Privacy policy

Controller

The controller of the data this site collects is Bernardo's Manufactura de Mermeladas, S.L. (“Bernardo's”), tax ID B76242833, registered at Calle Varenga 32, 35509 Playa Honda, Las Palmas, España. You can write to us at info@bernardos.org or call (+34) 928 833 441. We are not required to appoint a data protection officer; these requests are handled by the company's management.

What we collect, and what we don't

This site asks for personal data in two places and nowhere else: the contact form and the form for applying to a job opening. There is no user registration, no newsletter, no shopping basket, and we neither sell nor share data with anyone. Reading any other page — the products, the news, the transparency disclosures — does not require you to tell us who you are.

All three activities, in one table

Each with the data it asks for, the basis that permits it and the point at which it disappears.

The contact form

What you write in the letter becomes an email addressed to the department matching the subject you pick. It is not stored in any database: it lives in the company mailbox like any other message, read there by the people who can answer it. Your address is used to reply to you and for nothing else — you are not added to any list.

Job applications

Here there is a file: the application and the CV are kept in a private store that only the people involved in that hiring decision can reach. We ask for nothing beyond what you fill in: no photograph, no date of birth, no social security number.

When the opening closes, the record and the file are deleted. If a suitable vacancy comes up later you will have to apply again: we prefer that to keeping your CV for years.

Analytics

We use Google Analytics 4, and only if you accept it: while there is no consent this site loads no Google Analytics and sends it nothing. The advertising signals stay switched off at all times, including when you do accept. Each cookie, its lifetime and the way to withdraw consent are set out in the cookie policy.

The link to the shops

When you press the button for one of the two partner shops we note which shop, the language you were browsing in, and the date. No IP address and no identifier is stored, so that record cannot recognise you. What happens next happens on their site and under their own privacy policy.

The QR codes on our packaging

Some packs carry a QR code that leads to a page with recipes and instructions. When one is scanned we note which product it was, what language you were browsing in and the date. We do not store your IP address or any identifier, so that record cannot recognise you: it only tells us how many people scanned each pack.

Who else processes it

Running the site takes service providers, and each is a processor: they act on our instructions under a contract that requires them to. There are no other recipients. These are the categories; if you would like to know which company provides one of them, write to us and we will tell you.

Transfers outside the European Union

The server, the mail and the file store are in the European Union, so the data from the form and from job applications does not leave it. The exceptions are Google Analytics and the Google Maps map on the contact page: their use may involve processing data in the United States. Google LLC is certified under the EU–U.S. Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection on 10 July 2023, and that decision is the basis for the transfer. If you do not accept analytics cookies, the Analytics transfer never happens; the map's is limited to your IP address when you open the contact page.

Security

The site is always served encrypted, and access to the data is limited to the staff who need it, through named accounts. No system is infallible: were a breach ever to occur that put your rights at risk, we would report it to the Spanish Data Protection Agency and, where required, to you.

Children

Neither the contact form nor the job openings are aimed at children under fourteen, and we do not knowingly ask anyone of that age for data; if you believe a child in your care has written to us, tell us and we will delete it. The site shows liqueurs and gins: buying them from the partner shops is reserved for adults, under each shop's own rules.

Automated decisions and profiling

There are none. No application is rejected by an algorithm, we build no commercial profiles, and we do not match the analytics against the people who write to us.

Your rights

You may ask us for access to your data, its correction or its deletion, object to the processing, restrict it, ask for your data in a portable format, and withdraw your consent whenever you like — withdrawing it does not undo what was done while it was given. An email to info@bernardos.org saying what you want is enough; if we cannot tell who you are, we may ask for something that proves it. We answer within one month.

If you believe we have not done as we should, you can complain to the Spanish Data Protection Agency — C/ Jorge Juan 6, 28001 Madrid, www.aepd.es — without having written to us first. We would rather you told us first, but it is your choice.

Changes

This policy changes when what we do changes. The date at the foot of the page is the version in force. Were we ever to process your data for a new purpose, we would not apply it to data you had already given us without asking your consent first.