Privacy Policy.

The data controller who determines the purposes and means of processing your personal data is the company Coffee partners s.r.o., with its registered office at Partizánska cesta 106, 974 01 Banská Bystrica, Company ID: 46127526. For matters relating to the protection of personal data, you can contact us at info@cipollacaffe.sk.

Depending on how you use our website, we process:

• Order: first and last name, billing and delivery address, email, phone number, order contents and purchase history.
• B2B purchase: business name, Company ID, Tax ID and VAT ID of the corporate customer.
• Customer account: login details (email, encrypted password) and account settings.
• Newsletter: email address and record of consent given.
• Technical data: IP address, device and browser type, cookies and website usage data (for analytics and marketing cookies, only with your consent).

Processing based on consent (newsletter, marketing and analytics cookies) begins only after consent has been given, and you may withdraw your consent at any time without affecting the lawfulness of processing already carried out.

• Orders and accounting documents: for as long as necessary to fulfill the contract, and subsequently for the period required by tax and accounting regulations (generally 10 years).
• Customer account: for as long as it is actively used, or until the account is deleted.
• Newsletter: until consent is withdrawn, but no longer than 10 years from the last time consent was given.
• Cookies: according to the retention period of each cookie, as stated in the Cookie Policy.

We disclose your data only to the extent necessary to reliable partners with whom we have data processing agreements in place:

• Carriers: Packeta and GLS (delivery of the order).
• Payment gateway: Tatra banka, a. s. — TatraPay Plus (processing of online payments).
• Accounting: an external accounting firm.
• Hosting and email: our web hosting and email service provider.
• Newsletter: an email sending tool (e.g. Ecomail).
• Analytics and advertising: Google (Google Analytics 4) and Meta (Meta Pixel) — only when consent has been given; transfers to third countries take place under the EU-US Data Privacy Framework.
• Purchase review: Heureka Group a. s. — for the “Verified by Customers” service we pass on your email address, order number and the list of purchased products so it can send you a satisfaction questionnaire. This is done on the basis of legitimate interest (independent verification of shop quality); you may unsubscribe from the questionnaire at any time directly with Heureka, or write to us and we will exclude you from future mailings.
• Website operation: Vercel Inc. (USA) — operates our website and measures its traffic and speed in anonymous form; transfers to third countries are covered by standard contractual clauses. More detailed events (e.g. the name of the product being viewed) are only sent to it when you have given consent to analytics cookies.

Our website uses necessary cookies (required for the website and cart to function) and, once you give consent, analytics and marketing cookies as well. You can change your settings at any time in the cookie banner. A detailed list of all cookies, their purpose and retention period can be found in the separate Cookie Policy.

Our own visitor statistics (cookie-free). Independently of consent, we keep simple statistics directly on our own server. It stores nothing on your device and does not retain your IP address or browser details — these are used only as input to a one-way hash together with a random value that changes every day and is deleted once it becomes outdated. This means you cannot be identified from the stored records, and visits are not linked across different days. We record the pages visited, time spent on them, referral source, device type and country.

If a visit ends in an order, we link the order number with data about the referral source (e.g. “search”, “social media”) — we need to know which form of promotion is actually working. In connection with an order, this becomes personal data; we process it on the basis of legitimate interest (Art. 6(1)(f) GDPR) consisting of improving the website and evaluating our own promotion. We do not provide this data to third parties or use it to target advertising. We keep detailed records of website activity for 400 days, after which only aggregate statistics remain. You have the right to object to this processing at any time — simply write to info@cipollacaffe.sk.

If you subscribe to our newsletter, we process your email address on the basis of consent for the purpose of sending news, offers and information about coffee and courses. You can unsubscribe at any time by clicking the link in the footer of any email, or by writing to info@cipollacaffe.sk.

Welcome coupon: subscribing to our newsletter may come with a one-time welcome discount coupon. To issue and redeem it, we process your email address and coupon data (code, validity, usage) on the basis of consent, or performance of a contract when it is redeemed in an order; we keep coupon data for the validity period of the coupon and subsequently as part of the order’s accounting records. Withdrawing your newsletter consent does not cancel a coupon that has already been issued.

In connection with the processing of your data, you have the right:

• to access your data and obtain a copy of it,
• to have inaccurate or incomplete data corrected,
• to have your data erased (“the right to be forgotten”),
• to restrict processing,
• to data portability,
• to object to processing,
• to withdraw consent given, at any time.

You can exercise your rights by emailing us at info@cipollacaffe.sk. If you believe we are processing your data unlawfully, you have the right to file a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava (dataprotection.gov.sk).

We have adopted appropriate technical and organizational measures to protect your data against unauthorized access, loss or misuse (encrypted HTTPS transmission, secured access to databases). Providing the data required to process an order is a contractual requirement; without it, we are unable to process the order.

We may update this policy. The current version is always available on this page. Version effective as of July 1, 2026.