Version 1.1 · Effective 22.09.2026 · Last updated 22.09.2026

Privacy Policy

This policy explains how personal data is handled when you visit https://thegridcook.com, make contact, or use the in-kitchen batch-cooking sessions. It is written to meet Articles 13 and 14 of the GDPR and the Spanish Data Protection Act (LOPDGDD).

1. Who is responsible

The data controller is Dmitrii Sharonov, a self-employed professional (autónomo) trading as The Grid Cook (the "Controller"). NIF: Y9674448H. Address: Calle Floridablanca 66-68, Local 9F, 08015, Barcelona, España. Email for privacy matters: contact@thegridcook.com. No data protection officer has been appointed, because the activity does not require one; the email address above serves for anything concerning your data.

2. What data is processed, why, and for how long

Visiting the site. The web server records technical data (IP address, date and time, pages requested, browser type) in its logs. Purpose: security and keeping the site running. Legal basis: the Controller's legitimate interest in operating a secure website. Retention: up to 30 days.

Contact and bookings. When you send a message on WhatsApp or by email, the Controller processes your name, phone number, email address, the content of the conversation and the booking details (dates, the address where the session takes place, the price). Purpose: answering you, preparing and performing the service, and sending service messages such as plans, grocery lists, checklists, confirmations and invoices. Legal basis: taking steps at your request before a contract, and performing the contract. Retention: for as long as the relationship lasts and for 12 months after the last session; invoicing data is kept longer, as set out below.

Onboarding. Before the first session the Controller collects household size, the ages of children in the household, foods you do not want, details of the kitchen and its equipment, and your preferred slot. Purpose: planning and cooking. Legal basis: performing the contract. Information about allergies, intolerances or dietary restrictions is health data. Purpose: cooking safely for your household. Legal basis: your explicit consent, which is requested in the onboarding form and which you may withdraw at any time. Information about children is provided by a parent or legal guardian, who also gives the consent. Retention: for as long as the relationship lasts; allergy and dietary information is deleted when the relationship ends or when consent is withdrawn, whichever comes first. Onboarding data may be collected in the chat, by email or through a form on the site; wherever it comes from, it is handled as described here.

Sessions and invoices. For every session the Controller records the date, your name, the amounts paid and the expenses, and issues an invoice. A full invoice, if requested, includes your name, address and tax ID. Purpose: invoicing, accounting and tax obligations. Legal basis: legal obligation under Spanish tax and commercial law. Retention: 6 years from the end of the financial year, in blocked form after the relationship ends, and then deleted.

Payments. When you pay by contactless card payment or through a payment link, by Bizum or by bank transfer, the payment provider handles your card or account details; the Controller receives only a confirmation with the amount, the date and limited identifiers, such as the last digits of a card or the name of the payer. Purpose: receiving payment and keeping records. Legal basis: performing the contract, and legal obligation. Retention: with the invoicing records.

Work-area photographs. Photographs of the work area are taken before and after each session, without people in them, as a record of the state of the kitchen and of the work done. Purpose: quality control, and evidence in the event of a claim. Legal basis: the Controller's legitimate interest in documenting the service; these photographs are not published. Retention: 90 days after the session.

Photographs and testimonials for the website and social media. Published only with your prior consent, and never showing faces or details that identify you or your home. Legal basis: consent, which you may withdraw at any time. Retention: until consent is withdrawn; the material is then removed from the channels the Controller controls as soon as reasonably possible.

Service updates. As a client, you may receive occasional messages about the Controller's own similar services. Legal basis: the exception for existing clients in Article 21.2 of the Spanish Information Society Services Act (LSSI-CE). You may opt out at any time by replying to the message or writing to contact@thegridcook.com, and the messages stop.

Your data is not used for profiling or automated decisions. Contact details, the address and the onboarding information are necessary in order to provide the service; without them a session cannot be booked or performed. Allergy and dietary information is not mandatory, but without it restrictions cannot be taken into account.

3. Who receives your data

The Controller uses a small number of service providers. They process data on the Controller's behalf and under contract, except where they act as independent controllers, which is the case for the payment and messaging providers.

Public authorities, for example the tax agency, receive data where the law requires it. Personal data is neither sold nor rented.

4. International transfers

Some providers process data outside the European Economic Area. WhatsApp, Google and Stripe transfer data to the United States under the EU–US Data Privacy Framework, to which their United States entities are certified, and under standard contractual clauses approved by the European Commission. Where a provider outside the EEA is added, this policy is updated.

5. Cookies

The site uses only technical cookies that are strictly necessary for it to work: a session cookie and a security (CSRF) cookie, and a "remember me" cookie only where you log in to an account (no accounts are offered to the public at present). These cookies do not require consent, so the site has no cookie banner. The site uses no analytics, advertising or social media cookies. If that changes, this policy is updated and a consent mechanism is added before any such cookie is set.

6. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you have given, which does not affect processing carried out before the withdrawal. To exercise these rights, write to contact@thegridcook.com from the address or phone number you use with the Controller, or attach a copy of an identity document where your identity cannot otherwise be confirmed. The Controller replies within one month. If you believe your data has not been handled properly, you may complain to the Spanish Data Protection Authority (Agencia Española de Protección de Datos, www.aepd.es); the Controller would welcome the opportunity to resolve the matter with you first.

7. Security

The site is served over HTTPS. Access to your data is limited to the Controller and to the providers listed above, each for its own purpose. Only the data that is needed is kept, and it is deleted when the retention period ends.

8. Children

The site and the services are aimed at adults. Information about children is processed only where a parent or legal guardian provides it as part of the household information for a session.

9. Changes to this policy

The version and effective date are shown at the top of this page. When this policy changes, the new version is published here and, where the change matters to a client, the client is told by message.

10. Language

This policy is published in Spanish and in English. The Spanish version is the authoritative version; the English text is a courtesy translation. A Catalan translation is available on request at contact@thegridcook.com. Where versions differ, the Spanish version prevails.

Change log

• v1.1 — 22.09.2026 — first published version.