YOUR PRIVACY – CLEAR AND CAREFUL

When you browse, order or contact us, you may entrust us with personal data. We handle those data with care. We use only what we need, never sell your data and do not track you for advertising. This policy calmly explains what we process, why we do so and which choices you have.

1. Who is responsible for your data?

Caffelato, trading as Adesso Espresso, is the data controller.

Address: Spuistraat 94H Postcode and city: 1012TZ Amsterdam Dutch Chamber of Commerce number: 42120910 VAT identification number: NL869822469B01 Email for privacy matters: privacy@b1901.com

2. Which data may we use?

Depending on your interaction with us, we may process:

• your name, address, city, country, email address and telephone number;
• billing, delivery and payment details and payment status;
• orders, returns, preferences and purchase history;
• account details and secure session data;
• machine model and serial number and information about installation, use and maintenance;
• messages, complaints, repair requests, photographs and videos you provide;
• registrations for courses, appointments or events;
• newsletter preferences and evidence of consent;
• IP address, date and time, browser, device type and technical security logs;
• language, screen and device information needed to display the correct website version.

We do not use technical device or browser data to fingerprint visitors or track them for advertising.

If you use the showroom visit form, we store your name, email address, number of visitors and any preferred date or time, machine interest and message you provide, together with your chosen language and submission time. These requests are stored in a private flatfile on our own server, separate from technical page logs, so the owner can respond and arrange your visit. We do not store an IP address or cookie identifier with your request. Sending the form does not automatically book an appointment or subscribe you to marketing. The data are not used for analytics. The retention period for general correspondence below also applies to visit requests.

When a page is visited, our own server records the IP address, UTC date and time, language, desktop or phone version, requested page, response status, browser identification and the origin of the referring website. Only the page category and machine ID are retained from URL parameters. Passwords, login session cookies and other URL parameter values are not included. These private records help us check website operation and investigate misuse; only authorised administrators can view them. We use no external analytics service.

We do not create visitor identification cookies or combine page views into histories per visitor. We do not look up visitors’ locations or measure time spent on pages. Previously collected log records remain subject to the 180-day retention period.

On the current PC website, the first-party cookie adesso_preferences stores your language, machine filters and sorting preference. It contains display preferences only, not an account, payment or advertising identifier. More information is available in our Cookie Policy.

If you save favourite machines, their IDs and an expiry date are stored in this browser under adesso_favourites using first-party local storage (localStorage). This list is not synchronised with an account or other browsers and is not used for external analytics or advertising. You can remove favourites on the website or clear this website’s site data, including local storage, in your browser settings. Deleting cookies alone does not necessarily remove the list. If your browser blocks storage, the list is kept only for the current visit and a message tells you that the change could not be saved.

3. What do we use these data for?

We process personal data for the following purposes and on the stated legal bases:

• Orders, payment, delivery and returns: performance of a contract.
• Accounts, shopping carts and appointments: performance of a contract or steps taken before entering into a contract.
• Customer service, warranties, repairs and complaints: performance of a contract and compliance with legal obligations.
• Invoices and administration: compliance with tax and accounting obligations.
• Security, fraud prevention and prevention of misuse: our legitimate interest in protecting the website and transactions.
• Improving the operation and display of the website: our legitimate interest, using as little personal data as possible.
• Newsletters: your consent, which you may withdraw at any time.

If data are needed to perform a contract and you do not provide them, we may be unable to process your order, appointment or service request.

4. What do we expressly not do?

We do not sell personal data. We do not use external analytics software, advertising cookies, tracking cookies or profiles for personalised advertising.

5. With whom do we sometimes share data?

We share personal data only where necessary with:

• payment providers for processing and checking payments;
• carriers and delivery services for deliveries, returns and repair transport;
• hosting, email and IT service providers;
• our bookkeeper, accountant and other administrative service providers;
• Bezzera, Italexpert or a repair technician where necessary for technical support, warranty or repair;
• public authorities where disclosure is legally required.

These parties receive only the data needed for their task. Where required, we enter into a data processing agreement with parties that process personal data on our behalf.

6. Transfers outside the European Economic Area

Where possible, we select service providers within the European Economic Area. If personal data are processed outside the EEA, we ensure that a lawful transfer mechanism applies, such as an adequacy decision or Standard Contractual Clauses approved by the European Commission.

7. How long do we retain data?

We do not retain data longer than necessary:

• tax and accounting records: at least 7 years, or 10 years where the statutory OSS retention requirement applies;
• order data not required as part of the tax records: as long as needed for performance, warranty and potential claims;
• warranty, repair and complaint files: generally no more than 5 years after closure;
• general correspondence: generally no more than 2 years after the last contact;
• account data: while the account is active and for no more than 2 years afterwards, unless longer retention is required;
• newsletter data: until you unsubscribe; afterwards we may retain the minimum data needed to respect your opt-out;
• visitor and technical security logs: 180 days; older daily files are automatically removed during the next visit.
• anonymous shopping-cart and session data: no more than 30 days.
• display preferences in adesso_preferences: one year from the most recent save, unless you delete the cookie earlier.
• favourites in adesso_favourites: one year from the most recent change to your list, unless you clear it earlier. The expiry is checked when you visit, and an expired list is removed.

8. How do we protect your data?

We take appropriate technical and organisational measures, including encrypted connections, access restrictions, secure session cookies, updates and backups. No system is completely risk-free, but we restrict access to the people and organisations that need the data.

9. You remain in control

To the extent provided by the GDPR, you have the right to:

• access your personal data;
• have inaccurate data corrected;
• have data erased;
• restrict processing;
• object to processing;
• withdraw consent;
• receive your data in a portable format;
• lodge a complaint with the Dutch Data Protection Authority.

Send your request to privacy@b1901.com. We may request additional information to verify your identity. We generally respond within one month.

10. No important automated decisions

We do not make decisions with significant effects on you based solely on automated processing or profiling.

11. Links to other websites

Our website may link to third-party websites, such as those of a payment provider or carrier. Their own privacy policies apply to their processing of personal data.

12. Questions? Please contact us

We may update this policy when our services or the law changes. The current version and revision date will always be published on the website.

For privacy questions or complaints, contact privacy@b1901.com. You also have the right to complain to the Dutch Data Protection Authority at www.autoriteitpersoonsgegevens.nl.