GDPR Compliance Information

Overview

This page provides information about how we comply with the General Data Protection Regulation (GDPR), which protects the privacy rights of individuals in the European Union and European Economic Area.

Data Controller

The data controller responsible for your personal information is:

Alpen Bohnen Coffee Roasters
Getreidegasse 47
5020 Salzburg
Austria
Email: [email protected]

Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

Right to Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate personal data and completion of incomplete data.

Right to Erasure

Under certain circumstances, you have the right to request deletion of your personal data, including when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent on which processing is based
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restriction of Processing

You can request that we limit the processing of your personal data when:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification of legitimate grounds

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object

You can object at any time to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, particularly in the EU member state where you reside, work, or where an alleged infringement occurred.

Legal Basis for Processing

We process your personal data only when we have a valid legal basis, including:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary for a contract we have with you or to take steps at your request before entering into a contract
• Legal obligation: Processing is necessary to comply with the law
• Legitimate interests: Processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests

Data We Collect

We collect and process the following categories of personal data:

• Identity data: name, title
• Contact data: email address, postal address
• Transaction data: details about services you have requested or purchased
• Technical data: IP address, browser type, device information
• Usage data: information about how you use our website
• Marketing data: your preferences regarding marketing communications

How We Protect Your Data

We implement appropriate technical and organizational security measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Access controls limiting who can view and process data
• Regular security assessments and updates
• Staff training on data protection and security
• Incident response procedures for data breaches

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Customer inquiry data: retained for 2 years after last contact
• Order and transaction data: retained for 7 years for accounting and tax purposes
• Marketing consent: retained until consent is withdrawn
• Technical logs: retained for 90 days

International Data Transfers

When we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Transfers to countries with adequacy decisions
• Other legally approved transfer mechanisms

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at:

Email: [email protected]
Subject line: GDPR Rights Request

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of the extension.

We may need to verify your identity before processing your request. We will not charge a fee unless your request is clearly unfounded, repetitive, or excessive.

Supervisory Authority

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Austrian Data Protection Authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Vienna
Austria
Phone: +43 1 52 152-0
Email: [email protected]

Updates to This Information

We may update this GDPR compliance information from time to time to reflect changes in our practices or legal requirements. Please check this page periodically for updates.