Privacy policy
Website content updated: 20/10/2026
Data controller
Elien Turoboiska-Marahulian (El Lavash), NIF (NIE) Y9545060M, C/ Marfull 11, 17310 Lloret de Mar (Girona), Spain. Contact: WhatsApp +34 627 324 835 · Instagram @el.lavash.
Enquiries from professionals
The main website presents our catalogue for restaurants, shops and distributors. The form lets you request information and discuss a possible collaboration. Sending an enquiry does not confirm an order or make a payment. Availability, formats and supply terms are agreed directly with El Lavash.
Professional enquiry data
When you submit the form we process the information you provide: name, company or establishment, email or phone, town, business type, products of interest and message. The enquiry also includes its language and source page so we can respond in context. The purpose is to reply to your enquiry and manage the business relationship. For contact enquiries we retain the legal basis of legitimate interest in replying to you stated in this policy. You can contact us at info@ellavash.es.
How your enquiry is handled
The enquiry is stored in Supabase and the El Lavash administration system. An operational notification is sent to info@ellavash.es and to our responsible team member via Telegram. It is also recorded in Klaviyo to manage the enquiry and contact history. Submitting this form does not automatically subscribe you to a newsletter. Communication through WhatsApp is optional and starts when you choose that channel.
Where it is stored
Orders, subscriptions, messages and reviews are stored in a Supabase database (servers in the EU, Paris region). The site is hosted on Vercel (Vercel Inc., United States), with a global delivery network. These providers act as data processors; where they process data outside the European Economic Area, transfers rely on the European Commission's standard contractual clauses.
Optional analytics
On the main website, optional PostHog analytics only starts after you accept. We record page views and specific actions, such as viewing products, choosing a business type, opening WhatsApp or submitting an accepted enquiry. Form field contents are not sent to analytics. Analytics URLs have query parameters and fragments removed; session recording and automatic interaction capture are disabled. The legal basis is your consent (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE). You can change your choice in the cookie policy.
Your rights
You can request access to, rectification or erasure of your data, as well as restriction of or objection to processing, by writing on WhatsApp to the number above. You can also lodge a complaint with the AEPD (aepd.es).
Information about the former consumer ordering service
The previous version below is retained for reference and relates to consumer orders and shop functionality. It does not describe the current professional enquiry form or establish wholesale quotation terms. Retention periods and processing described for former orders do not automatically apply to B2B enquiries.
What data we process and why
When you place an order we store: name, phone, delivery address (if you choose delivery) and order notes. Purpose: to prepare, confirm and deliver your order. Legal basis: performance of a contract (Art. 6.1.b GDPR). Without this data we cannot manage the order.
We also process, only when you send it yourself: your email address if you subscribe to the newsletter (consent, Art. 6.1.a GDPR); your name, contact detail and message text if you use the contact form (legitimate interest in replying to you); your name, rating and text if you leave a review, which is published only after moderation.
Card payment
If you pay on the site (card, Apple Pay, Google Pay or Bizum), the payment is processed by Stripe (Stripe Payments Europe Ltd., Ireland). Your card details are entered in a Stripe form and never pass through our servers: we only receive the amount, the payment result and the transaction identifier. Legal basis: performance of the contract.
Email and Klaviyo
The newsletter and email notices are sent with Klaviyo (Klaviyo Inc., United States). If you subscribe, your address is added to the list and you can unsubscribe with the link in any message.
When you place an order, an order record is also sent to Klaviyo for the customer history and follow-up messages: your name, your phone (or the email address if a payment wallet provides one), the order number, the amount, the fulfilment mode, the promo code and the items. The delivery address is not sent. Legal basis: legitimate interest in managing the customer relationship; you can object by writing on WhatsApp to the number above and we will stop sending your orders to Klaviyo.
WhatsApp, Telegram and international transfers
To manage orders internally, the order summary (including your name, phone and delivery address) is also sent as a notification to the controller via Telegram (Telegram Messenger Inc.), whose servers may be located outside the EEA. Legal basis: performance of the contract and legitimate interest in managing orders.
When you tap "Order via WhatsApp" your order summary is sent through WhatsApp (Meta Platforms Ireland Ltd.), which acts as a messaging service and may transfer data outside the EEA; such transfers rely on the standard contractual clauses and the EU-US Data Privacy Framework applicable to Meta. The WhatsApp conversation is also governed by WhatsApp's privacy policy. Order conversations are reviewed and deleted periodically; the structured order record is retained for the period stated above.
How long
We keep the order's personal data for 12 months; after that it is automatically anonymised (only amounts and products are kept for statistics).
Related documents: Legal notice · Privacy · Cookies · Terms