Privacy
How we process data submitted in a professional enquiry.
Data controller
Purposes and legal bases
Professional enquiries
We process data to answer catalogue, product, tasting, or distribution requests and, where appropriate, to manage a potential B2B commercial relationship.
The legal basis depends on the nature of the enquiry. Where the person concerned asks for steps aimed at entering into a contract to which they will be a party, processing is based on taking pre-contractual steps at their request. For other professional contacts, including those made by representatives or employees of a company, processing is based on Le Croise's legitimate interest in answering and proportionately following up B2B commercial relationships.
Enquiry data is not added to promotional campaigns or used to send unsolicited commercial communications.
How the form works
The site's form does not send data directly to our servers. Using it prepares a message addressed to info@lecroisebakery.com in the user's email program. The data only reaches Le Croise if the user chooses to send that message.
Site operation and security
Hosting generates technical access logs to maintain security, diagnose incidents, and prevent abuse. This processing is based on the legitimate interest in protecting the site. Server access logs are kept for 7 days, unless they must be kept longer to investigate a specific security incident or to comply with a legal obligation.
Data processed and required fields
The form may collect name, role, company, business type, email, telephone, city or country, product interest, and message content. Name, company, and email are required because they are needed to identify and answer the request. Without them, we cannot handle the request through the form.
Retention
Data is retained while the enquiry is handled and, if a professional relationship begins, for its duration. It is then kept blocked only for the periods needed to address potential legal liabilities and deleted when those periods expire.
Enquiries that do not lead to a commercial relationship are, as a rule, deleted 12 months after the last interaction, unless there is a justified need to keep them longer or a legal obligation applies.
Recipients and transfers
We do not disclose data to third parties except where legally required. We may use hosting, email, technology-support, and analytics providers that act as processors or service providers and may access data only to the extent needed to provide their services.
Some providers may process data outside the European Economic Area. Where international transfers take place, they are carried out in accordance with Chapter V of the GDPR, relying, as appropriate, on a European Commission adequacy decision or on appropriate safeguards such as standard contractual clauses.
Your rights
You may request access, rectification, erasure, objection, restriction of processing, and portability where applicable. Send your request to info@lecroisebakery.com, stating the right you wish to exercise and the information needed to verify your identity.
You may also lodge a complaint with the Spanish Data Protection Agency.
No profiling or automated decisions are carried out using enquiry data.
Analytics, consent, and transfers
With your consent, we use Google Analytics 4 through Google Tag Manager to compile statistics about use of the site. Measurement may involve Google processing online identifiers and technical data associated with the connection and browsing. Le Croise has configured analytics not to send Google names, email addresses, telephone numbers, company names, messages, values entered in forms, or other identifying data provided directly by the user. Advertising features, Google Signals, and ad personalisation remain disabled.
No Google service is loaded and no analytics data is sent before you accept. The legal basis is your consent, which you can withdraw at any time through Cookie settings in the footer. Withdrawal prevents future processing but does not affect the lawfulness of processing carried out while consent was in force. Data already sent to Google before withdrawal is kept for the period configured in Google Analytics and in line with applicable obligations. You can exercise your rights against Le Croise at info@lecroisebakery.com.
For Google Analytics, the contracting provider is Google Ireland Limited. Certain data may be processed by Google LLC and other group entities outside the European Economic Area. Transfers to US entities certified under the EU–US Data Privacy Framework may rely on the adequacy decision adopted by the European Commission; where that mechanism does not apply, Google provides additional safeguards under the GDPR.
So that we can demonstrate your choice, we keep a receipt without identifying data: a random identifier, the date and time, the decision, and the notice version. See the cookie policy for the specific cookies, their duration, and the available controls.
Last updated: 22 October 2026.