1. Data Controller
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data — hereinafter, the "GDPR" — and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights — hereinafter, the "LOPDGDD" — users are informed that the controller responsible for processing their personal data is:
Data Controller: JUST KEEP GOING, S.L.
Trading name: Sabor Ritmo
Tax Identification Number (NIF): B88442991
Registered office: Calle San Manuel, 2, Esc. E, bajo 7, 28 220 Majadahonda, Madrid, Spain
Email: info@saborritmo.es
Website: https://saborritmo.es/
Hereinafter referred to as "Sabor Ritmo", "the Company", "we", "us" or "the Data Controller".
This Privacy Policy explains how we collect, use, retain, disclose and protect the personal data of individuals who visit the website, request information, place an order, create an account, purchase our products or services, or contact us.

2. Scope of This Privacy Policy
This Privacy Policy applies to the processing of personal data carried out through:

• the website https://saborritmo.es/;
• contact forms and information request forms;
• order forms;
• the customer’s personal account or user area;
• the personalised menu request form;
• communications by email, telephone or WhatsApp;
• order, payment and delivery management;
• customer support and incident handling;
• marketing communications, where the user has given consent or another lawful basis applies;
• analytics and advertising tools used on the website;
• any other channel through which the user voluntarily provides personal data to Sabor Ritmo.

Corresponding translations of this Privacy Policy may be made available for versions of the website provided in other languages.
In the event of any discrepancy between the different language versions, the Spanish version shall prevail, without prejudice to any mandatory rights granted to consumers and users under applicable law.

3. Personal Data We May Process
Depending on the user’s relationship with Sabor Ritmo and the services requested, we may process the following categories of personal data.

3.1. Identification Data

• first name and surname;
• username;
• customer identification number;
• signature, where required;
• identity document details, only where necessary for invoicing, fraud prevention or compliance with a legal obligation.

3.2. Contact Details

• email address;
• telephone number;
• postal address;
• postcode;
• town or city and province;
• delivery address;
• delivery instructions;
• preferred communication channel.

3.3. Order and Contractual Data

• selected meal plan;
• meals and products purchased;
• number of days purchased;
• delivery frequency;
• delivery date and time slot;
• delivery address;
• order history;
• discounts and promotions applied;
• comments provided by the customer;
• foods to be excluded;
• requested changes, pauses or cancellations;
• incidents relating to an order;
• communications relating to the provision of the service.

3.4. Payment and Billing Data

• selected payment method;
• purchase amount;
• transaction status;
• information required to issue invoices;
• information relating to refunds, outstanding payments or financial claims.

Where payment is made by bank card, the complete card details are processed directly by the relevant payment service provider, such as Stripe.
As a general rule, Sabor Ritmo does not have access to the full card number or security code.

3.5. Account and Access Data

• login credentials;
• encrypted password;
• account activity history;
• profile settings and preferences;
• information required to recover or secure the account;
• order and delivery history.

Users are responsible for maintaining the confidentiality of their login credentials and must notify Sabor Ritmo of any unauthorised access or use of which they become aware.

3.6. Dietary Preference Data
Sabor Ritmo may process information provided by customers regarding:

• foods they wish to exclude;
• dietary preferences;
• nutritional goals;
• foods they do not consume;
• special diets;
• preferred menu composition;
• preferences relating to flavours, portion sizes or types of dishes;
• food allergies or intolerances.

3.7. Health Data and Special Categories of Personal Data
When requesting a personalised menu, users may voluntarily provide information concerning:

• food allergies;
• food intolerances;
• medical conditions or circumstances relevant to menu preparation;
• medical recommendations;
• nutritional recommendations;
• health-related goals;
• training programmes;
• dietary restrictions;
• medication or treatment that may affect diet;
• other information required to assess the request.

Users may also attach documents containing medical, nutritional or sports-related recommendations.
This information is classified as special-category personal data and will only be processed where both of the following conditions are met:

• the data is necessary to deal with the user’s specific request; and
• the user has given explicit consent through a clear, specific and separate affirmative statement or action.

