Privacy Policy

Last updated: October 2026. This is a translation; in case of discrepancy, the Spanish version prevails.

1. Data controller

LA CASITA 33 Y ALGO MAS S.L. is the controller of the personal data you give us when you place an order in this online shop.

This website brings together the online shops of several restaurants, and each restaurant may belong to a different company. Each one is the controller of the orders you place with it: for this shop it is LA CASITA 33 Y ALGO MAS S.L., with the details above; those of another restaurant appear in the policy of its shop. Your account (“My account”) is one and the same for every shop on this website: you can order from any of them with it, and each restaurant processes the account data it needs to handle your orders with it.

2. Data we process

We only process the data you give us and the data strictly needed to handle it:

• First name and surname.
• Contact phone number.
• Delivery address and its location on the map (delivery orders only), with the floor and the instructions for the rider that you give us.
• Order details (products, comments, requested time, payment method and, if you pay the rider in cash, how much you will pay with).
• Loyalty points, stamps and free orders linked to your phone number or your account, if you take part in the programme.

If the restaurant has a self-ordering kiosk with the QR code of the customer app and you choose to scan it with the app while signed in, the order you place at the kiosk is linked to your account and earns a stamp on your stamp card for that restaurant, just like your orders on this website. At a kiosk that takes card payments on its own reader, if you have a free order, you can also use it by choosing it on the screen; at a kiosk where you pay at the counter, stamps are earned, but the free order is used on this website or at a kiosk with a reader. The kiosk only shows your first name, your stamps and, where it can be used, your free order. The link ends when you pay (at a kiosk where you pay at the counter, when you place the order), if you do not touch the greeting screen within 10 seconds or if you tap “Exit”. That order does not appear in your order list in “My account”, but it counts for your stamps. Without scanning the code, the kiosk order is anonymous. What is stored about the link and for how long is explained in the kiosk privacy policy.

And, only if you create an account or use these features:

• Email address, to sign in to your account and, if you ask for it, to send you the invoices for your orders.
• Saved addresses and your order history.
• Billing details for the invoice (tax ID, name or company name and billing address).
• Gift cards linked to your account and their balance.
• Your consent to receive offers and news by email, if you give it in “My account”, together with the date, the IP address and the shop where you gave it, as proof of that consent.
• For each order, a record that you were offered the option to object to receiving offers by email (the text you saw, its version, the language and whether you ticked the box) and, if you object or unsubscribe, that objection, so that we can respect it.

The customer app

If you use the customer app (Android or iPhone), the app shows this same online shop and processes the same data as the website. It also uses two phone features, both optional:

• Kiosk QR code scanner. The camera is only used while you scan and the image is processed on the phone itself: the app neither stores it nor sends it. Only the content of the scanned code (the kiosk link) reaches our servers. On Android the scanner is Google's (“Google code scanner”, from ML Kit, included in Google Play services): Google may receive technical data about the device and the app (for example, the model, the system and app versions and technical device identifiers) and performance and usage data of the scanner, which it processes as a controller to maintain and improve it, under its privacy policy (policies.google.com/privacy). On iPhone the scanner is Apple's system scanner, inside the app, and sends nothing to third parties.
• Location. If you tap “Use my location” on the shop list (in the app or on the website), the phone's position is used only on the phone itself to sort the shops by distance: it is not sent to our servers or stored.

If you pay by card on the website or in the app, the payment is processed by Stripe: the card details are entered directly into its system and we neither see nor store them. We only receive from Stripe the payment confirmation and the data needed to manage it (amount, date and, where applicable, refunds). If you pay at the restaurant or to the rider, no payment data is processed.

3. Purpose and legal basis

We process your data in order to manage and deliver your order (preparation, contact in case of an incident and, where applicable, home delivery) and, if you take part, to manage your loyalty programme, your account and your invoices. The legal basis is the performance of the sales contract you request when you place the order and, for invoices, compliance with legal obligations.

Offers and news by email. If you buy from this shop, LA CASITA 33 Y ALGO MAS S.L. may email you offers and news about its products similar to the ones you bought, unless you object. You are written to by LA CASITA 33 Y ALGO MAS S.L., directly or through LETTUS SALADS S.L., which manages the Lettus network's campaigns on its behalf; the email always states which restaurant it comes from and includes the unsubscribe link. No other restaurant in the network ever writes to you in its own name. The legal basis is article 21.2 of Spanish Law 34/2002 on information society services (LSSI) and the legitimate interest in making its products known to its customers (article 6(1)(f) GDPR). You can object free of charge and easily: when you place the order, by ticking the box “I don't want to receive offers…”, which is never ticked in advance, and afterwards, at any time, with the unsubscribe link included in every one of these emails, in “My account” or by writing to us. Once you object we will not write to you again, even if you buy again, unless you turn it on yourself in “My account”. Objecting at one restaurant of the network applies to all Lettus restaurants. Only purchases in which you were offered the option to object count, and we keep your objection for as long as your account exists.

If you turn on “Receive offers and news by email” in “My account”, the legal basis is your consent, which you can withdraw in the same ways at any time. The emails about your orders (confirmation, notices and invoices) are not marketing and you will keep receiving them.

