córdoba Commercial Registry, volume [TOMO], page [FOLIO], sheet [HOJA], entry [Nº]
Website	www.suertealta.es
Business activity	Production, packaging and marketing of organic extra virgin olive oil

Purposes of processing and legal basis

The controller responsible for the processing of your personal data is:

2.1 Order management and delivery

Legal basis: performance of the sales contract (Art. 6.1.b GDPR). Necessary data: name, surname, shipping and billing address, email, phone number, payment details. Without this information we cannot process and ship your order.

2.2 Invoicing and tax obligations

Legal basis: compliance with a legal obligation (Art. 6.1.c GDPR) under the Commercial Code and the General Tax Law.

2.3 Sending commercial communications (newsletter)

Legal basis: explicit consent (Art. 6.1.a GDPR), which you may withdraw at any time. If you are already a customer, we may also send you information about similar products based on legitimate interest (Art. 6.1.f GDPR and Art. 21 LSSI-CE).

2.4 Handling inquiries submitted through forms and email

Legal basis: consent and legitimate interest in responding to your request.

2.5 Web analytics and service improvement

Legal basis: consent, managed through the cookie banner. See Cookie Policy.

2.6 Compliance with legal obligations and administrative or judicial requirements

Legal basis: legal obligation (Art. 6.1.c GDPR).

Data we collect

We process only the data strictly necessary for each purpose, specifically:

Identification data: name, surname, tax ID / NIF (for invoicing purposes only), date of birth (if provided).
Contact details: email, phone number, shipping and billing postal address.
Transaction data: purchased products, amount, date and payment method. We do not store full card numbers: payment is processed directly through the Redsys payment gateway.
Browsing data: IP address, device, browser, pages visited and interaction events. See the Cookie Policy.
Friends’ Club data: declared preferences (delivery frequency, favourite variety, etc.) when you sign up.

Retention period

We retain your data for as long as strictly necessary for each purpose and, thereafter, for the periods legally required:

Customer data (purchases): for the duration of the business relationship and, thereafter, for the applicable legal periods (6 years for commercial matters, 4-10 years for tax matters).
Newsletter and commercial communications: until you withdraw your consent.
Inquiries via contact form: up to 12 months after the last interaction.
Browsing data / cookies: as set out in the Cookie Policy.

Data sharing and processors

We do not sell your personal data to third parties. We only share it with:

Providers acting as data processors, with whom we have entered into contracts in accordance with Art. 28 GDPR:
- E-commerce platform and hosting: WooCommerce
- Payment gateway: Redsys and PayPal
- Email marketing platform: [Mailchimp / Brevo / Klaviyo]
- Web analytics services: Google Analytics 4 (Google Ireland Ltd.)
- Customer service and CRM: [HubSpot / Zendesk]
Public authorities, law enforcement agencies and judicial authorities, where there is a legal obligation to do so.
Financial institutions for the management of payments and refunds.

International data transfers

Some of our providers have servers outside the European Economic Area (for example, in the United States). In such cases, we ensure an adequate level of protection through:

European Commission adequacy decisions, where applicable (for example, the EU-US Data Privacy Framework for certified providers).
Standard Contractual Clauses approved by the European Commission.
Transfer impact assessments and additional measures where necessary.

Your rights

The GDPR grants you the following rights over your personal data:

Access: find out what data of yours we process.
Rectification: correct inaccurate or incomplete data.
Erasure (“right to be forgotten”): request the deletion of your data when it is no longer necessary.
Objection: object to the processing for reasons related to your particular situation.
Restriction of processing: request that we only retain your data without processing it.
Portability: receive your data in a structured, commonly used format.
Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
Not to be subject to automated decision-making with legal effects or that significantly affects you.

You may exercise these rights by sending an email to info@suertealta.es or to dpd@suertealta.es, enclosing a copy of your identification document. We will respond within a maximum period of one month.

If you believe we have not properly handled your request, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): C/ Jorge Juan, 6, 28001 Madrid · www.aepd.es · 901 100 099.

Security measures

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure: SSL/TLS encryption on the website and in communications, access controls, backups, staff training, confidentiality agreements and periodic review of providers.

Minors

Our products and services are aimed at persons over 18 years of age. We do not knowingly collect data from children under 14 years of age. If we discover that we have collected data from a minor without the consent of their legal guardians, we will delete it without delay.

Changes to this policy

We may update this policy to reflect regulatory or technical changes, or changes to our data processing practices. We recommend that you review it periodically. Substantial changes will be expressly communicated to affected users.

Last updated: 20 May 2026 · Version 1.0

Have any questions about your data?

We are at your disposal to resolve any query related to the privacy and processing of your personal data.

Your cart is empty