Sabor Ritmo does not request complete medical records or medical information that is not necessary to prepare, adapt or assess the requested menu.
Users should avoid submitting diagnoses, medical reports or other health information that is not strictly necessary.
The preparation of a personalised menu by Sabor Ritmo does not constitute a diagnosis, medical treatment or healthcare service. Where the user’s circumstances require medical assessment, they should consult a doctor, registered dietitian-nutritionist or another appropriately qualified healthcare professional.

3.8. Communication Data
Sabor Ritmo may process:

• enquiries;
• requests;
• complaints;
• the content of emails;
• messages sent through WhatsApp;
• telephone communications;
• comments and reviews;
• attached documents and files;
• communications relating to orders, payments or deliveries.

3.9. Technical and Browsing Data
When users access the website, the following information may be collected:

• IP address;
• browser type and version;
• operating system;
• device used;
• language;
• date and time of access;
• pages visited;
• referring URL;
• technical identifiers;
• security logs;
• interactions with the website;
• information collected through cookies, pixels and similar technologies.

The use of non-essential cookies is governed by the Cookie Policy and the preferences selected by the user in the cookie settings panel.

4. Sources of Personal Data
Personal data processed by Sabor Ritmo may be obtained:

• directly from the data subject when they complete a form, place an order, create an account or contact us;
• from a person placing an order on behalf of someone else or naming a third party as the recipient;
• from payment service providers that notify us of the status of a transaction;
• from transport and delivery companies that provide information about a delivery;
• from technology providers where necessary to maintain the security and operation of the service;
• from analytics and advertising tools where the user has authorised the relevant cookies;
• from lawfully accessible sources where permitted by applicable law.

Where a user provides personal data relating to another individual, such as the name, telephone number or address of a different recipient, the user confirms that they are authorised to provide that information and that they have informed the relevant person about the processing of their data.

5. Purposes and Lawful Bases for Processing
5.1. Handling Enquiries and Information Requests
Sabor Ritmo processes personal data in order to:

• answer questions;
• respond to requests;
• provide information about menus, prices, deliveries and services;
• prepare quotations;
• contact the user through their chosen communication channel;
• follow up on the enquiry.

Lawful basis: the data subject’s consent, expressed by voluntarily submitting the request, and, where applicable, taking steps at the user’s request before entering into a contract.
Where a user contacts Sabor Ritmo through WhatsApp, their data will be processed to respond to the enquiry, manage the requested relationship and, where relevant, handle matters relating to orders, deliveries or purchased services.
Use of WhatsApp is also subject to the terms and privacy policy of that service provider.

5.2. Registration and Management of Personal Accounts
Sabor Ritmo processes personal data in order to:

• create and maintain an account;
• identify the user;
• save orders and preferences;
• make future orders easier;
• enable delivery management;
• protect account security;
• recover login credentials;
• maintain a history of orders and communications.

Lawful basis: performance of the contractual relationship or taking steps at the user’s request before entering into a contract.

5.3. Processing and Fulfilling Orders
Sabor Ritmo processes personal data in order to:

• register the order;
• verify its contents;
• confirm availability;
• prepare the meals;
• manage ingredient changes or exclusions;
• arrange delivery;
• communicate with the customer;
• send confirmations and notifications;
• process changes, pauses or cancellations;
• manage incidents;
• provide the purchased service.

Lawful basis: performance of the contract for the sale of goods or provision of services entered into with the customer, and taking steps before entering into a contract.
The data required to process an order is mandatory. If the user does not provide it, Sabor Ritmo will not be able to process the purchase or complete the delivery correctly.

5.4. Payments, Invoicing and Accounting Obligations
Sabor Ritmo processes personal data in order to:

• process and verify payments;
• confirm transactions;
• manage outstanding amounts;
• issue invoices;
• process refunds;
• maintain accounting and tax records;
• comply with applicable legal obligations.

Lawful basis: performance of the contract and compliance with legal obligations relating to taxation, accounting, commercial law and consumer protection.

5.5. Delivery Management
Sabor Ritmo processes personal data in order to:

• provide the courier or transport company with the recipient’s name, telephone number, address and necessary instructions;
• coordinate delivery dates and time slots;
• confirm delivery;
• manage changes of address;
• resolve delays or other incidents;
• track shipments;
• contact the recipient where necessary.

