Privacy and cookies

Controller

How we process data

Enquiries and orders. We process the name and contact details provided by the customer and information about the message, order and timing to handle the matter. Data is received by email, telephone or at the café; the website has no forms. Orders are based on a contract or requested pre-contractual steps (Article 6(1)(b) GDPR), other enquiries on legitimate interests (6(1)(f)).

Allergies and dietary needs. This information is used only to prepare the product. Processing information that reveals health data is based on explicit consent (Article 9(2)(a) GDPR).

Retention. Data is retained only while the matter and necessary communication are handled. Accounting records are processed under a legal obligation (6(1)(c)) and retained for the period required by law.

Website, service providers and cookies

Technical data. The hosting service and Cloudflare process data needed to deliver and protect the website, such as the IP address, requested page and request time, based on legitimate interests. Security logs are retained only for the services’ necessary retention periods.

Recipients and transfers. Google/Gmail processes emails. Google, the hosting service and Cloudflare may process data outside the EEA under an adequacy decision, the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

Cookies and external links. The website has no analytics, advertising pixels or marketing tracking. Cloudflare may use the strictly necessary __cf_bm security cookie, which expires after approximately 30 minutes of inactivity; no cookie banner is required. Map, Oiva and social media services load only when a link is opened.