Privacy policy
IBERIUM SELECTION ·
www.iberiumselection.com
1. Data Controller
The controller responsible for the processing of personal data obtained through the website https://iberiumselection.com (hereinafter, the “Website”) is:
· Controller: PREMIUM BOX ONLINE, S.L.U.
· Trading name: IBERIUM SELECTION.
· Tax Identification Number (NIF): B27649037.
· Registered address: C/ Lehendakari Aguirre, 39, 28914 Leganés (Madrid), Spain.
· Privacy email address: hola@iberiumselection.com.
· Telephone: +34 683 282 370.
This Privacy Policy explains what data IBERIUM SELECTION processes, the purposes for which it is used, how long it is retained and how data subjects may exercise the rights recognised under data protection legislation.
2. Personal data processed
Depending on the relationship maintained with the user, customer, recipient or collaborator, IBERIUM SELECTION may process the following categories of data:
· Identification and contact data: first name, surname, email address, telephone number and, where necessary, identification details of the person receiving the order.
· Billing and contractual data: Tax Identification Number (NIF), billing address, company details, order history, products purchased, prices, vouchers and contractual documentation.
· Delivery data: address and characteristics of the accommodation, requested date and time slot, recipient’s name, room number where applicable, delivery instructions and proof of receipt.
· Payment data: status and transaction reference. IBERIUM SELECTION does not receive or retain full card details, which are processed by the payment gateway.
· Enquiries and incidents: content of communications, photographs provided, information regarding packaging or product condition and actions taken to resolve the complaint.
· Account data: credentials, preferences and history accessible through the customer account.
· Technical data: IP address, access logs, device, browser and information obtained through cookies, according to the user’s preferences.
Health data is not generally requested. If the user voluntarily provides information concerning allergies or intolerances, which may constitute health-related data, such information shall be used exclusively to respond to the enquiry or manage the order, on the basis of the user’s explicit consent, and access shall be restricted to those persons who need to know it. The user may withdraw such consent, without prejudice to the fact that IBERIUM SELECTION may be unable to fulfil a request where its safe management requires access to that information.
3. Purposes, legal bases and retention periods
3.1. Enquiries and customer support
Data provided through the contact form, email, telephone or WhatsApp shall be processed in order to respond to enquiries and carry out the pre-contractual measures requested. The legal basis is the taking of pre-contractual steps at the request of the data subject and, for enquiries not related to a purchase, the legitimate interest in responding to them.
The data shall be retained for the time necessary to provide a response and subsequently for the limitation periods applicable to any potential liabilities.
3.2. Account creation and management
When the user creates an account, their data shall be processed in order to register and authenticate them, manage their preferences and enable them to view their orders. The legal basis is the performance of the contractual relationship or the taking of pre-contractual measures.
The account shall be maintained for as long as it remains active. Following deletion, any data that must be retained in order to comply with legal obligations or address potential liabilities shall be blocked.
3.3. Order management and contracting
The purchaser’s data shall be processed in order to verify availability, process the order, manage payment, issue confirmation, prepare the products, apply promotions, manage gift cards or vouchers and provide the requested service. The legal basis is the performance of the contract.
Contractual documentation shall be retained for the duration of the relationship and thereafter for the applicable statutory limitation periods. Documentation relevant for tax or accounting purposes shall be retained for the periods required under the applicable regulations.
3.4. Payment, billing and legal obligations
Data shall be processed in order to manage payments and refunds through Redsys and CaixaBank, issue invoices, maintain accounting records, prevent fraudulent transactions and comply with tax and accounting obligations. The legal bases are the performance of the contract, compliance with legal obligations and the legitimate interest in preventing, detecting and managing fraud, balanced against the rights of the individuals concerned.
Invoices and accounting documentation shall be retained for the periods established under commercial and tax legislation, without prejudice to any other applicable limitation periods.
3.5. Order delivery
The purchaser’s data shall be processed in order to coordinate delivery through SEUR Frío, make contact in the event of an incident and provide evidence of receipt, on the basis of the performance of the contract. The data of a recipient other than the purchaser shall be processed on the basis of the legitimate interests of IBERIUM SELECTION and the purchaser in managing the requested delivery, and shall be limited to what is strictly necessary. Where the purchaser requests that the order be received by the reception desk, host or accommodation manager, only the data necessary to complete the delivery shall be disclosed.
Proof of delivery and logistics communications shall be retained for the time necessary to manage the order and address complaints and, subsequently, for the applicable limitation periods.
3.6. Data relating to another recipient
If the purchaser provides another person’s data, they must ensure that it is accurate and inform that person that IBERIUM SELECTION will process it for the purpose of managing delivery, providing them with access to this Privacy Policy. IBERIUM SELECTION may contact the recipient solely in order to coordinate the order and resolve delivery-related incidents. During the first direct contact, the recipient shall be provided with the basic information required regarding the processing or with easy access to such information.
3.7. Incidents, returns and complaints
The data and documents provided shall be processed in order to verify the incident, manage replacements, refunds, compensation or complaints, and retain evidence of the transaction. The legal basis is the performance of the contract, compliance with legal obligations and the legitimate interest in establishing, exercising or defending legal claims.
The information shall be retained while the incident is being handled and throughout the limitation periods applicable to the corresponding liabilities.
3.8. Marketing communications
IBERIUM SELECTION may send information about products, promotions and offers by email and WhatsApp, but not by SMS. The legal basis shall be consent where required. Existing customers may receive communications concerning IBERIUM SELECTION’s own products that are similar to those previously purchased, where permitted by law. Each communication shall provide a simple and free means of withdrawing consent or objecting to future communications.
