Privacy policy for the nunc. espresso system

If you allow the receipt of push-up notifications via the nunc. app in the settings of your device, we will regularly inform you via corresponding push-up notifications about certain statuses of your nunc. portafilter machine (e.g., fill level of the water tank). This is only done for the purpose of ensuring you can make optimal use of the nunc. Espresso system as well as an optimal maintenance and support service. For this purpose an analysis and evaluation of the brewing and grinding parameters (e.g. brewing temperature, pressure, water tank level, condition of the brewing unit, grinding degree, shutter speed, humidity, grinding time) as well as certain technical device information (e.g. device ID, current firmware version, availability of updates, NFC tag, error messages) that we read from your nunc. portafilter machine.  

Data processing is carried out solely for the purpose of properly executing the user agreement with you and to be able to offer you the desired functionalities of the nunc. app. The legal basis for data processing is the user agreement concluded with you in accordance with Article 11. 6 paragraph 1 sentence 1 letter b GDPR.  

As part of the Notification Service , corresponding information may be stored on your device and/ or corresponding information already stored on your device may be accessed. Access is based on § 25 para. 2 No. 2 TDDDG, as this information is absolutely necessary in order to be able to provide the requested service properly.   

We will delete your data as soon as the purpose of processing no longer applies, subject to compliance with any ongoing statutory retention periods.  
 

You can order coffee beans via the nunc . app. In order to enable you to select and order coffee beans via our nunc . app, as well as to pay for and deliver them, we process the data you provided during registration (see section 6 ), the billing and delivery address you provided during the ordering process , and information about the products you ordered. This information is linked to your existing customer profile ( see section 8 ). The processing is carried out for the purpose of providing contractual services within the scope of operating our online shop, for order processing, billing, delivery, and for providing customer services.  

Processing is carried out on the basis of Article 6 (1) (b) GDPR (execution of order processes) or Article 6 (1) (c) GDPR, insofar as the storage serves to fulfill statutory retention periods. The information marked as mandatory is required to establish and fulfill the contract. Without this data, we are not able to execute the contract with you. We only transmit the data to third parties in the context of the order, in particular for payment processing and delivery, or within the framework of statutory rights and obligations. The data will only be processed in third countries if this is necessary to fulfill the contract (e.g. for delivery to a delivery location outside the EU).  

For the processing of online orders we use the services of Shopify International Ltd. , Haddington Road, 2nd Floor, 1-2 Victoria Buildings, Dublin D04 XN32, Ireland (hereinafter "Shopify"). All data collected as part of the ordering process on our nunc app is generally transferred to Shopify servers and stored there. Any transfer of personal data to Shopify 's parent company ( Shopify Inc. 151 O'Connor Street, Ground floor , Ottawa, Ontario, K2P 2L8, Canada) is subject to the EU Commission's adequacy decision (see https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002D0002).  

Further information on data processing by Shopify can be found on Shopify ’s websites at the following links:  

 For payment processing we work with the following payment service providers:  

For the purpose of payment processing, your payment details (name of your bank, IBAN, BIC, credit or debit card information, billing address) are transferred to the respective payment service provider. We do not store your payment details ourselves. We only receive and store information about the status of the respective transaction (e.g., "payment successful" or "payment declined," etc.).   

Please therefore note the data protection and security information of the payment service providers :  

The data you provide when placing an order will be deleted after the relevant statutory warranty, limitation and retention periods have expired.  

You have the option of subscribing to automatic follow-up deliveries. In this case, we estimate the need for a new coffee delivery (quantity and timing) based on previous orders and an analysis of your usage data (see Section 10, Letter d) and initiate the appropriate delivery in a timely manner. Your preferred payment option will be automatically charged. The processing is carried out for the purpose of providing contractual services within the scope of operating our online shop, for order processing, billing, delivery, and providing customer services.  

The processing is carried out on the basis of Article 6 paragraph 1 sentence 1 letter b GDPR (execution of the order processes) or Article 6 paragraph 1 sentence 1 letter c GDPR, insofar as the storage serves to fulfil statutory retention obligations.  

The data you provide when placing an order will be deleted after the relevant statutory warranty, limitation and retention periods have expired.  

You have the option of providing a personalized tip to the individual producers of the various coffee beans to support them and contribute to sustainable coffee production. We process the data collected during order processing (see Section 11) as well as the respective tip amount. This processing is carried out for the purpose of providing the requested services.  

The processing is carried out to protect our legitimate interests on the basis of Article 6 paragraph 1 sentence 1 letter f GDPR or Article 6 paragraph 1 sentence 1 letter c GDPR, insofar as the storage serves to fulfill statutory retention obligations. In the former case, our legitimate interest lies in the proper provision of the services you request.  

We work with the following payment service providers to process payments :  

For the purpose of payment processing, your payment details (name of your bank, IBAN, BIC, credit or debit card information , billing address) are transferred to the respective payment service provider. We do not store your payment details ourselves. We only receive and store information about the status of the respective transaction (e.g., "payment successful" or "payment declined," etc.).  

Please therefore note the data protection and security information of the payment service providers :  

If your data is processed based on legitimate interests, you can object to the storage of your personal data at any time. In this case, we will no longer process your data unless we can demonstrate an overriding legitimate interest or are otherwise legally obligated to store it. To exercise your right to object to storage, please contact us in writing or by email.  

The data you provide when placing an order will be deleted after the relevant statutory warranty, limitation and retention periods have expired.

You have the option of contacting us by email . In this case, we will process the data disclosed as part of your inquiry to respond to your inquiry based on our legitimate interests in processing customer inquiries in accordance with Article 6 (1) (f) GDPR. In this context, data may also be transferred to third parties, such as affiliated companies, to process your request.  

If your data is processed based on legitimate interests, you can object to the storage of your personal data at any time. In this case, we will no longer process your data unless we can demonstrate an overriding legitimate interest or are otherwise legally obligated to store it. To exercise your right to object to storage, please contact us in writing or by email.

We will delete your data as soon as the purpose of processing no longer applies, subject to compliance with any ongoing statutory retention periods.  
 

The processing of personal data related to the use of the nunc. Espresso system in accordance with the above sections is carried out under joint responsibility within the meaning of Article 26 (1) (1) GDPR by the companies named at the beginning of this data protection notice.  

In this context, the respective personal data may be exchanged between the joint controllers. The legal basis for this is generally the protection of our legitimate interests pursuant to Article 6 (1) (f) GDPR. Our legitimate interests lie in the optimization of our business processes, the effective allocation of our resources, and the provision and management of central IT infrastructure.  

Against this background, we have an agreement on joint responsibility The agreement essentially includes the following: 

If you have any further questions about the joint controllership agreement, you can contact us at any time using the contact details provided at the beginning of this privacy notice.