Privacy notice

Who is responsible

Kaffeparken Eco
Rolfsgatan 6B, 214 34 Malmö, Sweden
070-710 13 39
hej@kaffeparken.se (orders, bookings and returns)
info@kaffeparken.se (wholesale, press, privacy and legal)

Kaffeparken Eco is the data controller for personal data collected through this website and when you order, book or write to us. For questions about your data, or to use any of the rights below, email info@kaffeparken.se.

What we collect, and why

Data	Why	Legal basis
Name, address, email, phone	To take payment and deliver your order	Performance of a contract
Order history	Order tracking, support, returns and complaints	Contract, and legal obligation
Payment details	Handled by our payment provider; we never see or store card numbers	Contract
Accounting records	Swedish bookkeeping law requires them	Legal obligation
Bookings for sessions, courses and events	To plan the booking and send you the confirmation and calendar invite	Contract
Withdrawals sent with "Withdraw from contract here"	To receive your withdrawal, send the receipt and refund you	Legal obligation
Messages and enquiries you send	To answer you	Our legitimate interest in replying to people who contact us
Members' market accounts: name, company, company number, country, contact details, lots, offers, sign-in times	To check who may trade, run the market and confirm deals	Steps you ask for before a contract, and the contract
BankID check, if you choose it: the name BankID returns and a one-way code made from your personal identity number (never the number itself)	To know a member is who they say they are	Our legitimate interest in keeping the market free of false accounts
Activity log: who signed in and what was done in the market and the admin	Security, and to show what was agreed	Our legitimate interest in a secure, traceable market
Job applications	To assess your application	Steps you ask for before a possible contract
Website analytics	To understand what to improve	Consent
Advertising measurement	To show our coffee to people who might want it	Consent

We need your name, address and email to deliver an order. Without them we cannot sell to you. We do not make decisions about you by automated means alone.

Your basket

Your basket is kept in your own browser (local storage) so that it survives a page reload. It contains your choices, not your identity, and it is necessary for the shop to work, so it does not need consent.

Who else sees it

Who	What they do	Role
PostNord, DHL	Deliver your parcel, using your name, address and contact details	Independent controllers
Stripe	Processes card payments	Independent controller for payment data
Klarna	Processes Klarna payments	Independent controller for payment data
Vercel	Hosts the website	Processor
Turso	Hosts our database	Processor
Resend	Sends our order and booking emails	Processor
Google (analytics), Meta (advertising)	Measure visits and ads	Only if you allow them in the cookie settings

Processors handle data only on our instructions, under a data processing agreement. We do not sell your data.

Transfers outside the EU and EEA

Some of the services above are run by companies based in, or owned from, the United States, so data may be processed there. Such a transfer must rely on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for certified companies, or on the Commission's standard contractual clauses. Ask us and we tell you which applies to which service.

How long we keep it

• Accounting records: seven years, as Swedish bookkeeping law requires.
• Orders: as long as needed for delivery, support, returns and complaints (up to three years), then only as accounting records.
• Bookings, withdrawals, messages and enquiries: two years after our last contact.
• Members' market accounts and their activity log: as long as the account exists, then two years; confirmed deals are kept as accounting records.
• Job applications: until the role is filled, and no longer than twelve months.
• Consent choices: until you change them.

Your rights

Under the GDPR you may ask for a copy of your data, have it corrected or erased, restrict processing, receive your data in a portable format, and object to processing based on our legitimate interest. Where we rely on your consent, you may withdraw it at any time; that does not affect what we did before. Email info@kaffeparken.se and we answer within one month.

If you are unhappy with how we handle your data, you may complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY).

Cookies

The shop works without cookies that need consent. Analytics and advertising scripts, which set their own cookies, load only if you allow them. The cookie banner lets you refuse as easily as you accept, and you can change your choice at any time from the cookie settings link in the footer.

Changes

If we change this notice, the date at the top changes too. We tell you by email of changes that matter to an order or booking you have with us.