Privacy policy

1. PRIVACY POLICY OVERVIEW & ROLES OF THE PARTIES

This Privacy Policy outlines how personal data is collected, processed, stored, and protected when you use www.coffeeisland.es (“Site”) and the My Coffee Island application.
In accordance with the EU General Data Protection Regulation (GDPR 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD):
• COFFEE ISLAND SWISS LTD (Cyprus HE 406507, 5 Esperidon, 2048 Nicosia, Cyprus) acts as Data Controller for user account registration, website and application administration, digital platform infrastructure, IT hosting, and general customer account management.
• The respective fulfilling Store (e.g. GEOMETRIA GROUP SL, NIF B72648090, Calle Federico Garcia Lorca 17, Villalbilla, 28810 Madrid, or other authorized franchisee stores in Spain) acts as Data Controller for order preparation, delivery logistics, local sales invoicing, and customer order fulfillment.
• Under the Service Agreement and Data Processing Agreement (DPA) entered into between SWISS and the Stores, SWISS acts as Data Processor on behalf of the fulfilling Store to transmit and facilitate order collection via the Site.

2. PERSONAL INFORMATION WE COLLECT

We collect personal information directly from you when you interact with our Service:
• Registration & Profile Data: First and last name, delivery address, mobile phone number, email address, and optional demographic data (date of birth, gender).
• Transaction & Order Data: Details of products ordered, order history, frequency of visits, discount usage, loyalty points, and transaction amounts.
• Technical & Usage Data: IP address, device identifier, browser type, operating system, login metadata, and browsing patterns collected through cookies.
• Communication & Support Data: Inquiries, customer reviews, complaints, or feedback sent directly via email, contact forms, or telephone.
• Payment Reference Data: Payment confirmation tokens and references. Credit/debit card numbers are NOT stored by SWISS or Stores; they are encrypted and handled directly by licensed Payment Service Providers (PSP).

3. LEGAL BASIS AND PURPOSES OF PROCESSING

We process personal data based on legal bases established under Article 6(1) of the GDPR:
1. Performance of Contract (Art. 6(1)(b) GDPR): To process, manage, and fulfill your orders, communicate order updates, provide customer support, and manage user accounts.
2. Compliance with Legal Obligations (Art. 6(1)(c) GDPR): To fulfill tax, accounting, invoicing, and statutory consumer protection requirements under Spanish legislation.
3. Legitimate Interests (Art. 6(1)(f) GDPR): To maintain IT system security, prevent fraud, analyze platform usage to optimize our services, and defend legal claims.
4. Consent (Art. 6(1)(a) GDPR & Article 22.2 LSSI-CE): For sending commercial marketing communications, electronic newsletters, personalized offers, and setting non-essential cookies. You may withdraw consent at any time without affecting prior lawful processing.

4. DATA SHARING AND RECIPIENTS

Personal information may be disclosed to third parties strictly as necessary for platform functionality and order fulfillment:
• Fulfilling Coffee Island Stores in Spain: To prepare, pack, and deliver your orders.
• Technical Service Providers: IT infrastructure, cloud hosting, database maintenance, and software development vendors acting as data processors under GDPR contracts.
• Licensed Payment Service Providers (PSP): To securely process credit/debit card transactions.
• Logistics and Delivery Partners: Courier services where applicable for product delivery.
• Public Authorities & Courts: Where required by mandatory Spanish or EU law, court orders, or statutory reporting obligations.

5. INTERNATIONAL DATA TRANSFERS

Personal data processed through the Site is stored on secure servers located within the European Economic Area (EEA). No transfers of personal data outside the EEA take place without prior authorization and the implementation of appropriate safeguards (such as EU Standard Contractual Clauses or adequacy decisions) in full compliance with Chapter V of the GDPR.

6. DATA RETENTION PERIODS

Personal data is retained only for as long as necessary to achieve the specific processing purposes:
• Account Data: Maintained for the duration of your active account registration. Inactive accounts may be deleted after 2 years of inactivity.
• Transaction & Invoicing Records: Retained for six (6) to ten (10) years in compliance with mandatory Spanish tax and commercial obligations (Ley General Tributaria / Código de Comercio).
• Marketing Data: Retained until you withdraw consent or unsubscribe via privacy@coffeeisland.es.
• Customer Service Communications: Retained for up to two (2) years following resolution of the query.

7. YOUR DATA SUBJECT RIGHTS UNDER GDPR & LOPDGDD

As a data subject under GDPR and Spanish Organic Law 3/2018 (LOPDGDD), you have the following enforceable rights:
• Right of Access (Art. 15 GDPR): Request confirmation of whether your data is being processed and obtain a copy.
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal data.
• Right to Erasure / Right to be Forgotten (Art. 17 GDPR): Request permanent deletion of data where legal grounds apply.
• Right to Restriction of Processing (Art. 18 GDPR): Request restriction of data processing under specified statutory conditions.
• Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21 GDPR): Object at any time to processing based on legitimate interest or direct marketing.
• Right to Withdraw Consent: Withdraw consent at any time for consent-based processing.

8. EXERCISING YOUR RIGHTS & SUPERVISORY AUTHORITY

To exercise any of your data protection rights, request account deletion, or opt out of marketing, please send your request by email to: privacy@coffeeisland.es.
We will process your request within one (1) month of identity verification (extendable by two additional months in complex cases, with prior notice).
If you consider that your personal data processing infringes GDPR or LOPDGDD regulations, you have the right to file a complaint with the competent Spanish Supervisory Authority:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
Website: www.aepd.es | Tel: +34 900 293 183 / +34 912 663 517