Privacy and cookies

Data controller

Emka Coffee Group, S.L., Tax ID B67734806, calle Bahía de Palma 9, ático A, 28042 Madrid, Spain. Contact: info@emkacoffee.com · +34 658 371 547.

What data we process, why, and on what basis

• User account (first name, surname, email, phone, hashed password, IP address and the browser or app used to register). Purpose: creating and managing your account and evidencing acceptance of the terms. Basis: performance of the contract.
• Orders and deliveries (products, amounts, shipping address and billing details). Purpose: preparing, shipping and invoicing your order and handling returns. Basis: performance of the contract and compliance with legal obligations.
• Payments (transaction reference and, if you authorise it, the alias, last four digits, brand, expiry date and an opaque card identifier). Purpose: charging your order and, where applicable, subscription or membership renewals. Basis: performance of the contract.
• Subscriptions and membership (plan, configuration, periods and charges). Purpose: providing the contracted service. Basis: performance of the contract.
• Loyalty programme (stamps collected, coffees covered by the membership and the related servings in our coffee shops, and the code you identify yourself with). Purpose: applying programme benefits and preventing misuse. Basis: performance of the contract.
• Marketing communications (email and, in the app, notifications). Purpose: telling you about news and promotions. Basis: your consent, which you can withdraw at any time.
• Enquiries and contact (the data you give us when writing to us). Purpose: handling your request. Basis: your consent or performance of the contract.

Location in the app

If you view the coffee shop map and grant permission, the app uses your device location solely to show you the nearest ones. We do not store your location or use it for any other purpose, and you can revoke the permission in your device settings.

Automated decisions

We do not take automated decisions that produce legal effects concerning you or similarly significantly affect you.

Retention

We keep account data for as long as the account remains active. If you delete it, we erase your personal identifiers and keep only the records linked to orders and invoicing for the periods required by accounting, tax and consumer law. Loyalty programme consumption data is kept while the programme remains active for your account.

Security

Communications are encrypted and passwords are never stored in plain text. Your full card details are handled directly by the payment institution, certified under the PCI-DSS standard; Emka Coffee neither receives nor stores them.

Recipients

We do not sell or disclose your data for advertising purposes. Only the providers strictly necessary to deliver the service have access to it, acting as processors on our behalf and under contract: logistics and transport, payment institutions, communications delivery, invoicing and systems hosting. We also disclose any data required by law to the competent public authorities.

Data is hosted within the European Union, with no international transfers outside the European Economic Area.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent free of charge by writing to info@emkacoffee.com. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Cookies

We use only strictly necessary technical cookies: keeping you signed in, preserving your basket and remembering your language preference. These cookies do not require prior consent and are not used for profiling or advertising.

We do not use analytics or third-party cookies. Should we introduce them in future, we would ask for your consent through a notice before installing them.