TIO BIGOTES
Last updated: September 2026

Privacy Policy

At TIO BIGOTES we are committed to protecting your privacy. This policy explains what data we collect, how we use it and what your rights are.

1. Data controller

Registered name: Ilusiones 2015 S.L.

Tax ID (CIF): B66668971

Registered office: Carrer de París 131, 08036 Barcelona (España)

Contact email: administracion@tiobigotes.com

Phone: +34 931 621 303

Commercial Registry: Barcelona · Tomo 45148 · Folio 61 · Hoja B47833 · Inscripción 5ª

2. Data we collect

We collect the following categories of personal data:

  • •Account data: first name, surname, email address, phone number.
  • •Order data: delivery address, purchase history, payment method (we do not store card details; they are handled by the payment gateway).
  • •Technical browsing data: IP address and browser type, logged by the server for security and to serve the site in your language. We use no analytics or tracking cookies.
  • •Location data: approximate location to show nearby shops, only with your explicit consent.
  • •Job application data: CV, cover letter, professional profile, when you apply for a role.

3. Purposes of processing

We process your personal data for the following purposes:

  • •Managing orders, payments and deliveries.
  • •Sending marketing communications and promotions (only with prior consent).
  • •Anonymised statistical analysis to improve our services.
  • •Meeting legal obligations (invoicing, tax retention).
  • •Managing recruitment processes.

4. Legal basis

Performance of a contract (Art. 6(1)(b) GDPR): we process your order and delivery data because it is necessary to perform the sales contract.

Legitimate interests (Art. 6(1)(f) GDPR): analysing website use to improve the user experience.

Consent (Art. 6(1)(a) GDPR): sending marketing communications. You may withdraw your consent at any time.

Legal obligation (Art. 6(1)(c) GDPR): retaining invoicing data under applicable tax law.

5. Data retention

Customer dataDuration of the business relationship + 5 years
Invoicing data6 years (tax obligation)
Session and preference cookiesFrom 15 minutes to 12 months depending on the cookie
Job application data1 year, unless you consent to a longer period
Marketing subscription listUntil you withdraw consent

6. Sharing data with third parties

We do not share your personal data with third parties except where necessary to provide the service, always under data processing agreements that guarantee GDPR compliance:

  • •Delivery platforms (Glovo, etc.): name and delivery address to fulfil the order.
  • •Payment gateway: transaction data processed directly by the provider; we never access your card details.
  • •Hosting provider: Google Cloud Platform (EU region), for secure data storage.
  • •Handling enquiries: the data you submit through the franchise, wholesale, supplier and careers forms is recorded in our CRM, hosted on Google Cloud Platform (EU region). Files you attach — such as your CV or a catalogue — are stored in Supabase Storage (EU region).
  • •Event enquiries: these are also recorded in Google Workspace and Notion (Notion Labs, USA, under EU standard contractual clauses).
  • •Google Maps: if you open the map in the store finder, Google Maps (Google Ireland Ltd.) receives your IP address in order to serve it. It does not load until you ask for it.

7. Your rights

Under the GDPR and Spanish data protection law (LOPDGDD), you have the following rights:

Access

Find out what data we hold about you.

Rectification

Correct inaccurate or incomplete data.

Erasure

Request deletion of your data (right to be forgotten).

Objection

Object to certain processing.

Portability

Receive your data in a structured format.

Restriction

Ask us to restrict processing.

How to exercise your rights

administracion@tiobigotes.com attaching a copy of your identity document. We will respond within 30 days at most.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es) or with the supervisory authority in your country of residence.

8. Cookies

This site uses only first-party, strictly necessary cookies. We use no analytics, advertising or tracking cookies. Cookies strictly necessary to provide the service you requested are exempt from prior consent under Article 5(3) of the ePrivacy Directive and Article 22.2 of the Spanish LSSI-CE. The only third-party content is the map in the store finder, served by Google: that is why you see a banner, and the map does not load until you accept it. The full detail is in the cookie policy.

tb_access · tb_refreshNecessary

Keep you signed in. They are only created if you log in. They are httpOnly: JavaScript cannot read them. They last 15 minutes and 30 days respectively.

tb_country · tb_langNecessary

Remember the country and language you browse the site in, so we serve you the right version. They hold no personal data. Max. 12 months.

tb_consentNecessary

Stores your answer to the map banner. Not a cookie: it lives in the browser's local storage. Kept until you delete it or change your choice.

9. Security

We apply appropriate technical and organisational measures to protect your personal data:

  • •TLS encryption on all traffic between your browser and our servers.
  • •Access to personal data restricted to authorised staff.
  • •Regular security audits of our infrastructure.
  • •Ongoing data protection training for our staff.
  • •An internal privacy policy and a data breach response procedure.

10. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or in applicable law. When we make significant changes, we will notify you by email (if you are registered) and/or with a prominent notice on the website.

The date of the last update always appears at the top of this document. We recommend reviewing this page from time to time.

Questions about this policy?

Get in touch