Privacy Policy

The company “KIVU SPECIALITY COFFEE LTD” (hereinafter referred to as the “Company”), recognizes the importance of protecting the personal data of the users (the “users” or “you”) of its website www.kivu.com.cy, including its online store (hereinafter jointly referred to as the “Website”). The purpose of this Privacy Policy (the “Policy”) is to inform you, among other things, about when and why we collect information about you, how we use it, how long we keep it, and what rights you have with respect to it.

We would like to inform you that any processing of your personal data by our Company, as detailed in this Policy, is carried out in accordance with the applicable personal data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (GDPR), Law No. 125(I)/2018, the legislation on the protection of individuals with regard to the processing of personal data and the free movement of such data, as well as any specific national or European legislation, and any other specific national or European legislation.

Before visiting or using our Website, we invite you to carefully read this Policy, the Terms & Conditions of Use and the Cookies Policy of our Website. Any use of the Website, products and services offered through it constitutes your acceptance of the Terms and Policies posted on the Website.

Definitions

The following terms have the meaning given below, as defined in the General Data Protection Regulation (EU) 2016/679:

α) “Personal Data” or “Personal Data” means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one whose identity can be verified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to physical, physiological, genetic, psychological, economic, cultural or social identity, or to one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of the data subject.

(b) ‘processing of personal data’ means any operation or set of operations which is performed, whether or not by automated means, on personal data or on sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, search, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

(c) ‘controller‘ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

The data controller for all personal data processing activities performed through the Website, as well as in the context of any communication and/or transaction with us, is our Company, KIVU SPECIALITY COFFEE LTD, 21 Mykonos Street, P.O. Box 2480, Cheri, Nicosia.

1. d) “Personal Data Processor” means the natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller.

Collection and Processing of Personal Data

When you browse our Website, use our services, communicate or interact with the Company through our online store, we collect information that relates to you and that allows your identification, directly or indirectly in connection with other information (hereinafter referred to as “Personal Data”). This information is collected when you voluntarily provide it to us or simply by analyzing your behavior on our Website. In particular:

1. I) Data you voluntarily provide us with

Data voluntarily provided by you when you interact with the Website and/or use our services (e.g. when you register on the Website to receive our newsletter, when you purchase a product, when you participate in a contest, when you fill out the “Contact Form” available on our Website or one of our customer surveys). This data includes your full name, your email address/email address, the postal address for shipping products, the billing address of the order (if different from the shipping address), your telephone number (landline and/or mobile), billing information (company name, business name, VAT number), account information (such as username, password and other identifiers used to access our services), and the content of any comments or requests you choose to send us.

In case you request delivery of products to a third person/recipient, you acknowledge that you are solely responsible for the information and consent of this person to the disclosure of his/her personal data to our Company, in accordance with this Policy, and the Company bears no responsibility.

To complete an order, you will also be asked for credit/debit card details (if you choose to pay by credit/debit card), in which case this information is entered directly in a secure environment of the payment service of a partner bank, without being stored on our Website.

1. II) Browsing Data

In the context of the normal operation of our Website, information about users is collected, the transmission of which is carried out automatically, using internet communication protocols. Although this information is not collected to be associated with a specific user, it is possible, in combination with other data held by third parties, to allow your identification. For this reason, this information is considered “Personal Data” under applicable law and is afforded appropriate protection. This information includes internet protocol (IP) address, cookie data, device information (domain name and type of device), as well as your general traffic history on our Website, e.g. pages visited, products viewed, search terms used. Through this data, we hope to improve the quality of our Website, products and services. Also, this data may be combined with other data you provide to us in order to provide you with more personalized content based on your interests. For more information, we invite you to refer to our Website Cookies Policy.

Special Categories of Personal Data

The Company does not collect and does not wish to be notified of special categories of data (sensitive personal data) in the context of the operation of its Website.

