Privacy policy

The controller within the meaning of the GDPR is:

José Luis Chasi Puco · Encanto Latino Shop-Kiosk · Maxstraße 16 · 53111 Bonn · Email: [email protected] · Phone: +49 15561 374300

This website runs on a server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS automatically records server log files (IP address, browser type, referrer URL, date and time). Legal basis: Art. 6(1)(f) GDPR. We have a data processing agreement with IONOS.

Access to this website goes through Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA). Cloudflare delivers the content and protects the website against attacks and overload. In doing so Cloudflare processes technically necessary connection data, in particular your IP address, the time of access and details of your browser.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and available website). A data processing agreement is in place with Cloudflare; transfers to third countries are covered by the EU standard contractual clauses. Privacy policy: cloudflare.com/privacypolicy

When you order in our online shop we process the following data to perform the contract (Art. 6(1)(b) GDPR):

• Name, email address, phone number
• Delivery address
• Order contents, total amount, order reference
• Payment status (no access to card data)

This data is stored in our database at Supabase (see section 5) and used to process the order, ship it and communicate with you. We keep order data for the statutory retention period of 10 years under § 147 of the German Fiscal Code (AO).

We use Supabase (Supabase Inc., 970 Tresser Blvd, Stamford, CT, USA) as our database provider. Data is stored in the EU region Frankfurt (AWS eu-central-1). A data processing agreement under Art. 28 GDPR is in place with Supabase. Legal basis: Art. 6(1)(b) and (f) GDPR.

For payments in the online shop we use SumUp (SumUp More Limited, Block 8, Harcourt Centre, Charlotte Way, Dublin 2, Ireland). When paying you are redirected to SumUp’s secure payment page. Card and payment data are processed exclusively by SumUp and never reach our systems.

Legal basis: Art. 6(1)(b) GDPR. SumUp privacy policy: sumup.de/datenschutz

To ship your order we pass your name and delivery address to Deutsche Post DHL Group, Charles-de-Gaulle-Str. 20, 53113 Bonn. Legal basis: Art. 6(1)(b) GDPR (performance of the contract). DHL’s privacy policy is at dhl.de.

To generate order confirmations, receipts and shipping notifications automatically we use the software n8n. It runs on our own server (see section 2); the order data (name, email address, order reference, order contents, delivery address) does not leave our server for this. Legal basis: Art. 6(1)(b) GDPR.

For the technical delivery of these emails we use Resend (Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA). Your email address, your name and the content of each message including the receipt are transmitted to Resend as far as needed for delivery.

Legal basis: Art. 6(1)(b) GDPR. A data processing agreement is in place with Resend; transfers to the USA are covered by the EU standard contractual clauses. Privacy policy: resend.com/legal/privacy-policy

So that you can enter your delivery address faster and without mistakes, the order form suggests matching streets as you type. For this, the characters you type into the address search and your IP address are sent to the geocoding service Photon (photon.komoot.io) of komoot GmbH, Germany. The service’s servers are in Germany. No cookies are set.

This is purely a typing aid: you can always type your full address yourself without using the suggestions. You can also buy without this feature.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a correct delivery address and in avoiding failed deliveries). Privacy information: komoot.com/de-de/privacy

If you contact us via the contact form or WhatsApp, the data you provide is processed to handle your enquiry. WhatsApp is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Privacy policy: whatsapp.com/legal/privacy-policy

Legal basis: Art. 6(1)(b) and (f) GDPR.

The map you see on our pages by default is a static image stored on our own server. It was created from OpenStreetMap map data (© OpenStreetMap contributors, ODbL). Displaying this image sends no data to third parties and requires no consent.

You can additionally load the interactive Google Maps map, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It is loaded only after you actively click the “Load Google Maps” button. Only then is data (including your IP address) sent to Google. Legal basis: Art. 6(1)(a) GDPR (consent by clicking).

Your choice is saved in your browser (localStorage, entry “el-maps-consent”) so that you do not have to click again on every page. You can withdraw your consent at any time by clicking “Hide Google Maps” below the map. This deletes the entry and our own map image is shown again. Google privacy policy: policies.google.com/privacy

This website uses only technically necessary cookies (the session cookie for signing in to the admin area) and localStorage for the shopping cart and for your map choice under section 12. No tracking, analytics or advertising cookies are used. Consent is therefore not required (§ 25(2) TTDSG).

This website and parts of its content, texts and technical implementation were developed and created with the help of artificial intelligence (AI systems). Responsibility for the content and editorial control lie with the operator, José Luis Chasi Puco.

You have the right at any time to:

• Access the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)

To exercise your rights: [email protected]

Competent supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit NRW (LDI NRW), www.ldi.nrw.de

This website uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” and the padlock symbol in your browser’s address bar.