Privacy Policy

1. General Provisions

This Privacy Policy sets out the rules governing the collection, processing, and storage of personal data in connection with the use of the Coffee Freaks mobile application (the “Application”), as well as browsing the Blog and the Application Promotional Website.

All personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter the “GDPR”.

2. Data Controller

The controller of Users’ personal data is Maciej Romański, operating as Muninn Software, hereinafter the “Data Controller”.
Data Controller: Maciej Romański
Address: Plac Wolności 11/4, 11-100 Lidzbark Warmiński
TIN: 5792207971
REGON: 381828494
Contact: contact@coffeefreaks.eu

The Administrator has not appointed a Data Protection Officer. For matters relating to personal data protection, you can contact us at contact@coffeefreaks.eu.

3. Personal Data Processed

Providing personal data is voluntary; however, in certain cases, it may be necessary to use specific functionalities of the Application or services provided by the Data Controller. Providing an email address and password is necessary to create and operate a User account. Providing an email address is necessary to subscribe to the newsletter or join the waiting list. Failure to provide data required for a particular purpose may result in the inability to use a specific functionality or receive a response.

The data collected by the Data Controller shall:

• be processed lawfully;
• be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes;
• be accurate and, where necessary, kept up to date, and adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed;
• be kept in a form which permits identification of the data subject for no longer than is necessary for the purposes for which the personal data is processed.

We process the following data:

• username or first name, email address, and password (stored in secured hashed form) — where a User account has been created in the mobile Application;
• reviews and review reports — where a review or review report has been submitted through the mobile Application;
• messages submitted through contact forms — where a message has been submitted using a contact form or sent to contact@coffeefreaks.eu;
• photographs taken using the device camera while using the scanning functionality — where camera access has been granted and the scanning functionality has been used in the mobile Application;
• monitoring of activity within the application, session information (start and end of the visit, session duration, frequency), device information (type, operating system, application version), approximate location;
• cookies — exclusively on the Blog and the Application Promotional Website, and only where the User has consented to their use.

We process personal data for the following purposes:

• registration and operation of a User account, on the basis of Article 6(1)(b) GDPR;
• communication with the User initiated by the User, where the User has consented to such communication by subscribing to the newsletter or joining the waiting list for access to the Application Article 6(1)(a) GDPR;
• communication with the User initiated through the use of a contact form or direct email contact, on the basis of Article 6(1)(a) GDPR;
• providing information about speciality coffee and coffee roasters by means of a newsletter, which is directly related to the activities of the Data Controller, on the basis of Article 6(1)(a) GDPR;
• displaying search results using the scanning functionality, on the basis of Article 6(1)(b) GDPR;
• analytical and statistical purposes, consisting of analysing how Users use the mobile Application, the Blog and the Application Promotional Website in order to optimise the services, products, and functionalities provided, on the basis of the Data Controller’s legitimate interest pursuant to Article 6(1)(f) GDPR;
• establishing, pursuing, or defending legal claims, on the basis of the Data Controller’s legitimate interest in protecting its rights, pursuant to Article 6(1)(f) GDPR.

4. Data Retention Period

a. General Provisions
Personal data processed on the basis of consent shall be processed until such consent is withdrawn, provided that withdrawal of consent shall not affect the lawfulness of processing carried out before the withdrawal of consent.

b. Mobile Application
Personal data originating from the Coffee Freaks mobile Application (username, email address, password, submitted reviews, review reports, contact form messages, and photographs) shall be processed for as long as the User maintains an account in the Coffee Freaks mobile Application. Such data shall be deleted or anonymised within 30 days after the User ceases to maintain an account in the Coffee Freaks Application.

Analytical and statistical data collected using Google Analytics will be processed for a maximum period of 24 months.

Where required by the Data Controller’s legitimate interest, including the establishment, exercise, or defence of legal claims, or where necessary to comply with a legal obligation, processing of the relevant personal data may be restricted and the data retained for the period necessary to satisfy such legitimate interest or legal obligation.

c. Blog
Personal data originating from the Blog (email address, contact form message, and name provided in the contact form) shall be retained:

• in the case of newsletter subscription — until the User cancels the subscription by expressing such intention by email, or until the newsletter service is discontinued. The data shall be deleted or anonymised within 30 days of cancellation of the subscription or discontinuation of the newsletter service;
• in the case of use of the contact form — for the period necessary to provide a response, but no longer than 24 months from the date of the User’s last message.

Analytical and statistical data collected using Google Analytics will be processed for a maximum period of 24 months.

Where required by the Data Controller’s legitimate interest, including the establishment, exercise, or defence of legal claims, or where necessary to comply with a legal obligation, processing of the relevant personal data may be restricted and the data retained for the period necessary to satisfy such legitimate interest or legal obligation.

d. Application Promotional Website
Personal data originating from the Application Promotional Website (email address, contact form message, and name provided in the contact form) shall be retained:

• in the case of joining the waiting list — until the User cancels the subscription by expressing such intention by email, or until the waiting-list service is discontinued. The data shall be deleted or anonymised within 30 days of cancellation of the subscription or discontinuation of the waiting-list service;
• in the case of use of the contact form — for the period necessary to provide a response, but no longer than 24 months from the date of the User’s last message.

Analytical and statistical data collected using Google Analytics will be processed for a maximum period of 24 months.

