Privacy Policy

Your privacy matters to Nachteulen Coffee

At Nachteulen Coffee, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, place an order, contact us, or otherwise use our services.

This Privacy Policy is intended to provide information in accordance with the applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

The GDPR requires businesses to provide clear information about who processes personal data, why it is processed, the legal basis for processing, recipients, storage periods and the rights available to individuals. :contentReference[oaicite:1]{index=1}

2. Personal Data We May Collect

Depending on how you interact with our website and services, we may collect and process the following categories of personal data:

• Name and contact details.
• Billing and delivery address.
• Email address and telephone number.
• Order and transaction information.
• Information you provide when contacting customer support.
• Information submitted through website forms.
• Technical information relating to your device and browser.
• IP address and information relating to website access and security.
• Cookie and similar technology information, where applicable.

We aim to collect and process only information that is necessary for the relevant purpose.

3. How We Use Your Personal Data

We may use personal data for purposes including:

• Processing and fulfilling orders.
• Processing payments and refunds.
• Arranging delivery of purchased products.
• Providing order confirmations and service communications.
• Responding to customer enquiries and support requests.
• Managing returns, refunds and complaints.
• Maintaining and improving our website and services.
• Preventing fraud, misuse and unauthorized activity.
• Maintaining website and information-security measures.
• Complying with applicable legal and regulatory obligations.
• Sending marketing communications where legally permitted and where required consent has been obtained.

4. Legal Bases for Processing

Depending on the circumstances, we process personal data on one or more of the following legal bases under Article 6 GDPR:

5. Shopify and Service Providers

Our online store is operated using Shopify and may rely on service providers and technology partners to operate the website, process orders, provide payments, facilitate delivery, maintain security and provide other business services.

Depending on the service used and the circumstances of the transaction, personal data may be shared with relevant processors or service providers where necessary to provide the requested service or fulfil our legal obligations.

Where service providers process personal data on our behalf, we take appropriate steps to ensure that processing is governed by applicable data protection requirements.

6. Payment Information

Payments may be processed through third-party payment providers available at checkout. Payment providers may process payment information directly in accordance with their own privacy policies and applicable security requirements.

We do not intentionally store complete payment-card details when those details are processed directly by an authorized payment provider.

7. Order and Customer Information

When you place an order, we may process information such as your name, contact details, billing information, delivery address, order details and relevant communications.

This information is used to process your purchase, arrange delivery, provide customer service, handle returns and refunds, and comply with applicable accounting and legal obligations.

8. Customer Communications

If you contact us by email, telephone or another available communication channel, we may process the information you provide in order to respond to your enquiry, provide customer support and maintain appropriate records of our communication.

We may retain relevant correspondence for as long as reasonably necessary to resolve the matter and comply with applicable legal obligations.

9. Cookies and Similar Technologies

Our website may use cookies and similar technologies to operate the website, remember preferences, provide essential functionality, improve performance and, where applicable, analyze website usage or support marketing activities.

Where consent is legally required for non-essential cookies or similar technologies, these technologies will only be used after the required consent has been obtained.

You may also control cookies through your browser settings. Disabling certain cookies may affect the functionality of parts of the website.

10. Marketing Communications

Where legally permitted, we may use your contact information to provide information about products, services or promotions.

Where consent is required, we will obtain your consent before sending marketing communications. You may unsubscribe from marketing communications at any time by following the unsubscribe instructions included in the relevant communication or by contacting us.

11. Sharing of Personal Data

We do not sell your personal data. We may disclose personal data where necessary to operate our business and provide our services, including to:

• Website and e-commerce service providers.
• Payment service providers.
• Shipping and delivery providers.
• IT, hosting and technical service providers.
• Customer-support service providers.
• Professional advisers where necessary.
• Government authorities or other recipients where required by law.

We only share information where there is an appropriate legal basis and where the disclosure is necessary for the relevant purpose.

12. International Data Transfers

Some service providers we use may process personal data outside Germany or the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we will take appropriate measures required by applicable data protection law, which may include an adequacy decision, appropriate safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism.

13. How Long We Keep Personal Data

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Certain transaction, accounting and tax information may need to be retained for statutory periods under applicable German law.

When personal data is no longer required, it will be deleted or securely anonymized where appropriate.

14. Data Security

We take reasonable technical and organizational measures designed to protect personal data against unauthorized access, accidental loss, misuse, alteration or unlawful disclosure.

However, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure.

15. Your Data Protection Rights

Subject to the conditions and limitations of applicable law, you may have the following rights under the GDPR:

• Right of access: request information about your personal data.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of personal data in applicable circumstances.
• Right to restriction: request restriction of processing in applicable circumstances.
• Right to data portability: receive certain personal data in a structured, commonly used and machine-readable format.
• Right to object: object to certain processing, including certain processing based on legitimate interests.
• Right to withdraw consent: withdraw consent where processing is based on consent.

The GDPR provides these rights subject to applicable conditions and exceptions. Information about data-subject rights and transparent communication is set out in GDPR Articles 12–22. :contentReference[oaicite:2]{index=2}

16. Right to Lodge a Complaint

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent data protection supervisory authority.

In Germany, the competent supervisory authority may depend on the location and circumstances of the controller and the processing activities.

17. Children's Privacy

Our website and services are not intentionally directed toward children. We do not knowingly collect personal data from children where such collection would be unlawful.

18. Third-Party Websites

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices, content or security of third-party websites.

We recommend reviewing the privacy policy of any third-party website before providing personal information.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements or data-processing practices.

The updated version will be published on this page with an updated effective date where appropriate.