PRIVACY POLICY
Last updated: 7 August 2026
1. Data controller
In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights, the user is informed that the controller of their personal data is:
Controller: COFFEE TIME 2019 S.L.
Trade name: COFFITALIA
Tax ID (NIF): B22565618
Registered address: C/ Acequia del Real 2, Bl. 7, 2.º A, 29651 Mijas (Málaga), España
Email: info@coffitalia.es
Telephone: +34 644 735 927
Enquiries relating to privacy, data protection or the exercise of data rights may be sent directly to COFFEE TIME 2019 S.L. at the email address given above.
2. Personal data we may process
Depending on the relationship with the user, COFFITALIA may process the following categories of data:
- Identification data, such as first name and surname.
- Contact data, such as postal address, email address and telephone number.
- Professional or business data, such as company, establishment, job title, and NIF or CIF where necessary.
- Billing and delivery data.
- Information relating to orders, products purchased, returns and incidents.
- Data needed to manage user accounts.
- Information provided through contact forms, commercial requests or enquiries.
- Information arising from communications made by email, telephone, WhatsApp or other channels made available by COFFITALIA.
- Technical and browsing data, such as IP address, device, browser and browsing behaviour, where applicable and in accordance with the Cookie Policy.
COFFITALIA does not need to know or store full bank card details when payment is processed through an external payment institution or gateway.
3. Purposes of processing
3.1. Handling enquiries and requests for information
To respond to enquiries made through forms, email, telephone, WhatsApp or other contact channels.
3.2. Preparing and following up commercial proposals
To handle requests for commercial information, quotes or proposals relating to products and services for the hospitality industry, restaurants, hotels, offices, companies or distributors.
3.3. Managing orders and the contractual relationship
To manage purchases made through the online shop, including order processing, payment, invoicing, preparation, delivery, after-sales service, returns, incidents and compliance with contractual obligations.
3.4. Managing professional customers
To manage the commercial relationship with establishments, companies, professionals, distributors and customers in the HORECA channel.
3.5. Creating and maintaining user accounts
To manage registration, access and the features associated with accounts created on the website.
3.6. Commercial communications
To send commercial information, news, products, promotions or content relating to COFFITALIA where the data subject has given their consent or another legal basis permits it.
The data subject may object or withdraw their consent at any time.
3.7. Security and fraud prevention
To prevent fraudulent use, unauthorised access, security incidents and actions contrary to the website’s terms of use.
3.8. Compliance with legal obligations
To comply with accounting, tax, commercial, consumer, data protection and any other legal obligations applicable to COFFITALIA.
3.9. Website analysis and improvement
To analyse how the website works and is used and to improve the user experience where there is an appropriate legal basis and, where necessary, the user’s consent to the relevant cookies or technologies has been obtained beforehand.
4. Legal bases for processing
- Performance of a contract or application of pre-contractual measures: to manage orders, quotes, commercial requests and the relationship with customers.
- Consent of the data subject: for certain commercial communications, forms and the use of non-essential cookies.
- Compliance with legal obligations: in particular tax, accounting, commercial and consumer obligations.
- Legitimate interest: to protect our systems, prevent fraud, handle certain commercial relationships or carry out reasonable customer management and follow-up activities, provided that the rights and freedoms of data subjects do not override it.
5. Mandatory nature of the data
The fields marked as mandatory in the forms are required in order to handle the corresponding request or service.
If the user does not provide the necessary information, COFFITALIA may be unable to handle the request, complete a purchase, issue an invoice or provide the service requested.
6. Recipients of the data
Personal data will not be sold to third parties.
Where necessary to provide the service, COFFITALIA may disclose certain data to:
- Transport, courier and logistics companies, to manage deliveries and returns.
- Financial institutions and payment service providers.
- Providers of web hosting, email, maintenance, web development, CRM and other technology services.
- Providers of analytics, advertising and marketing services, where there is a corresponding legal basis or consent.
- Tax, accounting, employment, legal or administrative advisers.
- Public authorities, courts, tribunals, law enforcement agencies or other bodies where there is a legal obligation.
Where a provider processes personal data on behalf of COFFITALIA, it will be considered a data processor and will be subject to the corresponding contractual and legal obligations.
7. International data transfers
As a general rule, COFFITALIA will seek to use providers that process data within the European Economic Area.
However, certain technology providers may carry out processing from countries outside the European Economic Area.
Where an international data transfer takes place, COFFITALIA will adopt the safeguards provided for by the GDPR, such as European Commission adequacy decisions, standard contractual clauses or other legally recognised mechanisms.
8. Retention periods
Personal data will be kept only for as long as necessary to fulfil the purpose for which it was collected.
- Data relating to orders and customers will be kept for as long as a contractual relationship exists and afterwards for the legally required periods.
- Data needed for tax, accounting and commercial obligations will be kept for the periods set by the applicable regulations.
- Requests for information will be kept for as long as necessary to handle them and follow them up.
- Data used for commercial communications will be kept until the data subject withdraws their consent or exercises their right to object.
- Data associated with a user account will be kept for as long as the account remains active and afterwards for the periods necessary to address possible legal liabilities.
When the data is no longer needed, it may remain duly blocked for the legal limitation periods before being permanently deleted.
9. Rights of data subjects
Data subjects may exercise, where applicable, the following rights:
- Right of access to their personal data.
- Right to rectification of inaccurate or incomplete data.
- Right to erasure.
- Right to object to processing.
- Right to request restriction of processing.
- Right to data portability.
- Right to withdraw consent at any time, without affecting the lawfulness of the processing carried out beforehand.
- Right not to be subject to decisions based solely on automated processing where the legally established requirements are met.
To exercise these rights, the data subject may contact:
The request must allow the data subject to be properly identified and specify the right they wish to exercise. Where there are reasonable doubts about their identity, COFFITALIA may request the additional information needed to verify it.
10. Right to lodge a complaint
If the data subject considers that the processing of their personal data does not comply with the applicable regulations, they may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), without prejudice to any other administrative or judicial remedy to which they may be entitled.
11. Data of minors
COFFITALIA’s online shop and commercial services are not specifically aimed at minors.
People who make purchases must have sufficient legal capacity to enter into contracts. COFFITALIA may cancel registrations or orders where there are reasonable grounds to believe that they were made in breach of this requirement.
12. Information security
COFFITALIA will adopt the technical and organisational measures reasonably necessary to protect personal data against loss, alteration, unauthorised access, disclosure or unlawful processing, taking into account the nature of the data, the context and the risks associated with the processing.
13. Cookies
The use of cookies and similar technologies is governed by the website’s Cookie Policy.
Cookies that are not strictly necessary for the operation of the website will only be used where there is a corresponding legal basis and, where required, after obtaining the user’s consent.
14. Automated decisions and profiling
COFFITALIA does not plan to make decisions that produce legal effects or significantly affect the user based solely on automated processing of their personal data, unless this is expressly notified and there is a legal basis permitting it.
15. Changes to the Privacy Policy
COFFITALIA may amend this Privacy Policy where necessary to adapt it to legislative changes, criteria of the supervisory authorities, changes to the processing carried out or changes to the services offered.
The current version will be the one published on this website at any given time.