4. Processors and hosting

To provide the service we rely on providers that process data on our behalf, under the corresponding data processing agreement:

• Stellar Digital S.L. (Tax ID B93774057) — operator of the ordering technology platform Stellar Store, which processes the data on behalf of LA CASITA 33 Y ALGO MAS S.L. as a processor.
• LETTUS SALADS S.L. (Tax ID B93366813) — manages the Lettus network's offers and news email campaigns on behalf of LA CASITA 33 Y ALGO MAS S.L., as a processor: each email is sent in the name of the restaurant that sold to you.
• Hetzner Online GmbH — hosting provider of the platform, with data centres in the European Union.

To place your delivery address on the map, the address you type is sent to Google (Google Maps, address suggestions) and, to calculate its location, to OpenStreetMap (Nominatim service, the address only), which process it as independent controllers under their own terms and privacy policies. At restaurants that receive orders through Sinqro (their order management system), the order data needed to prepare and deliver it (name, contact details and address) also reaches Sinqro. Emails are sent from the platform's mail server (Abansys & Hostytec, S.L., Madrid) or, for invoices, from the restaurant's own email account.

In addition, if you pay by card on the website or in the app, the payment is processed by Stripe Payments Europe, Ltd. (Ireland) in two roles: on behalf of LA CASITA 33 Y ALGO MAS S.L., to charge your order (Stripe data processing agreement, stripe.com/legal/dpa), and as an independent controller for its own purposes, such as fraud prevention and its legal obligations, under its privacy policy (stripe.com/privacy).

The platform's backups are stored encrypted, on Hetzner servers and storage in the European Union.

When something fails (an order that does not reach the kitchen, a payment or a refund that is not completed), the system alerts the technical team of Stellar Digital S.L. through a messaging service (Telegram, outside the EEA). That alert is purely operational —the type of incident and the shop— and contains none of your data (no name, order code, amount or identifiers): the details stay in the server's internal logs, in the EU.

We do not share your data with third parties for commercial purposes. Your data is hosted in the European Union. Outside the European Economic Area:

• Stripe may transfer data to Stripe, Inc. (USA), which participates in the EU-U.S. Data Privacy Framework, and also under the European Commission's standard contractual clauses in its data processing agreement (stripe.com/legal/dpa).
• Google may process the address you type in the address search at Google LLC (USA), which participates in the EU-U.S. Data Privacy Framework (policies.google.com/privacy/frameworks).

You can ask for more information about these safeguards by writing to litoral@lettus.es.

5. Retention

• Orders: kept to manage them and to meet tax and accounting obligations. Each order, 36 months after it is placed, loses your name, phone number, address, its location and the notes (including those on each product), through a monthly automatic process; the order is kept without that data, linked to your record while it exists (for your history in “My account”).
• Your record and your account (name, contact details, saved addresses, billing details): for as long as you buy or use your account; they are emptied once you have gone 36 months without ordering or signing in, when you delete your account (section 6) or earlier if you ask us to. If you are also a customer of LA CASITA 33 Y ALGO MAS S.L. at its restaurant (with orders at its till), that record follows the restaurant's rules.
• Loyalty: for as long as you take part in the programme. Kiosk orders linked to your account follow the same rules as those on this website, except the name the kiosk greets you with, which is deleted after 30 days.
• Invoices: the period required by law (4 years for tax documentation and 6 for accounting records).
• If LA CASITA 33 Y ALGO MAS S.L. stops using this online shop, your data is deleted (except invoices) in the monthly automatic process, never earlier than 30 days after it leaves nor 7 days after the internal notice sent once it leaves: normally between one and two months later. It is not deleted while the shop keeps receiving orders or if it asks to keep it, nor is the data you share with other shops or with its restaurant.
• Backups: deleted data remains in the backups until they are renewed automatically, at most about three months, and is not used except to restore the service after a failure.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability of your data by writing to litoral@lettus.es. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Deleting your account

You can delete your account yourself, without writing to us: in “My account” > “My details” > “Delete my account”, on the website or in the app, or without signing in from https://pedidos.lettus.es/litoral/cuenta/eliminar, where you enter your email and we send you a link to confirm it. Before deleting, we show you what you will lose.

• Deleted immediately, in every shop on this website: your account and access to it (you are signed out on all your devices), your saved addresses and billing details, your stamps and any unused free order, your marketing consent and, in your orders on this website, your name, phone number, address, location and notes.
• Kept, as required by law and for the legal period (section 5): orders without your contact details (products, amounts, date and payment method) and invoices already issued, with the data that appears on them. If an order has an invoice, the copy of that order in the restaurant's till is kept as it is, because the invoice is issued from it, and your record keeps only what the invoices need in order to be issued again.
• Gift cards are removed from your account but still work with their code.
• If you have an order in progress or awaiting payment, or a refund being processed, you can delete your account once it is finished.
• If you are also a customer of the restaurant with orders placed at its till, that record also belongs to the restaurant and follows its rules: to delete it, write to it.
• Copies of the order already sent to other systems to prepare or deliver it (the restaurant's delivery application or, at the restaurants that use it, Sinqro) and the payment data kept by Stripe are not deleted with your account: they follow their own periods. Deleted data remains in the backups until they are renewed, at most about three months.
• If you sign in again with the same email, you start with a new, empty account.