1. Data controller
Babics Bence egyéni vállalkozó (registered address: 9090 Pannonhalma, Cseidervölgy 13; email: bence@kaveut.hu; phone: +36 30 653 7220). We are not required to appoint a data protection officer under Article 37 of the GDPR. Please use the email address above for privacy questions.
2. What data we process, why and for how long
| Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|
| Completing the Cup Compass quiz and displaying matches | Quiz answers (brewing method, flavor preferences, caffeine and box). Not linked to a name or email address. | No personal data is transferred: answers are stored only in your browser for the duration of the session. | Until you close your browser or restart Cup Compass. |
| Order fulfillment and invoicing | Name, email address, telephone number, delivery address, ordered box and selected coffees, payment identifier and amount. We do not process card details. | GDPR Article 6(1)(b): performance of a contract; for invoice data, Article 6(1)(c): legal obligation (Section 169 of the Hungarian Accounting Act). | Contract data: 5 years after fulfillment (limitation period under the Hungarian Civil Code); invoices and accounting records: 8 years. |
| Post-purchase reviews and administration of the Taste Match Guarantee | Order ID, email address used for the order, rating for each coffee, brewing method, brief tasting description, dates of the claim and replacement fulfillment, and related correspondence. Reviews are not public. | GDPR Article 6(1)(b): fulfilling the requested contractual Taste Match Guarantee and checking eligibility. | For 12 months from assessment of the claim; for approved claims, at least until delivery of the replacement coffee. Complaint records, invoices and shipping records are subject to their respective retention requirements. |
| Updates about the next ordering window and newsletter | First name, email address, subscription date and source, and saved flavor profile (if requested). | GDPR Article 6(1)(a): consent; prior, express consent under Section 6 of Act XLVIII of 2008 on Commercial Advertising. | Until consent is withdrawn. Every email includes an unsubscribe link; withdrawal does not affect the lawfulness of earlier processing. |
| Complaints and contact | Name, contact details, complaint and response. | GDPR Article 6(1)(c): legal obligation (Section 17/A of the Hungarian Consumer Protection Act). | We retain the complaint record and a copy of our response for 3 years. |
| Web analytics (Google Analytics 4, PostHog) | Pseudonymous identifier, pages visited, clicks, device and browser details, and approximate location. We do not store IP addresses. | GDPR Article 6(1)(a): consent, given by choosing “Analytics” in the cookie banner. Tracking scripts are not loaded without consent. | Google Analytics: 14 months. PostHog: 12 months. You can withdraw consent at any time by clicking the cup icon. |
| Website operation, security and payment fraud prevention | Server logs (IP address, timestamp and requested URL), plus Stripe fraud-prevention cookies during payment. | GDPR Article 6(1)(f): legitimate interest in operating the service securely and preventing misuse. | Server logs: up to 30 days. See the Cookie Notice for details of Stripe cookies. |
Providing the data needed for an order is a condition of entering into the contract; without it we cannot deliver your box. Newsletter subscriptions and analytics are optional.
3. Who has access to your data
The Service Provider processes your data. The following partners access the data necessary for their tasks as processors or, where indicated, independent controllers:
- KBOSS.hu Kft. (Számlázz.hu) – Issuing electronic invoices, sending invoice notifications and reporting to NAV Online Számla; processing billing name, address, business tax number, email address and order amounts. Hungary. Privacy policy
- Stripe Payments Europe, Ltd. – Payment service provider; an independent data controller for payment data. Ireland (EU). Some data may be transferred to Stripe, Inc. (USA) under the EU–US Data Privacy Framework (DPF). Privacy policy
- Railway Corporation – Hosting and database provider. USA; the application and database run on servers in an EU region. Data transfers are based on the European Commission's Standard Contractual Clauses (SCCs). Privacy policy
- Google Ireland Ltd. – Web analytics (Google Analytics 4), only with consent. Ireland (EU); transfers to Google LLC (USA) are based on the DPF. Privacy policy
- PostHog, Inc. – Product analytics and masked session replay, only with consent. Data is stored in PostHog's EU data center in Frankfurt. Privacy policy
- Bunny.net (BunnyWay d.o.o.) – Video player for explainer videos; loads only after playback starts. Slovenia (EU). Privacy policy
- Foxpost Zrt., Magyar Posta Zrt. (MPL), GLS General Logistics Systems Hungary Kft. – Parcel delivery; transfer of the name, address, telephone number and email needed for delivery. Hungary. The courier is an independent data controller for delivery.
We disclose data to authorities, courts or other bodies only where required by law. We do not carry out automated decision-making or profiling with legal effects within the meaning of Article 22 of the GDPR. Cup Compass recommendations are based on your answers and have no legal effect on you.
4. Your rights
- Access : you may request information about the data we process about you (GDPR Article 15).
- Rectification : you may ask us to correct inaccurate data (Article 16).
- Erasure : you may request deletion where there is no longer a legal basis for processing (Article 17). Data subject to accounting retention requirements cannot be deleted before the retention period ends.
- Restriction : you may request restriction of processing (Article 18).
- Data portability : you may request data processed on the basis of a contract or consent in a machine-readable format (Article 20).
- Objection : you may object to processing based on legitimate interests (Article 21).
- Withdrawal of consent : at any time, for future processing; use the link at the bottom of a newsletter or the cup icon for cookies.
Send your request to bence@kaveut.hu ; we will respond within one month at the latest. We may ask you to verify your identity to protect your data from unauthorized access.
5. Your right to file a complaint
If you believe our processing infringes your rights, you may complain to Hungary's National Authority for Data Protection and Freedom of Information (NAIH; 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; telephone: +36 1 391 1400; email: ugyfelszolgalat@naih.hu; naih.hu), or bring proceedings before the court with jurisdiction over your place of residence.
6. Data security
The website is available only over an encrypted HTTPS connection. Payment data is handled by Stripe's PCI DSS-certified system and never reaches the Service Provider's server. Only the Service Provider can access the database, through an account protected by a password and multi-factor authentication.
7. Cookies
Cookies, similar technologies and consent management are covered by a separate Cookie Notice .
8. Changes to this notice
We update this notice periodically. You'll always find the current version here. We'll also email subscribers about significant changes.