Privacy Policy
How we handle your data at Ribatexas Hot Spicy
Last updated: May 26, 2026
1. Data controller
Ribatexas Hot Spicy is the controller of your personal data. Name: Ribatexas Hot Spicy Activity: Salts, seasonings, flavourings and condiments VAT/Tax ID: 252272790 Address: Rua António Joaquim Alves Inácio, Glória do Ribatejo, Portugal Contact: ribatexashs@gmail.com For any data protection matter, please email us at the address above.
2. What data we collect
Only the data needed for the service you request: • Orders: name, email, address, phone and, optionally, tax ID for invoicing. • Payments: handled directly by Stripe — card data never reaches our systems. • Contact and newsletter: name and email. • Reviews: the name (or pseudonym) and text you choose to publish. • Technical data: language and country (detected via IP) to show the right version of the site.
3. Why we use it
Each use has a legal basis under the GDPR: • Process your order and provide customer support — performance of the contract (Art. 6(1)(b)). • Invoicing and tax obligations — legal obligation (Art. 6(1)(c)). • Reply to messages and moderate reviews — legitimate interest (Art. 6(1)(f)). • Send the newsletter, publish reviews and use analytics or marketing cookies — only with your consent (Art. 6(1)(a)), which you can withdraw at any time.
4. Who we share with
We do not sell your data. We only share with providers that are essential to running the store: • Stripe — payment processing. • Supabase — database and authentication. • Vercel — site hosting. • Resend — transactional emails such as order confirmations. • Google Maps Places — address autocomplete at checkout (only if you accept functional cookies).
5. International transfers
Some of these providers may process data on servers outside the European Economic Area, notably in the United States. These transfers rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, the EU-U.S. Data Privacy Framework. Whenever possible we choose EU servers.
6. How long we keep it
• Orders and invoices: 10 years, due to legal and tax obligations. • Contact messages: up to 12 months. • Published reviews: until you request removal. • Newsletter: until you unsubscribe. • Cookie consent record: 6 months or until you change your preferences.
7. Reviews
When you publish a review we do so with your explicit consent and identify it by the name (or pseudonym) you provided. You can request removal at any time by emailing ribatexashs@gmail.com.
8. Children and minors
The store is not directed at minors under 16. We do not knowingly collect data from children. If we detect data from a minor without parental consent, it will be deleted immediately.
9. Your rights
You have the right to access, rectify, erase, object to, restrict and port your data, and to withdraw consent at any time. To exercise these rights, please email ribatexashs@gmail.com. You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD — www.cnpd.pt).
10. Cookies
We use strictly necessary cookies without prior consent, as they are essential to the store. The others — functional, analytics and marketing — are only activated with your consent. You can change your choices at any time using the "Cookie preferences" link in the footer.
11. Security
All communications with the site are encrypted (HTTPS). Payments are processed by Stripe in a PCI-DSS certified environment. Data is hosted on EU servers whenever technically possible.
12. Changes to this policy
If we update this policy, the new version will be published on this page with the corresponding date. For material changes we will ask for your cookie consent again.