Privacy Policy

Aura Media Consulting S.L. (owner of the Kitchen Stocker brand, hereinafter "Kitchen Stocker", "we"), with tax identification number (NIF) B88667829 and registered office at Calle Sagunto 1, Valencia (Valencia), 46009, is the controller of the personal data collected through the website www.kitchenstocker.com and the inventory management platform available at app.kitchenstocker.com.

You may contact us regarding any data protection matter at: privacy@kitchenstocker.com

We process the following categories of personal data:

• Account data: first name, surname, email address and password (stored as a hash). Purpose: creation and authentication of the user account.
• Billing data: name or company name, NIF/CIF, tax address. Purpose: issuing invoices and complying with Spanish tax obligations.
• Service usage data: session logs, actions performed on the platform, IP address. Purpose: operational security, error diagnostics and product improvement.
• Operational data uploaded by the customer: product lists, suppliers, prices, inventories, recipes. This data belongs to the customer (see Section 6 on GDPR roles).

We process your data on the following legal grounds under the General Data Protection Regulation (GDPR, "RGPD"):

• Performance of a contract (Art. 6(1)(b) GDPR): processing necessary to provide the subscribed service.
• Legal obligation (Art. 6(1)(c) GDPR): retention of tax and accounting records as required by Spanish law.
• Legitimate interest (Art. 6(1)(f) GDPR): service security, fraud prevention and product improvement through aggregated and anonymised usage analysis.
• Consent (Art. 6(1)(a) GDPR): marketing communications, where the user has explicitly opted in.

Account data is retained for as long as the account remains active. Following cancellation of the subscription, we retain the data for an additional 30 days to allow export. After that period, the data is deleted, except for data that must be retained under a legal obligation (tax records: 5 years under the Ley General Tributaria (the Spanish General Tax Law); accounting records: 6 years under the Código de Comercio (the Spanish Commercial Code)).

We do not sell or transfer personal data to third parties for commercial purposes. We share data only with sub-processors necessary to operate the service, all of them subject to adequate data protection safeguards:

• Cloud infrastructure provider (hosting and database): data hosted in the European Union or under equivalent safeguards.
• Payment processor: management of subscriptions and recurring billing.
• Error monitoring tool: capture of technical errors with the minimum data necessary.

You may request the current list of sub-processors by writing to privacy@kitchenstocker.com.

Where a customer uploads data to the platform that may contain personal data of third parties (for example, data relating to employees or suppliers), Kitchen Stocker acts as data processor and the customer as data controller. This relationship is governed by the Data Processing Agreement (DPA) available at /en/legal/dpa.

Under the GDPR and Ley Orgánica 3/2018 (LOPDGDD) (the Spanish Data Protection and Digital Rights Act), you have the right to access, rectify, erase, restrict or object to the processing of your data, as well as the right to data portability. To exercise these rights, send your request to privacy@kitchenstocker.com, stating your name, the email address associated with your account and the right you wish to exercise. We will respond within a maximum of one month.

If you consider that the processing infringes your rights, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es.

We apply appropriate technical and organisational measures to protect your data: encryption in transit (TLS), secure authentication, per-customer data isolation and continuous monitoring. Further details are available on our Security Page.

We may update this policy to reflect changes in the service or in applicable law. We will notify you of material changes by email or by notice on the platform at least 15 days in advance.