Privacy policy & Cookies
Privacy Policy & Cookies
How CoffeeBI collects, uses and protects your personal data, in line with the EU General Data Protection Regulation (GDPR) and the guidance of the Italian Garante per la protezione dei dati personali.
1. Data Controller
The Data Controller of personal data processed through the coffeebi.com website is:
CoffeeBI is a brand of EuroEuro s.r.l., an independent consulting firm specialising in business intelligence and analytics for the coffee industry.
EU Representative (if required): Marcello Peluso ([email protected]).
The website primarily targets users located in the European Economic Area and processes personal data in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable national data protection laws.
2. Categories of personal data processed
Data provided directly by the user
When using CoffeeBI’s services, you may voluntarily provide certain personal data, including:
- Identification and contact data: first name, last name, e-mail address, company, job title, country, phone number and similar details, depending on the forms you fill in.
- Professional data: industry, company type, content preferences and business interests related to the coffee sector.
- Billing and payment data (if you purchase reports, services or subscriptions): billing address, VAT number, and payment data processed by third-party payment providers (Stripe, PayPal).
- Content of communications: messages sent via contact forms, commercial requests, partnership proposals, support requests, comments and any other information you decide to share.
Providing some data may be necessary to deliver the requested services; if you do not provide such data, CoffeeBI may not be able to fulfil your request.
Data collected automatically while browsing
While you browse coffeebi.com, certain technical and usage data are collected automatically, including:
- IP address.
- Information about your browser and device (user agent, operating system, screen resolution, language, etc.).
- Log data: visited pages, date and time of access, time spent on pages, referring URL (referrer) and interactions with the website.
- Information related to cookie consent and tracking preferences, managed via our own cookie consent tool.
These data are mainly collected through cookies and similar technologies, as described in the Cookies section below.
3. Purposes and legal bases of processing
Personal data are processed for the following purposes and legal bases:
Provision of website services
To enable navigation on the website, access to content, download of materials, registration to events, creation of accounts (if available), and use of CoffeeBI’s business intelligence and market insights services for the coffee industry.
Legal basis: performance of a contract or pre-contractual measures — Article 6(1)(b) GDPR.
Handling contact and support requests
To respond to information requests, quotes, collaborations, partnerships, media enquiries and support questions sent via contact forms or other channels.
Legal basis: pre-contractual measures and/or the Controller’s legitimate interest in managing communications — Article 6(1)(b) and 6(1)(f) GDPR.
Newsletter, informational and marketing communications
To send newsletters, reports, market updates, event invitations, webinars, offers and editorial content related to CoffeeBI and the coffee industry.
Legal basis: your consent — Article 6(1)(a) GDPR, given via subscription forms or the consent banner, withdrawable at any time (e.g. via the “unsubscribe” link in every e-mail).
Customer, partner and contract management
To manage customers, business partners and suppliers, including orders, subscriptions, access to premium content, invoicing, accounting and compliance with tax and regulatory obligations.
Legal basis: performance of a contract and legal obligations — Article 6(1)(b) and 6(1)(c) GDPR.
Analytics and website improvement
To measure traffic, understand how the website is used and improve content, performance, usability and the service offering. The analytics tool currently used on this website is Google Analytics 4 (GA4), which is only activated after you give consent.
Legal basis: your consent, given via the cookie banner — Article 6(1)(a) GDPR.
Website security and prevention of abuse
To prevent fraudulent activities, unauthorized access, spam and cyber-attacks, by means of system logs, firewalls, anti-spam systems and other security tools.
Legal basis: the Controller’s legitimate interest in network and information security — Article 6(1)(f) GDPR.
Compliance with legal obligations and legal defence
To comply with legal obligations and requests from public authorities, and to establish, exercise or defend legal claims in or out of court.
Legal basis: legal obligation and legitimate interest — Article 6(1)(c) and 6(1)(f) GDPR.
5. Methods of processing and security measures
Personal data are processed using electronic and/or telematic tools, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation and integrity.
The Controller implements appropriate technical and organisational measures to protect personal data, including for example:
- Server and CMS security configurations, periodic updates and backups.
- Access control procedures and management of user credentials.
- Pseudonymisation or anonymisation of data for statistics and reporting purposes, where possible.
6. Recipients and categories of third parties
Personal data may be disclosed to third parties acting as Data Processors (Article 28 GDPR) or as independent data controllers, including:
- Hosting and IT infrastructure providers: service providers hosting the coffeebi.com website and related databases (Aruba, Italy).
- Newsletter and e-mail marketing providers: platforms that manage mailing lists and send e-mail communications (Mailchimp).
- Analytics and tracking providers: Google Analytics, configured according to the privacy settings adopted.
- Payment service providers: Stripe, PayPal, which process payment data as independent controllers or processors, according to their own terms.
- Professional advisors: law firms, tax and accounting consultants, and other professionals assisting CoffeeBI with legal, administrative and tax obligations.
- Affiliated companies or business partners: in the context of joint research projects or business initiatives in the coffee industry, limited to the purposes described and in compliance with the applicable legal bases.
An updated list of Data Processors can be requested from the Controller using the contact details provided above.
7. Transfers of personal data outside the EEA
Some service providers may be located or may process data outside the European Economic Area. In such cases, data transfers take place in compliance with Chapter V of the GDPR, i.e.:
- to countries for which the European Commission has issued an adequacy decision, or
- on the basis of Standard Contractual Clauses (SCCs) adopted by the European Commission, or
- on the basis of other appropriate safeguards.
Specific information on international transfers related to individual services (e.g. e-mail marketing, analytics or payment providers) is available in the privacy policies of those providers and can also be requested from the Controller.
8. Data retention periods
Personal data are retained only for as long as necessary to achieve the purposes for which they were collected, without prejudice to longer retention periods where required by law. In particular:
- Contact and enquiry data: retained for the time necessary to process the request and, in any case, no longer than 12 months from the last meaningful interaction.
- Newsletter and marketing data: retained until you withdraw consent or request deletion (unsubscribe), without prejudice to limited retention for compliance and proof of consent management.
- Contract and billing data: retained for the entire duration of the contractual relationship and for the statutory retention periods required under tax and civil law (typically up to 10 years).
- Browsing data and system logs: retained for periods compatible with security and operational needs, usually no longer than 12 months, unless longer retention is required by law.
After the retention periods have expired, personal data will be deleted, anonymised or aggregated so that individuals can no longer be identified.
9. Data subject rights
Under the GDPR, you have the following rights:
To exercise your rights, contact the Controller at [email protected] or by post at EuroEuro s.r.l. – CoffeeBI brand, Via Messina 47, 20154, Milan, Italy.
You also have the right to lodge a complaint with the competent Supervisory Authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. In Italy, the Supervisory Authority is the Garante per la protezione dei dati personali.
10. Children’s data
CoffeeBI’s services are not intentionally directed to children under 18 years of age.
If the Controller becomes aware that personal data of children have been collected without verifiable parental consent, reasonable steps will be taken to delete such information as soon as possible.
11. Links to third-party websites
The coffeebi.com website may contain links to third-party websites, content or services (for example, partners’ websites, payment platforms, social networks, event registration tools or external marketplaces).
These websites are operated independently by third parties and are governed by their own privacy policies, which you are encouraged to review. The Controller is not responsible for how such external websites handle personal data.
12. Changes to this Privacy Policy
The Controller reserves the right to modify this Privacy Policy at any time, for example to reflect changes in the law, in the services offered or in technical developments.
Changes will be published on this page and, where appropriate, may be notified by a specific notice (for example, via a banner, a notice on the website or an e-mail communication, when technically and legally feasible).