Where required by the Data Controller’s legitimate interest, including the establishment, exercise, or defence of legal claims, or where necessary to comply with a legal obligation, processing of the relevant personal data may be restricted and the data retained for the period necessary to satisfy such legitimate interest or legal obligation.

5. Disclosure of Data

Aggregated information concerning Users, in particular information regarding how the Application is used, may be disclosed to:

• entities affiliated with or cooperating with the Data Controller, in anonymised form and for analytical and statistical purposes;
• entities providing and operating selected IT systems and solutions, including Google Analytics and Campaign Lark.

Where required by the Data Controller’s legitimate interest, including the establishment, exercise, or defence of legal claims, or where necessary to comply with a legal obligation, Users’ personal data may be disclosed to law firms or competent public authorities.

Google LLC / Google Ireland Limited processes personal data as a data processor under the Google Ads Data Processing Terms, which contain provisions compliant with Article 28 GDPR. Where data is transferred outside the European Economic Area, Google relies on Standard Contractual Clauses approved by the European Commission and/or other approved data transfer mechanisms (e.g. the EU-U.S. Data Privacy Framework).

Campaign Lark (Maileroo Group Pty Ltd) processes personal data as a data processor under a Data Processing Addendum concluded with the Controller, in accordance with Article 28 GDPR. Data may be processed on servers located in Germany, the Netherlands, and Finland. Where data is transferred outside the European Economic Area, Campaign Lark relies on the Standard Contractual Clauses approved by European Commission Implementing Decision 2021/914 (Module Two: Controller to Processor).

Google Privacy Policy:

• How Google uses information from sites or apps that use their services
• Google Privacy Policy
• Data Processing Terms

Campaign Lark Privacy Policy:

• GDPR Compliance
• Privacy Policy
• DPA

The Coffee Freaks Application and related services, including the Blog and the Application Promotional Website use infrastructure located within the European Union (Germany).

Users’ personal data is not used for decision-making based solely on automated processing, including profiling, which produces legal effects concerning the User or similarly significantly affects the User.

6. Rights of Data Subjects

The User has the right to:

• obtain access to their personal data;
• request rectification of their personal data;
• request erasure of their personal data;
• request restriction of processing of their personal data;
• request portability of their personal data;
• object to the processing of their personal data;
• withdraw consent at any time.

The exercise of the above rights shall not affect the lawfulness of processing carried out on the basis of the User’s consent before such consent was withdrawn.

The User also has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) where the User considers that the processing of their personal data infringes their rights or freedoms.

Any request concerning a change in the manner of processing or cessation of processing of personal data, including a request for erasure, may be submitted by the User by email to contact@coffeefreaks.eu.

The exercise of individual rights may be subject to limitations arising from the GDPR and other applicable laws.

7. Account Deletion and Subscription Cancellation

a. Account Deletion
The User may delete their account directly within the Application by entering the account settings and clicking the "Delete account" button. Data deletion shall be processed subject to the provisions set out in Section 4(b) of this Privacy Policy.

b. Subscription Cancellation
A User who has subscribed to the newsletter or joined the waiting list for access to the Application may unsubscribe at any time by clicking the "Unsubscribe" link in the footer of the email. Depending on the service from which the User wishes to unsubscribe, the User’s request shall be processed subject to the provisions set out in Section 4(c) or 4(d) of this Privacy Policy.

8. Minors

The Application, Blog and the Application Promotional Website are intended for persons who have read and accepted the Terms and Conditions.

Persons under 16 years of age may use the Application, Blog and the Application Promotional Website only with the consent of a parent or legal guardian who has read and accepted the Terms and Conditions and this Privacy Policy.

9. Security

The Data Controller makes every reasonable effort to ensure that Users’ data is appropriately protected against unauthorised access, loss, alteration, or disclosure. For this purpose, appropriate technical and organisational measures are implemented, including encrypted connections, access restrictions based on the principle of least privilege, ongoing monitoring, and periodic security assessments of the services and providers used.

10. Cookie Policy

a. General Provisions
Cookies are used exclusively on Coffee Freaks websites, namely the Blog and the Application Promotional Website. Cookies are not used in the Coffee Freaks mobile Application.

b. Legal Basis
The use of cookies is based on the User’s consent pursuant to Article 6(1)(a) GDPR.

c. Technologies Used
Google Analytics.

d. Granting, Refusing, or Withdrawing Consent
To consent to the use of cookies, click the “Accept All” button on the banner displayed at the bottom of the website. Clicking this button constitutes consent to the collection of all cookies.

To refuse the use of cookies, click the “No, Thank You” button on the banner displayed at the bottom of the website. Clicking this button means that no analytical or marketing cookies will be collected, but this does not prevent the use of cookies necessary for the site to function.

To withdraw previously granted consent, click the “Cookie Settings” link displayed in the website footer and then click the “No, Thank You” button on the banner. Alternatively, the User may clear the website’s stored data, which will cause the cookie consent banner to appear again.

Withdrawal of consent shall not affect the lawfulness of the processing of cookies carried out before such withdrawal.

e. Retention Period
Depending on their type and settings, cookies are stored:

• until they are deleted by the User by clearing the website’s stored data;
• until the browser window is closed;
• for up to 24 months in the case of other cookies.

f. Data Transfers
Data collected through cookies may be processed outside the European Economic Area, including in the United States, due to the use of Google Analytics.

11. Final Provisions

The Data Controller reserves the right to amend this Privacy Policy.
Users shall be informed of material changes through the “Notice board” section of the Application, Blog and/or by email.