Privacy policy · Cafuné

Courtesy translation. If there is any discrepancy, the Spanish version prevails.

1. Data controller

Controller: Rio de Janeiro Importación y Exportación, S.L.
Tax ID (NIF): B75594721
Address: Camí Vell d'Alboraia 28, 46020 Valencia (Spain)
Contact email: riocomercio@gmx.com

2. What data we process

Retail orders: name, phone, delivery method, neighbourhood or postcode, notes and the products you choose. This data travels in the WhatsApp message you send, together with your WhatsApp number and profile.
Trade form: café name, contact person, neighbourhood, phone, email, coffees of interest, estimated volume, interest in consignment and message.
Technical data: the server hosting the website logs connection data, such as your IP address, for security and to keep the site running.

We never ask for payment details on the website.

3. Why we use it

To answer your order or enquiry, arrange delivery or pickup, send you the information or sample you ask for and, if we reach an agreement, issue the invoice. We do not use your data to send you advertising without your consent, we do not build profiles and we do not make automated decisions.

4. Legal basis

Steps taken at your request before entering into a contract, and performance of the contract (art. 6(1)(b) GDPR): orders and enquiries.
Compliance with legal, tax and accounting obligations (art. 6(1)(c) GDPR): when a sale takes place.
Legitimate interest in keeping the website secure (art. 6(1)(f) GDPR): technical connection data.

5. How long we keep it

For as long as needed to handle your order or enquiry and maintain the business relationship. After that, data is kept blocked only for the periods required by law (for example, six years for accounting records under article 30 of the Spanish Commercial Code) and then deleted.

6. Recipients and service providers

We do not share your data with third parties unless required by law. We work with these providers to run the service:

Vercel Inc.: website hosting.
WhatsApp (Meta): we receive the orders and enquiries you send on WhatsApp. Its use is also governed by WhatsApp's terms and privacy policy.
Email provider (GMX): the mailbox where we receive emails.
Google Fonts: serves the website's typefaces; when they load, your browser shares your IP address with Google.

Where any of these providers processes data outside the European Economic Area, it does so with the safeguards set out in the GDPR, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

7. Your rights

You can request access, rectification, erasure, objection, restriction of processing and portability of your data by writing to riocomercio@gmx.com and stating which right you want to exercise. If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

8. Minimum age

The forms are intended for people aged 14 or over, as set out in article 7 of the Spanish data protection act (LOPDGDD).