Privacy Policy

At Congas Ibérico S.L., we are committed to protecting your privacy and ensuring the security of your personal data. This Policy describes how we collect, use, share, and protect your information when you use our website and services.

By using our services, you agree to the practices described in this policy.

The Data Controller of your personal data is:

• Company Name: Congas Ibérico S.L.
• NIF / CIF: B22696223
• Registered Office: Cecilia Böhl de Faber Street, s/n, Marbella, Málaga
• Contact Email: contacto@congas.es

Hereinafter, "Congas" or "we".

3.1. Personal Information

When you make a purchase or register, we may collect:

• Full Name
• Email Address
• Billing and Shipping Address
• Phone Number
• Payment Information (processed securely by third parties)

3.2. Soda Club Information

If you join the Soda Club, we additionally store your order history and cylinder delivery and pickup address to coordinate exchanges. We do not automatically charge your account: each refill order is a voluntary transaction initiated by you.

3.3. Usage Information

We collect information when you visit our site:

• IP Address
• Browser and Device Type
• Pages visited and time spent browsing
• Referring source
• Cookies and similar technologies

The GDPR requires us to indicate the legal basis that authorizes us to process your data. Depending on the purpose:

• Contract performance (Art. 6.1.b GDPR): to manage your order, coordinate the delivery and collection of cylinders, and keep your account active.
• Legal obligation (Art. 6.1.c GDPR): to retain tax and accounting records for the legally required period.
• Legitimate interest (Art. 6.1.f GDPR): to prevent fraud, ensure site security, and improve our services, provided that your rights and interests do not override ours.
• Consent (Art. 6.1.a GDPR): to send commercial communications and use non-essential cookies. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

We use your personal information to:

• Process your orders: manage purchases, shipments, and pickups
• Manage cylinder exchange: coordinate deliveries of full cylinders and collection of empty ones
• Communicate with you: confirmations, updates, and customer support
• Improve our services: analyze usage through Google Analytics 4
• Digital marketing (with your consent): newsletters via Odoo, campaigns on Meta Ads, Google Ads, and TikTok Ads
• Prevent fraud and comply with legal obligations

We do not sell or rent your personal information. We may share it with:

6.1. Service Providers

• Shopify — web platform, hosting, and payment gateway (Shopify Payments)
• PayPal — alternative payment gateway
• CTT — logistics and shipping
• Odoo — CRM and email marketing
• Google Analytics 4, Meta Pixel, TikTok Pixel — analytics and digital marketing (only with prior cookie consent)
• Technical services and consultants necessary for operations

All of them act under contract and in compliance with the GDPR.

6.2. Legal Requirements

We may disclose information to comply with the law, respond to judicial requirements, or protect our legitimate rights.

Some providers are based outside the European Economic Area (EEA). In these cases, we apply appropriate safeguards:

• Shopify Inc. (Canada / USA): e-commerce platform. Canada has an Adequacy Decision from the European Commission; for servers in the USA, Standard Contractual Clauses (SCCs) apply.
• Google, Meta, TikTok: for analytics and advertising services, SCCs or other equivalent safeguards apply.
• Odoo: operates within the EEA and is fully GDPR compliant.

You can request information about the applicable safeguards by writing to contacto@congas.es.

We implement technical and organizational measures to protect your information:

• SSL/TLS encryption for all communications
• Secure storage with restricted access for authorized personnel
• Regular security audits
• Payment processing through PCI-DSS certified gateways

However, no method of transmission over the internet is 100% secure. If you detect any issues, please report them to us at contacto@congas.es.

In accordance with the GDPR and the LOPD-GDD, you can exercise the following rights:

• Access: obtain confirmation of whether we process your data and a copy of it.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request the deletion of your data when it is no longer necessary.
• Restriction: restrict processing in certain circumstances.
• Data Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest or for direct marketing purposes.
• Withdrawal of consent: withdraw your consent at any time, without retroactive effect.

To exercise any of these rights, please write to contacto@congas.es stating your request and providing a copy of your identity document. We will respond within a maximum period of one month.

We use cookies to improve your experience:

• Essential: necessary for the site to function (cart, session)
• Performance: anonymous usage analysis through Google Analytics 4
• Marketing: Meta Pixel and TikTok Pixel for relevant ads (only with your explicit consent)

You can manage or withdraw your consent at any time from our cookie panel or your browser settings. See our Cookie Policy for more details.

We only store your data for as long as necessary for the purposes described or as required by law:

• Customers: up to 6 years after the last purchase (tax and commercial obligations)
• Soda Club registration: as long as the registration is active and up to 2 years after the last interaction
• Marketing: until you withdraw your consent
• Browsing data / cookies: according to the expiry defined in the Cookie Policy

Our services are not intended for children under 14 years of age, the minimum age established in Spain by the LOPD-GDD (Art. 7) for providing consent to the processing of personal data.

If we identify that we have collected data from a minor without the proper consent of their legal representatives, we will delete it as soon as possible.

We do not make decisions based solely on automated data processing—including profiling—that produce legal effects or significantly affect you (Art. 22 GDPR).

If we were to implement such systems in the future, we would inform you beforehand and, when necessary, request your express consent.

We may update this Policy to reflect operational, legal, or regulatory changes. We will post the new version with the update date visible at the top of this page. If the changes are substantial, we will notify you by email with reasonable advance notice.