Lawful basis: performance of the contract.
Where delivery is carried out by an external company, the necessary data may be disclosed to SEUR, SEUR Frío or another logistics operator or transport company engaged by Sabor Ritmo.

5.6. Preparation and Management of Personalised Menus
Sabor Ritmo processes personal data in order to:

• assess the request;
• identify dietary preferences and foods to be excluded;
• take allergies or intolerances into account;
• prepare a personalised proposal;
• adapt ingredients;
• contact the user to clarify their requirements;
• manage the requested service;
• provide follow-up for the purchased menu.

General lawful basis: taking steps at the user’s request before entering into a contract and performance of the contract.
Where the information provided includes health data, allergies, intolerances, medical recommendations or other special categories of personal data:
Specific lawful basis: the data subject’s explicit consent in accordance with Article 9(2)(a) of the GDPR.
The user may withdraw this consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.
Where the user withdraws consent and the health data is necessary to provide the requested personalised menu, Sabor Ritmo may be unable to continue providing that service.

5.7. Handling Enquiries, Complaints and Incidents
Sabor Ritmo processes personal data in order to:

• handle complaints and claims;
• verify orders;
• resolve issues involving missing, incorrect or damaged products;
• investigate quality-related incidents;
• process refunds or compensation;
• respond to consumer requests;
• manage official complaint forms;
• protect its rights in the event of a dispute.

Lawful basis: performance of the contract, compliance with legal obligations and, where applicable, Sabor Ritmo’s legitimate interest in handling complaints, preventing abuse and defending its rights.

5.8. Fraud Prevention and Security
Sabor Ritmo may process technical, account, transaction and activity data in order to:

• detect unauthorised access;
• prevent fraudulent orders;
• prevent misuse of the website;
• protect accounts and systems;
• investigate security incidents;
• preserve the integrity of its services;
• establish, exercise or defend legal claims.

Lawful basis: Sabor Ritmo’s legitimate interest in protecting its business, systems, customers and rights.
This processing will be carried out proportionately and with due regard for the rights and freedoms of data subjects.

5.9. Compliance with Legal Obligations
Sabor Ritmo may retain, process or disclose personal data where necessary to:

• comply with tax, commercial and accounting obligations;
• respond to administrative or judicial requests;
• cooperate with competent authorities;
• comply with consumer protection legislation;
• comply with e-commerce legislation;
• comply with food safety requirements;
• comply with data protection legislation;
• manage inspections, claims or legal proceedings.

Lawful basis: compliance with a legal obligation.

5.10. Marketing Communications
Where the user has given consent, Sabor Ritmo may send information about:

• new menus;
• promotions;
• discounts;
• news;
• services;
• campaigns;
• content relating to food and wellbeing;
• other commercial communications from Sabor Ritmo.

Lawful basis: the data subject’s consent.
Where there is a prior contractual relationship, Sabor Ritmo may send information about its own products or services that are similar to those already purchased, where permitted by applicable law and provided that the user is offered a simple and free way to opt out.
Users may unsubscribe from marketing communications at any time:

• by using the unsubscribe link included in each communication;
• by emailing info@saborritmo.es;
• by using any other method made available.

Acceptance of this Privacy Policy does not automatically constitute consent to receive marketing communications.

5.11. Analytics, Advertising Measurement and Personalised Advertising
Where the user has given consent through the cookie settings panel, Sabor Ritmo may use tools such as Google Analytics and Meta Pixel in order to:

• analyse the use and performance of the website;
• identify the pages visited;
• analyse website interactions;
• identify errors;
• improve the user experience;
• measure enquiries, purchases and other conversions;
• assess the performance of advertising campaigns;
• create audiences;
• display advertising based on the user’s interests where advertising cookies have been authorised.

Lawful basis: the user’s consent.
Google Analytics and Meta Pixel must not be activated until the user has accepted the relevant category of cookies.
Consent may be withdrawn or changed at any time through the "Cookie Settings" option available on the website.
Where analysis is carried out exclusively using aggregated or anonymised data that cannot be used to identify the user, that information will no longer be considered personal data.

