Sign in
EN
ENEnglish ESEspañol EUEuskara
Order online
695 96 07 68 Sign in
EN
ENEnglish ESEspañol EUEuskara
Order online
Legal information

SUPPLIERS AND CUSTOMER PRIVACY

We explain clearly what data we process, why we use it and what your rights are.

Last updated: 31 October 2026

1. Data controller

MARTXEL BURGER, S.L. is responsible for processing the personal data collected on this website and through its contact channels.

Registered office
Saibigain Kalea, 2, 48200 Durango, Bizkaia
Tax ID
B70775168

2. Data we may process

Depending on how you interact with Martxel, we may process your identification and contact data, data necessary to manage your account and orders, delivery address, billing information and basic technical navigation data.

We ask only for the data needed for each purpose. Do not send especially sensitive information through forms or email.

3. What we use your data for

  • Manage your account, online ordering, local pickup, and home delivery.
  • Respond to your inquiries and requests sent by email, phone or forms.
  • Prevent fraudulent uses and maintain the security of the site.
  • Send you marketing communications only where there is a legal basis and you can easily object.

4. Legal basis, recipients and retention

The legal basis will be the execution of the service you request, compliance with legal obligations, our legitimate interest in maintaining security and, where applicable, your consent.

We keep account data while the account is active. Enquiries are kept for up to 12 months after closure; technical security logs for up to 12 months unless there is an incident; and order, invoice and payment information for the applicable tax or limitation period. When an account is closed, we delete the profile, addresses, credentials and preferences, and unlink or anonymise operational data that no longer needs to be kept. Geolocation and proof-of-delivery data are also subject to the delivery service’s specific operational periods.

We may disclose data to vendors that help us provide the service - for example, accommodation, technology, communications, delivery or payments - subject to applicable confidentiality safeguards and obligations. We don't sell your data.

5. Providers, transfers and automated decisions

We may use the following providers or services to deliver the service:

  • 24racks Cloud: hosting and technical operation of the website and its databases, according to the contracted configuration.
  • Redsys card payment platform. Its secure form is integrated into Martxel checkout; Martxel does not receive or store full card details.
  • OpenStreetMap and Leaflet: the contact page map uses these services and may load third-party resources and images when you visit that page.
  • jsDelivr: content delivery network for technical libraries; when those resources are requested, the provider may receive technical data such as your IP address.
  • Google Login: when you choose to register or sign in with Google, Google authenticates the account and may provide Martxel with your name, email address, account identifier and authorised basic profile data. It is used only to create or sign in to your account.
  • Google Analytics and Google Signals: when you accept the analytics category, Google receives technical and browsing data such as visited pages, events, device, browser, approximate location and cookie identifiers. Google Signals may associate data from users who are signed in to Google and have ad personalisation enabled, according to the property settings and Google's own policies.
  • Google reCAPTCHA: on protected forms, Google analyses the interaction, device and technical data to detect abuse and fraud. It may use the cookie _GRECAPTCHA and act as an independent provider for this function.
  • Email address: SMTP service configured to send operational messages about orders and contact.

The site's fonts are served from our own infrastructure; they are not loaded from Google Fonts. Google and other providers may act as data processors or independent controllers for their own services. See their privacy policies and the options they provide to access, control or delete your data.

The legal basis for Google sign-in and reCAPTCHA security is to provide the requested service and protect it against fraud. Analytics and Google Signals features based on measurement or personalisation are used only where the relevant consent exists, which you can withdraw from the cookie settings.

If a provider processes data outside the European Economic Area, GDPR safeguards will apply, such as an adequacy decision or standard contractual clauses. We do not make solely automated decisions with legal or similarly significant effects on you.

Data may come from you, the person placing the order, Google when you use Google sign-in, or the devices and systems you use to access the site.

6. Your rights

You can request access, rectification, deletion, opposition, limitation of processing and portability of your data, as well as withdraw consent when processing is based on it.

If you have an account, you can download your data, correct your profile or request account closure from the Privacy Centre. You can also write to info@martxel.es state what you are requesting and provide a way to verify your identity. The response is free except where the law provides otherwise. You may also complain to the Spanish Data Protection Agency if you believe processing does not comply with the rules.

7. Children, changes and contact

The service is not aimed at children under the age of 14 for consent-based treatments. If we detect that data has been provided without the necessary authorization, we will take reasonable steps to delete it.

We may update this policy to reflect legal, technical, or service changes. We will publish the current version on this same page. If you have questions about privacy, we're here Contact.