Last updated: [DD MONTH YYYY]
Effective date: [DD MONTH YYYY]
Roast a Bean (hereinafter, “Roast a Bean”, “we”, “us” or “our”) is committed to protecting the privacy and personal data of individuals who visit our website, purchase our products or contact us.
This Privacy Policy explains what personal data we collect, why we process it, how we protect it and what rights you have regarding your personal data.
The data controller responsible for your personal data is:
Legal name: [COMPANY LEGAL NAME, S.L.]
Tax ID (NIF/CIF): [CIF NUMBER]
Registered address: [STREET, POSTAL CODE, CITY, SPAIN]
Email: [privacy@roastabean.com]
Phone: [+34 XXX XXX XXX]
Data Protection Officer (DPO): [DPO name / email — or “Not appointed”, if not applicable]
The appointment of a Data Protection Officer is only required where the circumstances set out in Article 37 of the General Data Protection Regulation (GDPR) apply.
Depending on how you interact with us, we may collect the following categories of personal data:
Identification and contact data: first name, surname, email address, postal address and telephone number.
Order and billing data: products purchased, order history, billing and shipping address and tax identification information where legally required.
Payment data: payments are processed securely by our payment service providers. We do not store full payment card numbers on our servers.
Account data: username and password when you create an account on our website. Passwords are stored securely.
Commercial and marketing data: subscription preferences, consent records and interactions with our newsletters and commercial communications.
Professional or B2B data: when you request a quotation or contact our sales team, for example for services intended for hospitality businesses, retailers or other professional customers, we may process the professional information you provide.
Technical and navigation data: IP address, device type, browser used and information relating to your use of our website, including information collected through cookies and similar technologies. For more information, please see our Cookie Policy.
We do not intentionally collect special categories of personal data, such as information relating to health, religion or political opinions. Please do not provide this type of information through our website.
In accordance with Article 6 of the GDPR, we will only process your personal data where there is a valid legal basis allowing us to do so.
We process your data to process your orders, manage payments, arrange deliveries and maintain our contractual relationship with you.
Legal basis: performance of a contract (Article 6.1.b GDPR).
We process your data to issue invoices and comply with our tax, accounting, commercial and consumer protection obligations.
Legal basis: compliance with a legal obligation (Article 6.1.c GDPR).
We may send you newsletters and commercial communications about our products where you have provided your consent.
In certain circumstances, we may send commercial communications to existing customers regarding similar products, in accordance with applicable legislation.
Legal basis: consent (Article 6.1.a GDPR) and, where applicable, legitimate interest in relation to existing customers.
We process your data to respond to enquiries, requests for information and quotations, including those relating to B2B services.
Legal basis: consent and/or taking steps prior to entering into a contract at the request of the data subject (Articles 6.1.a and 6.1.b GDPR).
We may process certain technical and navigation data to ensure the security of our website, prevent fraudulent activity, improve our services and analyse website performance.
Legal basis: legitimate interest (Article 6.1.f GDPR) and, where applicable, consent for the use of non-essential cookies.
We process the information necessary to manage returns, complaints and warranty-related requests.
Legal basis: performance of a contract and compliance with legal obligations.
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal obligations.
Customer and order data: for the duration of the contractual relationship and, afterwards, for the periods required by Spanish tax, accounting and commercial legislation, which may be up to [6 years], depending on the type of documentation.
Marketing data: until you withdraw your consent or object to the processing, as applicable.
Enquiry and contact data: for as long as necessary to handle your request and for a reasonable period thereafter.
Once the applicable retention periods have expired, the data will be securely deleted or, where appropriate, anonymised.
We do not sell your personal data.
We may share your data with service providers and third parties who provide services on our behalf and act as data processors, where necessary to provide our services and always in accordance with applicable legislation.
These third parties may include:
Shipping and logistics companies to deliver orders.
Payment service providers to process transactions.
Web hosting, IT and e-commerce platform providers.
Email and marketing service providers.
Professional advisors, such as accountants, tax advisors or lawyers.
Public authorities and tax authorities where legally required.
Where applicable, we will enter into the data processing agreements required under Article 28 of the GDPR with our service providers.
Roast a Bean sources green coffee from Colombia and carries out the roasting process in Spain. Our customer base is primarily located within the European Union.
As a general rule, we seek to ensure that personal data is processed within the European Economic Area (EEA).
Where any of our service providers process personal data outside the EEA, we will implement the safeguards required by applicable data protection legislation. These may include an adequacy decision adopted by the European Commission or the use of the Standard Contractual Clauses approved by the European Union.
Where necessary, certain data may also be shared with partners or service providers located in Colombia in connection with our sourcing operations. Appropriate safeguards under Chapter V of the GDPR will apply to such transfers.
You may request additional information about the safeguards applicable to international transfers by contacting us using the details provided in this Privacy Policy.
Under the GDPR and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), you may exercise the following rights:
Right of access: to know what personal data we process about you.
Right to rectification: to request the correction of inaccurate or incomplete personal data.
Right to erasure: to request the deletion of your personal data where the legal requirements for doing so are met.
Right to restriction of processing: to request that the processing of your data be restricted in certain circumstances.
Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format, or to request its transmission to another controller where technically feasible.
Right to object: to object to certain processing activities based on legitimate interest, including processing for direct marketing purposes.
Right to withdraw consent: to withdraw your consent at any time where processing is based on consent.
You may exercise these rights free of charge by sending a request to:
We may request additional information to verify your identity where necessary to protect your personal data.
We will respond to your request within the time limits established by applicable legislation, normally within one month.
If you believe that your data protection rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) through its website:
You may also contact the relevant data protection supervisory authority in your country of residence or in the country where the alleged infringement occurred.
Roast a Bean applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, destruction or unlawful disclosure, in accordance with Article 32 of the GDPR.
These measures may include access controls, security measures for the transmission and storage of information, and regular reviews of our security practices.
Our website and products are intended for adults.
We do not knowingly collect personal data from children under the age of 14 without the appropriate safeguards and authorisations required under applicable Spanish legislation.
If you believe that a minor has provided us with personal data without the appropriate authorisation, please contact us so that we can request its deletion.
Our website uses cookies and similar technologies.
Detailed information about the cookies we use, their purposes and how you can manage or withdraw your consent is available in our Cookie Policy.
[LINK TO COOKIE POLICY]
We may update this Privacy Policy from time to time to reflect changes in our activities, services, technologies used or legal requirements.
The current version will always be available on our website and will indicate the date on which it was last updated.
We recommend reviewing this policy periodically to stay informed about any changes.
If you have any questions about this Privacy Policy, how we process your personal data or how to exercise your rights, you can contact us:
[COMPANY LEGAL NAME, S.L.]
Registered address: [STREET, POSTAL CODE, CITY, SPAIN]
Email: [privacy@roastabean.com]
Phone: [+34 XXX XXX XXX]
Last updated: [DD MONTH YYYY]