In a nutshell
We use your data only to respond to what you ask of us: preparing your quote, talking to you and, if you hire us, providing the service and meeting our accounting and tax obligations. If you tell us about allergies or intolerances, we process them with your explicit consent and only so that we can take them into account in the quote and the menu and cook safely for you or your guests. We do not sell your data or pass it on to third parties, except where required by law. You can ask us at any time to access, correct or delete it, as well as exercise your other rights, by writing to info@xepep.com.
Data controller
The controller of the personal data collected through xepep.es and Xepep’s contact channels is:
- Company name: Xepep Cocina Tradicional S.L.U.
- Tax ID (NIF): B42577049
- Registered address: C. de la Virgen Nieves, 53 · 03680 Aspe (Alicante), Spain
- Email: info@xepep.com
- Events and catering phone: 629 44 27 67
- Shop and delivery phone: 688 79 01 71
- Registry details: [PENDIENTE: datos de inscripción en el Registro Mercantil]
Xepep is engaged in traditional cooking, takeaway food and delivery in Aspe and the surrounding area, catering and events (local fiestas, live paella cooking, company events and celebrations) in the province of Alicante and nearby areas, and a daily service for contract catering clients.
What data we process and where it comes from
We process the data you give us. If you give us data about other people (for example, your guests’ allergies), see the section on health data and make sure you have their permission.
Through the quote form
- Contact details: name, phone number and email address.
- Type of request: event, company or daily service for centres.
- Event or service details: type, date, number of guests or people, town or city, format, set-up, approximate budget and, where applicable, the name of the company or centre.
- Comments: whatever you want to tell us in the free text field. There you can, if you wish, mention food allergies or intolerances, which are health data (see the specific section below).
When you submit the form, we send you an automatic confirmation email with a summary of your request.
Newsletter
We collect your email address and, if you give it, your name in order to send you the newsletter.
By phone, WhatsApp or email
The data you share when you call us, message us on WhatsApp or send us an email: usually your name, how to contact you and the details of what you need.
If you hire us
The data needed to provide the service and to issue and keep the corresponding accounting and tax documents.
The contact details and the event or service details are necessary to deal with your request: if you do not provide them, we will not be able to prepare your quote. Allergies and intolerances are always voluntary.
Purposes and legal bases
| Processing | What we use the data for | Legal basis |
|---|---|---|
| Newsletter | Using your email and, if you give it, your name, to send you news, seasonal suggestions and content about Xepep. | Your consent (Art. 6(1)(a) GDPR). |
| Quote form | Dealing with your request, preparing and sending you the quote, communicating with you and sending you the automatic confirmation email with the summary. | Taking steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR). For allergies and intolerances: your explicit consent (Art. 9(2)(a) GDPR). |
| Contact by phone, WhatsApp or email | Dealing with your enquiry or request, preparing the quote and communicating with you. | Taking steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR). For allergies and intolerances: your explicit consent (Art. 9(2)(a) GDPR). |
| Clients who hire us | Providing the contracted service and managing the relationship. | Performance of a contract (Art. 6(1)(b) GDPR). |
| Clients who hire us | Meeting legal accounting and tax obligations. | Compliance with legal obligations (Art. 6(1)(c) GDPR). |
We only send you the newsletter if you have given your consent. Withdrawing consent does not affect the lawfulness of mailings sent before. We do not make automated decisions or carry out profiling.
Health data: allergies and intolerances
Food allergies and intolerances are health data, a special category of data that the General Data Protection Regulation (GDPR) protects more strongly.
- They are voluntary. We do not ask for them as a required field: we only process them if you decide to mention them in the form’s comments or through any of our contact channels.
- Legal basis: your explicit consent (Art. 9(2)(a) GDPR). On the form, you give it by ticking the specific consent box for allergy and intolerance data next to the comments field; by phone, WhatsApp or email, by voluntarily telling us.
- Sole purpose: to take them into account when preparing the quote and the menu, and to cook safely for you or your guests.
- You can withdraw your consent whenever you like by writing to info@xepep.com. Withdrawal does not affect the lawfulness of the processing carried out before, but without that information we will not be able to take those needs into account when preparing the service.
If you give us the allergies or intolerances of other people (for example, your guests), we ask that you only do so when you have their consent.
How long we keep the data
| Case | Retention period |
|---|---|
| Newsletter | Until you unsubscribe |
| Requests that do not become a contract | Up to 12 months from the last contact. |
| Clients | Throughout the relationship and, afterwards, for the legal periods: 6 years (Commercial Code) and 4 years (tax law). |
Once those periods have passed, the data is deleted or, where the law requires it, blocked (Art. 32 LOPDGDD).
Recipients and data processors
We do not pass your data on to third parties, except where there is a legal obligation (for example, to the tax authorities or to authorities that request it).
To make the website work, we use providers that may access your data solely to provide us with their service, following our instructions and as data processors:
| Provider | Service they provide for us | Location |
|---|---|---|
| Netlify, Inc. | Website hosting and receipt of the quote and newsletter forms. | United States |
| Resend | Sending the automatic emails from the form and the newsletter. | United States |
Third-party services you choose to use
WhatsApp (Meta) and Google Maps are third-party services that operate under their own privacy policies. They only come into play if you decide to use them: for example, when you message us on WhatsApp or when you load the Google map on the website.
International transfers and safeguards
Netlify, Inc. and Resend are based in the United States, so using their services involves an international transfer of data. These transfers are covered by appropriate safeguards under the GDPR: the EU–US Data Privacy Framework and/or the standard contractual clauses approved by the European Commission.
Your rights and how to exercise them
You can exercise the following rights at any time:
- Access: to know what data of yours we process.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to ask us to delete your data.
- Objection: to object to a specific processing activity.
- Restriction: to ask us to suspend processing in certain cases.
- Portability: to receive your data in a structured format or have it sent to another controller.
- Withdrawal of consent: in particular, regarding allergy and intolerance data.
How to do it: write to info@xepep.com, saying which right you want to exercise and proving your identity. We will reply within one month, extendable in the cases provided for in Art. 12(3) GDPR.
You can unsubscribe at any time using the link in every email or by writing to info@xepep.com.
Complaints to the AEPD
If you believe we have not processed your data properly or you are not satisfied with our reply, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es). Beforehand, if you prefer, you can write to us at info@xepep.com and we will try to sort it out with you.
Minors
We do not knowingly collect data from children under 14. If you are a parent or guardian and believe a child has given us their data, write to us at info@xepep.com and we will delete it.
Security
We process your data confidentially and in line with the security obligations of the GDPR.
Cookies
The website does not install any first-party, analytics or advertising cookies. All the information about the technical storage we use and about the Google Maps map is in our cookie policy.
We count clicks from the calendar to our services in aggregate, without cookies or personal data.
Changes to this policy
We may update this policy to adapt it to legal changes or changes in our services. We will always publish the version in force on this page, with its update date, so we recommend that you check it from time to time.
Contact
For any questions about this policy or about how we process your data:
- Email: info@xepep.com
- Events and catering phone: 629 44 27 67
- Shop and delivery phone: 688 79 01 71
- Postal address: Xepep Cocina Tradicional S.L.U., C. de la Virgen Nieves, 53 · 03680 Aspe (Alicante), Spain
Last updated: 9 October 2026.
This text is a translation of the Spanish version. In the event of any discrepancy, the Spanish version shall prevail.