6. Mandatory and Voluntary Data
Fields marked as mandatory in forms are necessary to process the request, manage the order or provide the service.
If the user does not provide the required data, Sabor Ritmo may be unable to:

• respond to the enquiry;
• create an account;
• process the payment;
• prepare the order;
• complete the delivery;
• prepare a personalised menu;
• resolve an incident;
• issue an invoice.

Providing data for marketing communications is voluntary and is not a condition of purchasing products or services.
Providing health data for a personalised menu is also voluntary. However, where such data is necessary to adapt the menu to the user’s requirements, failure to provide it may prevent Sabor Ritmo from properly delivering the requested service.

7. Recipients of Personal Data
Personal data will not be sold or disclosed to third parties for commercial activities unrelated to Sabor Ritmo.
However, personal data may be disclosed or made accessible to certain categories of recipients where necessary to provide the services, comply with legal obligations or manage the relationship with the user.

7.1. Delivery and Transport Companies
The following parties may receive the data required to deliver an order:

• Sabor Ritmo’s own couriers or contracted delivery personnel;
• SEUR;
• SEUR Frío;
• other logistics operators;
• temperature-controlled transport companies;
• shipment tracking service providers.

The disclosed data may include the recipient’s name, telephone number, address, delivery time slot and delivery instructions.

7.2. Payment Service Providers
Where the user pays by bank card or another electronic payment method, the necessary data will be processed by the payment service provider, such as Stripe, in accordance with its own terms and privacy policy.
Depending on the type of transaction and its legal obligations, Stripe may act as a processor on behalf of Sabor Ritmo or as an independent controller.

7.3. Technology Providers and External Platforms
To manage the website, orders, communications, customer relationships, analytics and advertising, Sabor Ritmo uses technology providers that may access certain personal data on behalf of the Data Controller or process it in accordance with their own terms.
These providers include:

• Tilda Publishing and Tilda CRM, as the platform used for website development, hosting and technical operation, receiving form submissions, and managing enquiries, customers, orders, communications and the history of commercial relationships;
• Google Analytics, for obtaining statistics about website usage where the user has authorised analytics cookies;
• Meta Platforms through Meta Pixel, for measuring advertising campaign effectiveness, analysing conversions, creating audiences and, where applicable, displaying personalised advertising where the user has authorised advertising cookies;
• WhatsApp, as a communication channel for customers and users who choose to contact Sabor Ritmo through that service;
• providers of hosting, email, data storage, backups, maintenance, technical support, automation, security and order management services.

These providers may only process data that is necessary to provide the relevant services and must offer sufficient guarantees regarding confidentiality, security and compliance with data protection legislation.
Where a provider acts as a processor on behalf of Sabor Ritmo, the Company will enter into the relevant data processing agreement with that provider.
Where a provider processes certain data as an independent controller, the processing will also be governed by that provider’s own privacy policy.

7.4. Professional Advisers
Where necessary, personal data may be accessed by:

• administrative and accounting service providers;
• tax advisers;
• accounting advisers;
• lawyers;
• auditors;
• insurance companies;
• technical consultants and data protection specialists.

7.5. Public Authorities and Bodies
Personal data may be disclosed to:

• tax authorities;
• health authorities;
• consumer protection authorities;
• the Spanish Data Protection Agency;
• law enforcement authorities;
• courts and tribunals;
• other competent public bodies.

Such disclosures will only be made where required by law, pursuant to a valid official request or where necessary to establish, exercise or defend legal claims.

8. International Data Transfers
Some of the service providers used by Sabor Ritmo may be established outside the European Economic Area or may process information using infrastructure located in third countries.
This may occur, in particular, when using services provided by:

• Google;
• Meta Platforms;
• WhatsApp;
• Stripe;
• Tilda Publishing and Tilda CRM;
• certain hosting, data storage, communication, technical support or security providers.

Where processing involves an international transfer of personal data, Sabor Ritmo will verify that the transfer is covered by a mechanism recognised under the GDPR, such as:

• an adequacy decision adopted by the European Commission;
• the provider’s participation in the EU-US Data Privacy Framework, where applicable;
• Standard Contractual Clauses approved by the European Commission;
• Binding Corporate Rules;
• other safeguards recognised under applicable law.

