Privacy Policy — Chocolates El Rey

1. Who is responsible for your data

The controller of the personal data collected through this website is Chocolates El Rey, C.A., Cr. A2, Parcelas A23 y A24, Zona Industrial II, Barquisimeto, Estado Lara, Venezuela.

To complete
Chocolates El Rey is established outside the European Union. Article 27 GDPR requires a controller offering goods or services to people in the EU to designate a representative in the Union in writing, and to publish that representative’s name and address here. Confirm with counsel whether the Article 27 exemption applies; if not, appoint an EU representative and insert their details in this section before launch.

Data protection contact

For any question about this policy or about your data, write to chocolates@chocolate.com.ve.

To complete
Consider a dedicated address (for example privacy@…) so data-subject requests are not lost in the general commercial inbox — the GDPR sets a one-month deadline for responding. Confirm separately whether a Data Protection Officer is required under Article 37; for a company of this size and processing profile it usually is not, but the assessment should be recorded.

2. What we collect

We only collect what you send us through the contact form on this site. No account is created and no profile is built.

Data	Where it comes from
Name, email address	Required fields of the contact form
Company, phone, role, country, subject, product of interest	Optional fields of the contact form
The content of your message	Contact form
IP address, browser user agent, date and time of submission	Recorded automatically with each submission, to detect and prevent abuse of the form

3. Why we use it, and on what legal basis

Purpose	Legal basis
Replying to your enquiry and, where relevant, discussing supply of our European range	Your consent, Article 6(1)(a) GDPR — given by ticking the box on the form. You may withdraw it at any time.
Protecting the form against spam and automated abuse	Our legitimate interest in keeping the service usable, Article 6(1)(f) GDPR
Keeping a record of enquiries where we are required to, or where a commercial relationship follows	Legal obligation, Article 6(1)(c), or performance of a contract, Article 6(1)(b)

Providing the required fields is voluntary, but without them we cannot answer you.

4. Who else sees it

Your message is delivered to our commercial team. It passes through the providers that host this website and carry our email.

To complete
Name the hosting provider and the email provider here, and confirm a written processor agreement under Article 28 GDPR is in place with each. If the site is served from a CDN, name that too.

We do not sell personal data and we do not share it for advertising.

5. Transfers outside the European Economic Area

Chocolates El Rey operates from Venezuela. When you write to us, your message is read by our team there, which means your personal data is transferred outside the European Economic Area.

To complete
Venezuela is not covered by a European Commission adequacy decision. A lawful transfer mechanism under Chapter V GDPR is therefore required — in practice Standard Contractual Clauses with a transfer impact assessment, or reliance on the Article 49(1)(b) derogation for transfers necessary to perform a contract or take pre-contractual steps at the data subject’s request. Decide which applies with counsel, put it in place, and describe it here. This is the single most substantive GDPR item on this site.

6. How long we keep it

We keep enquiries only as long as needed to deal with them and, where a commercial relationship follows, for as long as that relationship and the applicable record-keeping periods require.

To complete
Replace with concrete periods — for example: enquiries that lead nowhere deleted after 12 months; enquiries that become customer records kept for the statutory accounting retention period. A vague answer here is one of the most commonly cited deficiencies in supervisory-authority decisions.

7. Your rights

Under the GDPR you have the right to:

ask what personal data we hold about you and obtain a copy (Article 15);
have inaccurate data corrected (Article 16);
have your data erased (Article 17);
ask us to restrict how we use it (Article 18);
receive the data you gave us in a portable format (Article 20);
object to processing based on our legitimate interests (Article 21);
withdraw your consent at any time, without affecting what we did before you withdrew it (Article 7(3)).

To exercise any of these, write to the address in section 1. You also have the right to lodge a complaint with the data protection authority of the EU Member State where you live, work, or where you believe the problem occurred.

8. Automated decisions

We do not make decisions about you by automated means and we do not profile you.

9. Changes

If we change this policy we will publish the new version here and update the date below.

Last updated: September 2026