The data shall be processed until the recipient withdraws consent or objects. Information necessary to demonstrate consent or the opt-out request may be retained in blocked form for the applicable limitation periods.
3.9. WhatsApp
When the user contacts IBERIUM SELECTION through WhatsApp Business, their telephone number, profile name and the content of the conversation shall be processed in order to respond to enquiries and manage orders. WhatsApp may also be used to send advertising where there is a valid legal basis. Access to the account shall be restricted to an authorised person. The recipient may withdraw consent or object to further communications at any time.
Use of WhatsApp entails the processing of certain data by Meta Platforms in accordance with its own terms and conditions. Users may alternatively contact IBERIUM SELECTION by email or customer service telephone.
3.10. Website security and operation
Technical data and logs shall be processed in order to maintain security, prevent abuse, resolve errors and protect the Website and user accounts. The legal basis is IBERIUM SELECTION’s legitimate interest in ensuring the security of its systems. The data shall be retained for the period reasonably necessary for these purposes and to address any potential liabilities.
3.11. Cookies and analytics
Necessary cookies are used to enable the operation of the Website and the purchasing process. Statistical, advertising or personalisation cookies shall only be used in accordance with the preferences expressed through the consent management panel. Further information is available in the Cookie Policy.
3.12. Summary of retention periods
Account data shall be retained for as long as the account remains active.
Documentation relating to orders, payments, deliveries, incidents and contractual relationships shall be retained for six years, without prejudice to certain data being retained in blocked form for a longer period where required by law or in connection with a claim.
Invoices and other accounting documentation shall be retained for six years. Documentation relevant for tax purposes shall be retained for at least four years, unless the limitation period is interrupted or a special period applies.
Data used for marketing communications shall be processed until the data subject withdraws consent or objects. Thereafter, only the minimum information necessary to demonstrate consent and comply with the opt-out request shall be retained in blocked form.
Data concerning allergies or intolerances shall be retained only for as long as necessary to manage the relevant order or incident and shall thereafter be deleted or blocked where legally required.
Technical data and security logs shall be retained for the period strictly necessary to ensure security and address potential liabilities.
4. Mandatory nature of the data
Fields marked as mandatory are necessary to process the request, create the account or fulfil the order. If the user does not provide such data, IBERIUM SELECTION may be unable to provide the service. Data used exclusively for marketing communications is optional.
5. Recipients of the data
Data may be disclosed or made available to the following recipients where necessary:
· Redsys and CaixaBank, for processing payments, refunds and any charge disputes.
· SEUR Frío, for preparing, transporting and evidencing delivery.
· Reception desk, host or accommodation manager, solely where the purchaser requests or authorises their involvement in receiving the order.
· Public authorities, courts, law enforcement agencies and other competent authorities, where required by law.
· Advisers and legal, accounting or insurance professionals, where necessary to comply with obligations or defend legal rights.
Data may also be accessed, in their capacity as processors, by service providers engaged by IBERIUM SELECTION, including Raiola Networks (hosting and email), JanubaWEB (development and maintenance), WooCommerce and its plugins (online store and order management), and technical providers of backup, analytics, mapping, reCAPTCHA, messaging, advertising or communication services that are actually installed.
6. International data transfers
Some technology providers, particularly those associated with Google or Meta/WhatsApp, may process data outside the European Economic Area. Where international transfers take place, an adequacy decision, Standard Contractual Clauses or another safeguard recognised under Articles 45 to 49 of the GDPR shall be used.
7. Automated decision-making and profiling
IBERIUM SELECTION does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect users. The existence of advertising or personalisation profiles must be confirmed when validating the analytical and advertising tools installed. If additional processing activities are activated, this Privacy Policy and the consent system shall be updated before such activities begin.
8. Data relating to minors
The Website and online store are not intended for minors. Purchases of product assortments containing alcoholic beverages are restricted to persons over 18 years of age. If IBERIUM SELECTION becomes aware that it has received data relating to a minor without sufficient lawful basis, it shall take reasonable steps to delete such data.
9. Data subject rights
Data subjects may exercise their rights of access, rectification, erasure, objection, restriction of processing and data portability, and may withdraw consent at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.
Requests may be sent to hola@iberiumselection.com or to C/ Lehendakari Aguirre, 39, 28914 Leganés (Madrid), specifying the right being exercised and providing only the information necessary to verify identity. A full copy of an identity document shall not be required unless strictly necessary; any unnecessary data may be concealed.
If a data subject considers that the processing infringes applicable legislation, they may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) through www.aepd.es.
10. Accuracy and updating of data
Users must provide truthful, accurate and up-to-date data and notify IBERIUM SELECTION of any changes. IBERIUM SELECTION may request the correction of data where it identifies errors that prevent the provision of the service or completion of the delivery.
11. Security and confidentiality
IBERIUM SELECTION shall implement appropriate technical and organisational measures to protect data against destruction, loss, alteration, unauthorised access or disclosure, taking into account the nature of the data, the risks involved and the state of the art. Authorised persons shall be required to maintain the confidentiality of the information.
12. Changes to this Privacy Policy
This Privacy Policy may be updated to reflect regulatory or technical changes or changes in the processing activities carried out. The current version shall be available on the Website and shall indicate its date of update. Where a change requires new consent, such consent shall be requested before the relevant processing begins.
Last updated: 14 September 2026.