Where necessary, additional contractual, technical or organisational measures will be implemented to protect personal data.
Users may request further information about international data transfers and the safeguards applied by emailing info@saborritmo.es.

9. Data Retention Periods
Personal data will only be retained for as long as necessary to fulfil the purposes for which it was collected and subsequently for the periods required to comply with legal obligations and address any potential liabilities.

9.1. Enquiries and Information Requests
Personal data will be retained for as long as necessary to respond to and follow up on the request.
If no contractual relationship is established, the data may be deleted or restricted after a reasonable period following the last communication.

9.2. Customer, Order and Contract Data
Personal data will be retained for the duration of the contractual relationship and will subsequently be restricted for the applicable statutory limitation periods.

9.3. Tax, Accounting and Billing Data
This information will be retained for the periods required under tax, commercial and accounting legislation.

9.4. Payment Data
Sabor Ritmo will only retain the information necessary to demonstrate the transaction, process refunds and comply with legal obligations.
Complete payment card details will be processed by the payment service provider.

9.5. Health Data and Personalised Menus
Health data will be retained for as long as necessary to prepare, adapt and manage the requested personalised menu.
Once the service has ended, the data will be deleted or anonymised when it is no longer required, except where:

• the user asks Sabor Ritmo to retain their preferences for future orders;
• a legal retention obligation applies;
• the data must be temporarily restricted in order to address potential liabilities.

Medical, nutritional or sports-related documents will be deleted as soon as they are no longer required for the specific purpose for which they were submitted.

9.6. Marketing Communications
Personal data will be retained until the user withdraws consent, objects to the processing or unsubscribes.
Sabor Ritmo may retain a minimum amount of information on a suppression list in order to respect the user’s decision and avoid sending further unwanted communications.

9.7. Complaints and Incidents
Personal data will be retained for as long as necessary to handle the complaint or incident and subsequently for the periods required to establish, exercise or defend potential legal claims.

9.8. Technical Data and Cookies
Technical data and cookie information will be retained for the periods specified in the Cookie Policy and in accordance with the preferences selected by the user.
Once the applicable retention periods have expired, personal data will be securely deleted, anonymised or restricted.

10. Rights of Data Subjects
Users may exercise the following rights.

10.1. Right of Access
Users may request confirmation as to whether Sabor Ritmo processes their personal data and obtain information about that processing.

10.2. Right to Rectification
Users may request the correction of inaccurate personal data or the completion of incomplete personal data.

10.3. Right to Erasure
Users may request the deletion of their personal data, including where the data is no longer necessary for the purposes for which it was collected.

10.4. Right to Object
Users may object to processing based on legitimate interests or to the use of their personal data for marketing communications.

10.5. Right to Restriction of Processing
Users may request that the processing of their personal data be restricted in the circumstances provided for by law.

10.6. Right to Data Portability
Users may receive the personal data they have provided in a structured, commonly used and machine-readable format, or request that it be transmitted to another controller where technically feasible.

10.7. Right to Withdraw Consent
Users may withdraw consent given for a specific processing purpose at any time.
Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

10.8. Right Not to Be Subject to Solely Automated Decisions
Users may request not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects or similarly significantly affects them.
As a general rule, Sabor Ritmo does not make solely automated decisions that produce legal effects or significantly affect users.

11. How to Exercise Your Rights
Users may exercise their rights by submitting a request to:
Email: info@saborritmo.es
Alternatively, requests may be sent by post to:
JUST KEEP GOING, S.L.
Calle San Manuel, 2, Esc. E, bajo 7
28 220 Majadahonda, Madrid
Spain
The request should include:

• the user’s first name and surname;
• the right they wish to exercise;
• sufficient information to locate the relevant personal data;
• an address or other means of receiving the response;
• any documentation required to verify identity where there are reasonable doubts.

Sabor Ritmo may request additional information to verify the identity of the applicant and prevent personal data from being disclosed, deleted or changed by an unauthorised person.
Exercising these rights is free of charge.
However, measures permitted by law may be applied where requests are manifestly unfounded or excessive, particularly because of their repetitive nature.
Requests will be handled within the legally prescribed period.

