Privacy

Who is responsible

The data controller is AGROREGEN, S.L. — an entity, not a natural person — with NIF (Spanish tax ID) B93925824 and registered office at CALLE LABRADORES, NUM 8 · 29300 ARCHIDONA - (MALAGA), Spain. Its full identification details are set out in the legal notice.

Channel for all matters relating to personal data: info@fenorganic.eu.

Purposes and legal bases

• Replying to your enquiry or quotation request. If you write to us through the contact form, by email, by telephone or via WhatsApp — whether with a technical question or to request a quotation — we process the data you provide (your name, your email address or telephone number and the content of your message) for the sole purpose of replying to you. Legal basis: taking steps prior to entering into a contract at your request (Article 6(1)(b) GDPR) and, where the enquiry does not relate to a possible purchase, your own consent, given by writing to us (Article 6(1)(a)).
• Processing your order in the online shop. The online shop of fenorganic.eu is in Spanish and serves Spain and Portugal; direct sale to other countries is not yet available, and customers in other countries request a quotation through the channels in the previous point. If you place an order in the online shop, the data you provide (name, email address, telephone number, delivery and billing addresses, and your tax identification number, NIF or CIF, if you give it) is processed to handle the order, calculate delivery, invoice you and attend to you afterwards. Legal basis: performance of the contract or of the steps you request before entering into it (Article 6(1)(b)) and tax and commercial obligations (Article 6(1)(c)). Test orders — those bearing the “PRUEBA” (test) label and a simulated payment — and their data is deleted after 30 days; real orders are kept for as long as tax and commercial legislation requires.
• Assisting you through the automated assistant. The assistant is an artificial intelligence program, not a person. What you write in the conversation is stored on our server and sent to DeepSeek, the artificial intelligence provider that drafts the reply, whose servers are in China. Together with the conversation, what the assistant itself has worked out along the way (for example, your country or your crop) is also sent, but not your IP address or your contact details. We ask you not to write personal data in the conversation: if you wish to leave your details, the assistant shows you a separate form that does not pass through the artificial intelligence. Legal basis: the same as for an enquiry (Article 6(1)(b) and, where it does not relate to a purchase, Article 6(1)(a)).
• Putting you in touch with a person. If you leave your details in the assistant’s form, we use them to contact you. Legal basis: your consent, which you give by ticking the box on the form (Article 6(1)(a)); we keep the date, the text and the version of what you accepted so that we can demonstrate it. Each time someone leaves their details, the team receives an email notification containing those details and a summary of the conversation, and the request is recorded in the company’s contact management panel; through internal messaging only a notification without personal data is sent. If you press “Continue on WhatsApp”, WhatsApp opens on your device with a pre-written message that includes a reference; whatever happens from that point on is between you and WhatsApp.
• Keeping the site running and protecting it. The server records technical data for each request — IP address, date and page requested — in order to operate and to defend itself against abuse. When the contact form is submitted, and when an order lookup in the online shop fails, a fingerprint derived from your IP address — not the address itself — is also stored, solely to curb repeated attempts; the assistant derives it from your IP address and your browser. Contact form submissions that appear to have been made by an automated program are discarded: they are stored marked as discarded, without notifying anyone and without replying to the address they carry. Legal basis: legitimate interest in the security of the service (Article 6(1)(f)).

And nothing else. There is no user registration, no newsletter, no analytics, no advertising and no profiling. The assistant makes no automated decisions producing effects concerning you: it guides you through the catalogue and puts you in touch with a person. The technical enquiry you prepare from the catalogue stays in your browser, and the basket of the online shop uses two technical cookies: the key-by-key detail is set out in Cookies and storage.

Recipients and retention

• Hosting provider: CLOUDI NEXTGEN, S.L. — CIF B-66356528 (Clouding.io), which hosts the server and acts as a processor. It does not process your data for its own purposes.
• Email delivery: Resend (United States) sends, on our behalf, the email notification for each contact form message and for each contact left through the assistant, which carries the full message. It processes that data as a processor under its data processing agreement, which incorporates the European Commission’s standard contractual clauses for transfers to the United States, and it declares that it is certified under the EU–US Data Privacy Framework.
• The assistant’s artificial intelligence: DeepSeek drafts the replies on our behalf and processes the text of the conversation in China, a country for which the European Commission has issued no adequacy decision. We have not signed a specific data processing contract with this provider. To reduce the risk, the assistant does not receive your contact details or your IP address, and it asks you not to write personal data in the conversation.
• No data is disclosed to third parties for commercial purposes, nor sold, nor used for advertising.
• Retention of enquiries: 12 months from the last communication. They are then erased, unless a legal obligation requires them to be kept for longer.
• Retention of assistant conversations: if you did not leave contact details, 30 days from the last message; if you did, 12 months from the last communication. They are then erased, unless a legal obligation requires them to be kept for longer.

Access, rectification and erasure

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent where consent is the legal basis for the processing, by writing to info@fenorganic.eu or by calling +34 623 753 719. Proof of identity may be requested in order to verify who you are. If you believe your rights have not been honoured, you may lodge a complaint with the Agencia Española de Protección de Datos (the Spanish data protection authority, aepd.es).

If your enquiry began in the assistant, quote the reference shown in the WhatsApp message (it begins with F-) so that we can locate the conversation and delete it.