Privacy policy
Last updated: 30/07/2026
Data controller
Elien Turoboiska-Marahulian (El Lavash), NIF (NIE) Y9545060M, C/ Marfull 11, 17310 Lloret de Mar (Girona), Spain. Contact: WhatsApp +34 627 324 835 · Instagram @el.lavash.
What data we process and why
When you place an order we store: name, phone, delivery address (if you choose delivery) and order notes. Purpose: to prepare, confirm and deliver your order. Legal basis: performance of a contract (Art. 6.1.b GDPR). Without this data we cannot manage the order.
We also process, only when you send it yourself: your email address if you subscribe to the newsletter (consent, Art. 6.1.a GDPR); your name, contact detail and message text if you use the contact form (legitimate interest in replying to you); your name, rating and text if you leave a review, which is published only after moderation.
Where it is stored
Orders, subscriptions, messages and reviews are stored in a Supabase database (servers in the EU, Paris region). The site is hosted on Vercel (Vercel Inc., United States), with a global delivery network. These providers act as data processors; where they process data outside the European Economic Area, transfers rely on the European Commission's standard contractual clauses.
Card payment
If you pay on the site (card, Apple Pay, Google Pay or Bizum), the payment is processed by Stripe (Stripe Payments Europe Ltd., Ireland). Your card details are entered in a Stripe form and never pass through our servers: we only receive the amount, the payment result and the transaction identifier. Legal basis: performance of the contract.
Email and Klaviyo
The newsletter and email notices are sent with Klaviyo (Klaviyo Inc., United States). If you subscribe, your address is added to the list and you can unsubscribe with the link in any message.
When you place an order, an order record is also sent to Klaviyo for the customer history and follow-up messages: your name, your phone (or the email address if a payment wallet provides one), the order number, the amount, the fulfilment mode, the promo code and the items. The delivery address is not sent. Legal basis: legitimate interest in managing the customer relationship; you can object by writing on WhatsApp to the number above and we will stop sending your orders to Klaviyo.
WhatsApp, Telegram and international transfers
To manage orders internally, the order summary (including your name, phone and delivery address) is also sent as a notification to the controller via Telegram (Telegram Messenger Inc.), whose servers may be located outside the EEA. Legal basis: performance of the contract and legitimate interest in managing orders.
When you tap "Order via WhatsApp" your order summary is sent through WhatsApp (Meta Platforms Ireland Ltd.), which acts as a messaging service and may transfer data outside the EEA; such transfers rely on the standard contractual clauses and the EU-US Data Privacy Framework applicable to Meta. The WhatsApp conversation is also governed by WhatsApp's privacy policy. Order conversations are reviewed and deleted periodically; the structured order record is retained for the period stated above.
How long
We keep the order's personal data for 12 months; after that it is automatically anonymised (only amounts and products are kept for statistics).
Cookies and statistics
We use no advertising cookies and sell data to nobody. We do use analytics: until you accept the cookie notice, the site stores no cookies and visits are counted in aggregate (page, language and time in our database, plus the cookieless count from our hosting provider). If you accept, the cookies of Google Analytics 4 and PostHog are switched on, including a recording of your scrolling and clicks on the page; the contents of form fields are masked in those recordings. Legal basis: your consent (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE), which you can withdraw at any time on the cookie policy page.
The cart, the last order and your own cookie decision are stored in your browser's local storage: functional, and it does not leave your device until you send the order. Every cookie, its lifetime and the accept or reject button are listed on the cookie policy page.
Your rights
You can request access to, rectification or erasure of your data, as well as restriction of or objection to processing, by writing on WhatsApp to the number above. You can also lodge a complaint with the AEPD (aepd.es).