12. Complaints to the Supervisory Authority
If users believe that the processing of their personal data infringes applicable data protection legislation, they may lodge a complaint with:
Spanish Data Protection Agency — AEPD
Calle Jorge Juan, 6
28 001 Madrid
Spain
Users may also use the electronic channels made available by the Spanish Data Protection Agency.
Before lodging a complaint, users may contact Sabor Ritmo at info@saborritmo.es in an attempt to resolve the matter.

13. Minors
Sabor Ritmo’s products and services are primarily intended for adults with legal capacity to enter into contracts.
Minors should not place orders or provide personal data without the involvement and authorisation of their parents, guardians or other legal representatives.
If Sabor Ritmo becomes aware that it has received a minor’s personal data without valid authorisation, it will take reasonable steps to delete that data.
Where a parent, guardian or legal representative orders a menu for a minor, that person is responsible for providing accurate and strictly necessary information, particularly regarding allergies, intolerances or dietary needs.

14. Accuracy and Currency of Personal Data
Users confirm that the personal data they provide is:

• truthful;
• accurate;
• complete;
• up to date.

Users must notify Sabor Ritmo of any changes so that the information can be kept current.
Sabor Ritmo will not be liable for harm arising from false, incomplete, outdated or unauthorised data, without prejudice to the legal obligations applicable to the Data Controller.

15. Security and Confidentiality
Sabor Ritmo applies appropriate technical and organisational measures to protect personal data against:

• destruction;
• loss;
• alteration;
• unauthorised access;
• accidental or unlawful disclosure;
• misuse;
• unauthorised processing.

These measures are determined taking into account:

• the nature of the personal data;
• the scope of processing;
• the purposes of processing;
• risks to individuals' rights and freedoms;
• the state of the art;
• implementation costs.

Employees and contractors with access to personal data are subject to confidentiality obligations.
However, no system connected to the internet can guarantee absolute security.
If Sabor Ritmo becomes aware of a personal data breach that may pose a risk to users, it will comply with its legal obligations regarding assessment, documentation and, where applicable, notification.

16. Cookies and Similar Technologies
The website uses technical cookies that are necessary for its operation and may also use analytics, advertising and personalisation cookies with the user’s consent.
Non-essential cookies must not be installed before a valid choice has been obtained from the user.
Users may:

• accept all cookies;
• reject cookies;
• configure cookies by category;
• subsequently withdraw or change their consent.

Sabor Ritmo uses tools including Google Analytics and Meta Pixel where the user has previously authorised the relevant cookie categories.
Detailed information about the cookies used, their providers, purposes, categories and retention periods is available in the Cookie Policy.

17. Social Media, WhatsApp and External Links
Sabor Ritmo may maintain social media profiles and provide links to third-party websites, platforms and services.
When users interact with our social media profiles, the processing of their personal data may also be governed by the terms and privacy policy of the relevant social media platform.
Where users contact Sabor Ritmo through WhatsApp, certain personal data may be processed by WhatsApp or companies within its group in accordance with their own terms and privacy policies.
Sabor Ritmo does not control the privacy policies or practices of external websites or platforms. Users are advised to review the relevant terms before providing personal data.
The voluntary publication of comments, images or other information on social media may make that content visible to other users.

18. Changes to This Privacy Policy
Sabor Ritmo may update this Privacy Policy in response to:

• changes in legislation;
• new guidance issued by supervisory authorities;
• changes to services;
• the appointment or replacement of service providers;
• technical changes to the website;
• new types of personal data processing.

Where changes are significant, users will be informed through a notice on the website, by email or through another appropriate method.
The date of the latest update will be shown at the beginning of the document.
Users are advised to review the current version of this Privacy Policy periodically.

19. Contact Details
For any questions regarding this Privacy Policy or the processing of personal data, users may contact:
JUST KEEP GOING, S.L. — Sabor Ritmo
Calle San Manuel, 2, Esc. E, bajo 7
28 220 Majadahonda, Madrid, Spain
Email: info@saborritmo.es