privacy

privacy policy noble roast online store · noble-roast.com version of 16.10.2026 1. general provisions 1.1. this policy explains what personal data we receive when you use noble-roast.com, place an order, create an account or contact us, why we need it, to whom and on what grounds we share it, and how you can control it. 1.2. the policy is drawn up in accordance with the law of ukraine «on personal data protection» no. 2297-VI and forms part of the public offer published at noble-roast.com/terms. 1.3. by using the site and providing your data, you confirm that you have read this policy. if you do not agree with it, please do not provide your data or use the site. 2. who is responsible for your data (data controller) 2.1. the «data controller» is the person who decides why and how your data is processed and is responsible for it to you and to the law. for noble-roast.com this is: individual entrepreneur (FOP) [full name], tax id [tax id], address: [address]. 2.2. for any questions about your data, write to [email protected]. 3. what data we receive 3.1. orders: first and last name, phone, email, city and nova poshta branch or address (or pickup), order contents and amount, order comment. 3.2. account: email, password (stored only in encrypted form — we cannot see it), order history, favourites, bonus points and referral code, if these programmes are active. 3.3. coffee subscription: selected products, delivery frequency, delivery details. 3.4. reviews: the name you provided, text and rating. 3.5. enquiries: data you provide yourself in the contact form, coffee request or partnership application (name, phone or email, venue name, message text). 3.6. newsletter: email, if you subscribed to news. 3.7. technical data: ip address, browser and device type, request time — automatically in server and site-protection logs; necessary cookies (see section 7). 3.8. statistics data — only if you clicked «accept» in the cookie banner: pages you viewed, where you came to the site from, device and browser type, approximate city, a random browser identifier. we do not identify you from this data. 3.9. we do not receive or store payment card data: payments are processed by the payment service on its own secure page. 4. why we process data and on what grounds 4.1. to accept, fulfil and deliver orders and subscriptions — to perform the contract with you (public offer). 4.2. to maintain your account, order history and bonuses — to perform the contract; you create an account voluntarily. 4.3. to issue receipts and keep records as required by law — to fulfil our legal obligations. 4.4. to contact you about an order, enquiry or request — to perform the contract or at your request. 4.5. to protect the site from fraud, bots and attacks — our legitimate interest in service security. 4.6. to send news and offers — only with your consent (subscription); you can unsubscribe in every email. 4.7. to understand how people use the site and make it more convenient (google analytics statistics) — only with your consent, given with the «accept» button in the cookie banner. you can withdraw consent at any time (section 7). 5. who we share data with 5.1. we share data only with those without whom we cannot fulfil an order or run the site, and only to the extent necessary: — nova poshta LLC — order delivery (name, phone, city, branch or address); — [payment service] — accepting online payments (amount, order number, contacts for the receipt); — Hetzner Online GmbH (germany, eu) — servers on which the site runs and data is stored; — Cloudflare, Inc. (usa) — site protection and fast delivery (technical data); — [email service] — sending order emails and newsletters; — Telegram FZ-LLC (uae) — internal notifications to us about new orders and enquiries; — Google LLC (usa) — google analytics statistics, only if you clicked «accept». 5.2. we may also provide data to public authorities, but only upon their lawful request and to the extent required by law. 5.3. we do not sell your data or share it for third-party advertising. 6. transfer of data outside ukraine 6.1. some of our services are located in the eu and the usa. these states are on the list of states that ensure adequate protection of personal data, and Google, Cloudflare and Hetzner additionally undertake to protect data under standard contractual clauses. 6.2. transfers to other states (in particular internal notifications via telegram) take place only to the minimum extent necessary to fulfil your order or enquiry, on the grounds provided for in article 29 of the law «on personal data protection». 7. cookies and analytics 7.1. necessary cookies are required for the site to work: cart, account login, site language, bot protection and your choice in the cookie banner. they are enabled without separate consent, because the site cannot work without them. 7.2. on your first visit you see a cookie banner with two buttons: «accept» — allows google analytics statistics; «necessary only» — the site works only with necessary cookies. until you make a choice, statistics are not loaded. 7.3. google analytics collects the data listed in clause 3.8. we do not enable advertising features or google signals and do not combine statistics with your account or orders. statistics data is kept for 2 months, after which google deletes it. 7.4. to change your choice, delete the cookies of noble-roast.com in your browser settings — the banner will appear again. you can also install the official google analytics opt-out browser add-on. 8. how long we keep data 8.1. orders, receipts and related data — for as long as tax law requires (at least 1095 days), after which we delete or anonymise them. 8.2. account — while it exists; after the account is deleted, only the order data under clause 8.1 remains. 8.3. enquiries and requests — up to 1 year after the matter is resolved. 8.4. newsletter email — until you unsubscribe. 8.5. technical server logs — up to [90 days]. 8.6. google analytics statistics data — 2 months (clause 7.3). 9. your rights 9.1. under article 8 of the law «on personal data protection» you have the right to: — know what data of yours we process, why and to whom we share it; — access your data; — require correction of inaccurate data or deletion of data processed without need or grounds; — object to processing and withdraw consent (to the newsletter or statistics) at any time — this does not affect the lawfulness of processing before withdrawal; — file a complaint with the ukrainian parliament commissioner for human rights or with a court. 10. how to exercise your rights 10.1. write to [email protected] from the email, or stating the phone, used in your order or account — this way we can make sure it is really you. 10.2. we reply as soon as possible, but no later than 30 calendar days. 10.3. you can change some data yourself in your account and unsubscribe from the newsletter via the link in the email. 11. security and your share of responsibility 11.1. we protect data: the connection to the site is encrypted (https), passwords are stored only in encrypted form, only those who need it for work have access to data, and staff login is protected by two-factor verification. 11.2. for your part, please do not share your password and use a strong one. we are not responsible for the consequences if you disclosed your password yourself or let another person into your account or device. 11.3. by providing another person’s data (for example, a gift recipient), you confirm that you are entitled to share it and that this person does not object. the person who provided the data is responsible for its accuracy. 11.4. the site is not intended for children. persons under 14 may place orders only through their parents or other legal representatives. 12. changes to the policy 12.1. we may update this policy, for example when new services appear or the law changes. the current version is always available on the site; the version date is stated at the top. 12.2. if the changes are significant, we will announce them on the site.