Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
Privacy Policy
Last updated: [6.08.26]
This privacy policy explains how Cafetoria Roastery Oy processes personal data when you visit cafetorias.pro, shop with us online or in our coffee locations, subscribe to our newsletter or contact us. We process personal data in line with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.
1. Who is responsible for your data
The controller of your personal data is:
Cafetoria Roastery Oy Business ID: [1234567-8] Runeberginkatu 31, 00100 Helsinki, Finland. Email: info@cafetorias.pro. Phone: [+358 104235570]
For any question about your personal data or to use your rights, contact us at info@cafetorias.pro.
2. What data we collect and why
We only collect the data we need for the purposes below. Most of it you give us yourself when you order, sign up or contact us.
Purpose | Data | Legal basis (GDPR) |
Processing and delivering your orders, including gift orders and store pickup | Name, address, email, phone, order details, delivery address of a gift recipient, payment status (we never see full card details) | Performance of a contract (Art. 6(1)(b)) |
Customer account (if you create one) | Login details, order history, saved addresses | Performance of a contract (Art. 6(1)(b)) |
Accounting and tax | Invoices, receipts and payment records | Legal obligation (Art. 6(1)(c)) |
Customer service and corporate gift enquiries | Your messages and contact details | Legitimate interest in answering you (Art. 6(1)(f)), or steps before a contract (Art. 6(1)(b)) |
Newsletter | Email address, name, newsletter preferences | Consent (Art. 6(1)(a)); you can unsubscribe at any time |
Product reviews and prize draws | Name, review text, contact details of winners | Consent (Art. 6(1)(a)) |
Website analytics and advertising | Cookie IDs, pages visited, device and browser data, approximate location, purchases made after an ad click | Consent (Art. 6(1)(a)), given in our cookie banner |
Website security and operation | IP address, technical logs | Legitimate interest in keeping the site secure (Art. 6(1)(f)) |
You don’t have to give us your data, but we can’t deliver an order without your name and address.
3. Cookies, analytics and advertising
We use necessary cookies to run the shop, such as the shopping cart and login. We use analytics and marketing cookies only if you accept them in our cookie banner. You can change or withdraw your choice at any time through the cookie settings link at the bottom of every page.
With your consent we use:
If you decline, Google may still receive limited, cookieless signals without identifiers to measure ad performance in aggregate (Google Consent Mode).
Full details of each cookie, its purpose and duration are in our Cookie Policy.
4. Who we share your data with
We never sell your personal data. We share it only with service providers who help us run the business, and only as much as they need. They process it on our behalf under a data processing agreement, or as independent controllers where stated.
Recipient | What for | Where |
[Payment provider, e.g. Paytrail / Stripe / Klarna] | Processing payments | [EU] |
[Delivery partner, e.g. Posti / Matkahuolto / DHL] | Delivering parcels | Finland / EU |
[Web hosting provider] | Hosting our website and shop | [EU] |
Mailchimp (Intuit Inc.) | Sending our newsletter | USA |
Google (Google Ireland Ltd / Google LLC) | Analytics and advertising, with your consent | EU / USA |
Meta (Meta Platforms Ireland Ltd) | Advertising, with your consent | EU / USA |
[Accounting firm] | Bookkeeping and tax | Finland |
Authorities | When the law requires it | Finland |
Transfers outside the EU. Some providers (Mailchimp, Google, Meta) may process data in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses.
5. How long we keep your data
We keep personal data only as long as needed for the purpose, or as long as the law requires.
Data | How long |
Order data needed for accounting (receipts, invoices) | 6 years from the end of the financial year, as required by the Finnish Accounting Act |
Other order and customer service data | [2] years after your last order or message, unless needed longer for a complaint or legal claim |
Customer account | Until you delete it, or after [3] years of inactivity |
Newsletter subscription | Until you unsubscribe |
Analytics and advertising data | As set in the Cookie Policy; Google Analytics data is kept for [14] months |
Reviews | As long as the review is published, or until you ask us to remove it |
6. Your rights
Under the GDPR you have the right to:
To use your rights, email info@cafetorias.pro. We answer within one month.
If you think we process your data unlawfully, you can complain to the Finnish supervisory authority, the Office of the Data Protection Ombudsman (tietosuoja.fi).
7. Security
Our website uses an encrypted (HTTPS) connection. Access to customer data is limited to staff who need it, and our service providers are bound to keep it secure. Payments are handled by our payment provider; we never store card details.
8. Changes to this policy
We may update this policy when our services or the law change. The latest version is always on this page, with its update date at the top.
Sources used for this template
