Privacy Policy

This policy explains how Rikisimo processes personal data when you use the Rikisimo website, the Rikisimo mobile app identified as com.rikisimo.mobile, create an account, contact us, or place an order.

1. Data controller and privacy contact

5 Sentidos SRL, a Cuban MSME operating under the trade name Rikisimo, is responsible for the processing described in this policy. Its professional address is Calle San Juan de Dios 67, ground floor, between Habana and Compostela, Old Havana, Havana, Cuba. Privacy inquiries and requests can be submitted to soporte@rikisimocuba.com or through WhatsApp at +53 6308 9446.

1.1. Representative in the European Union

In accordance with Article 27 of Regulation (EU) 2016/679, 5 Sentidos SRL has designated Joel Arce Otaño as its representative in the European Union for matters concerning the processing of personal data. The representative's address is Pilar de Zaragoza 77, ground floor, 28028 Madrid, Madrid, Spain, and the representative can be contacted at representanteue@rikisimocuba.com. People located in the European Union and supervisory authorities may contact the representative regarding Rikisimo's processing of personal data, without prejudice to their right to contact 5 Sentidos SRL directly.

2. Data we collect

• Account data: full name, email address, password stored as a secure hash, WhatsApp number, municipality, account status, and email confirmation information.
• Order and delivery data: recipient name, telephone number, email, province, municipality, delivery address, requested date and time, items, amounts, discounts, fulfillment method, payment method, order status, and optional gift instructions.
• Customer service and survey data: messages you send us and responses you voluntarily submit to satisfaction surveys.
• Technical data: authentication cookies, session information, connectivity data necessary to communicate with the service, and standard server security records such as IP address and request time.
• Data stored on your device: cart contents, basic profile data when you choose to keep your session open, and authentication cookies stored using the device's secure storage.

Rikisimo does not request access to your precise location, contacts, camera, microphone, photos, or shared device storage. The app does not include advertising or behavioral tracking SDKs.

3. How we use data

• Create, authenticate, secure, and manage your account.
• Prepare, confirm, deliver, collect, and support your orders.
• Send transactional messages such as email confirmation, password recovery, order information, and service notices.
• Apply coupons and operate Club Rikisimo benefits and referral attribution.
• Prevent fraud, abuse, unauthorized access, and technical failures.
• Measure service quality through voluntary surveys and aggregated sales statistics.
• Meet applicable administrative, accounting, legal, and regulatory obligations.

Our legal bases are the steps you request before entering into a contract and performance of the contract for accounts and orders; compliance with applicable legal obligations for accounting, rights requests, and regulatory matters; and our legitimate interests in securing the service, preventing fraud, handling claims, and improving quality, provided those interests do not override your rights. Separate promotional communications and non-essential cookies are used only when there is a valid legal basis, including consent where required. You may withdraw consent at any time without affecting prior lawful processing.

4. When data is shared

We do not sell personal data. We disclose only the information needed for the service to:

• Authorized Rikisimo staff who prepare orders or provide customer support.
• Assigned couriers, who receive the contact and delivery details needed to complete an active order.
• IONOS Cloud S.L.U., as the provider of web hosting, database, and email services, acting as a processor under the applicable contractual terms.
• Other communications, security, and technical service providers acting on our behalf.
• WhatsApp/Meta when you choose to open WhatsApp from Rikisimo; that service applies its own privacy terms.
• TropiPay when you choose to pay electronically; TropiPay processes the payment and applies its own terms and privacy information.
• Authorities or other parties when required by law or necessary to protect users, Rikisimo, or third parties.

International context: Rikisimo's technological infrastructure is provided by IONOS Cloud S.L.U., and the data is hosted in Europe. The web server for rikisimocuba.com is geolocated in Germany. The specific country and data center used for the database, email, and backups have not been individually identified. Authorized personnel of 5 Sentidos SRL may access the data from Spain and Cuba to manage orders, support, and security. Other providers may process information in the countries described in their terms. Rikisimo assesses the role and safeguards of each provider and limits information to what is necessary. Direct payment credentials are collected by TropiPay, not by Rikisimo.

5. Payments

Rikisimo sells physical goods. The app records the selected payment method and order amounts. It does not request or store complete payment-card credentials in the mobile app.

6. Security

We use HTTPS encryption in transit, hashed passwords, secure authentication cookies, access controls, session expiration, and restricted administrative access. No system can guarantee absolute security; please protect your password and contact us if you suspect unauthorized access.

7. Retention

Account and profile data is retained while the account remains active. Active-order data is retained until completion, cancellation, and resolution of incidents, and transaction records for the period required by applicable Cuban accounting and liability rules. Security logs are kept for no longer than 12 months unless an incident justifies restricted retention. Closed privacy-request evidence is kept for three years under the current internal policy and then deleted or anonymized. Backups follow their protected overwrite cycle. These periods are reviewed and data is deleted or anonymized when no longer needed.

8. Account and data deletion

You can permanently delete your account from Account > Security > Delete account in the mobile app or from your account settings on the website. Active orders must first be delivered or cancelled so that the service does not lose the information needed to complete them.

When deletion is completed, Rikisimo deletes your Identity credentials, profile, authentication sessions, personal coupon associations, and personal contact and delivery information. Completed orders remain only as anonymized sales records: products, quantities, amounts, dates, and statuses are retained without your account identifier, name, email, telephone number, or address. Survey invitations and responses associated with those orders are removed.

For assistance with deletion, including when you cannot access your account, contact soporte@rikisimocuba.com. We may request reasonable information to verify that you own the account.

9. Your choices and rights

You may request access, correction, deletion, restriction, objection, and portability where applicable, withdraw consent, and ask not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Rikisimo does not currently make such automated decisions. Requests are free and are normally answered within one month; complex requests may be extended by up to two additional months, with notice and reasons during the first month. Contact Rikisimo or its EU representative using section 1. You may also lodge a complaint with the supervisory authority where you live or work; in Spain, this is the Spanish Data Protection Agency (AEPD).

10. Children

Rikisimo accounts and orders are intended only for people aged 18 or older. We do not knowingly create accounts for children.

11. Changes to this policy

We may update this policy when the service or legal requirements change. The current version and its effective date will remain available on this page.