Purposes and Legal Basis for the Processing of your Personal Data

The Company intends to use your personal data, collected through its Website and/or in the context of your transactions with our Company, for the following purposes:

1. To process your orders, payments, requests, to execute contracts for the purchase of goods or services. To complete purchase orders and deliver products ordered by you through its Website and to provide any other services you may request, including participating in competitions and informing you when a product will be available again. For the above purposes (hereinafter jointly referred to as “Service Provider”), your consent is not required with regard to the processing of your personal data, as such processing is deemed necessary for the provision of the services you have requested and, by extension, for the performance of the contract to which you are party or for taking measures at your request prior to the conclusion of a contract (GDPR Article 6, paragraph 1.b – “1. The processing is lawful only if and insofar as at least one of the following conditions applies. However, if you do not provide it, the Company will not be able to respond to your requests and/or provide the products and services you have requested.
2. For marketing, promotional and advertising purposes, regarding the Company’s products and services and in order to send you offers, promotions, e-newsletters and other information about our products and services. Please note that your registration for such a service of sending newsletters and promotional communications is done through our Website. Immediately after your registration, you will be sent an email confirming your registration, and you will be provided with the possibility to immediately and easily withdraw your consent in case you change your mind. The processing for these purposes (hereinafter jointly referred to as “Marketing”) is based on your consent (GDPR Article 6, paragraph 1.a – “1. The processing is lawful only if and insofar as at least one of the following conditions applies: a) the data subject has consented to the processing of his/her personal data for one or more specified purposes,” ). You are not obliged to grant your consent to the Company for the use of your personal data for this purpose and you will not suffer any consequences if you choose not to grant it, except that you will not be able to receive promotional communications from the Company. Any consent granted may be revoked in the future. Please note that the withdrawal of consent does not affect the lawfulness of the processing based on that consent.

iii. For future marketing, promotional and advertising purposes, by sending you directly electronic promotional communications regarding products and services provided by the Company, which are identical or similar to those you may have previously requested from our Company (hereinafter “Soft Spam”). The processing for these purposes is based on the Company’s legitimate interest (GDPR Article 6, paragraph 1.f – – “1. (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular if the data subject is a child.”) for the purpose of sending you direct electronic marketing communications. You may opt-out of such communications and no consequence will be suffered if you do so by opting out via an unsubscribe link/unsubscribe link provided at the bottom of each such future communication.

1. To analyze the use of our Website, to measure its traffic, to obtain information regarding users’ preferences, as well as to display advertisements relevant to users and their interests, through the use of cookies. The processing for the above purpose (hereinafter referred to as “Advertising/Analysis”) is based on your consent (GDPR Article 6, paragraph 1.a – “1. The processing is lawful only if and insofar as at least one of the following conditions applies: a) the data subject has consented to the processing of his/her personal data for one or more specific purposes,”), which is obtained via the cookie banner and/or a specific field that you must actively fill in. It is never obligatory to grant your consent to the Company in order for it to use your personal data for this purpose, and you will have no consequence if you choose not to grant it. Any consent granted may be revoked in the future by modifying your device settings, based on instructions set out in the Cookies Policy of our Website.
2. To comply with laws, such as consumer protection legislation, which require the Company to collect and/or further process certain categories of personal data. When you provide any personal data to the Company, the Company must process it in accordance with applicable law, which may mean retaining and disclosing your personal data to official authorities in compliance with tax, customs or other legal obligations. Consent is not required to process data for this purpose (hereinafter “Compliance”), as such processing is necessary to comply with a legal obligation of the Company (GDPR, Art. 6, para. 1.c – 1. The processing is lawful only if and insofar as at least one of the following conditions applies.)
3. To protect and defend the security of the Company’s systems and property, including the prevention and detection of any misuse of the Website or any fraudulent activities taking place through the Website, as well as to defend the Company’s legitimate interests before competent courts and authorities. Processing for this purpose (hereinafter referred to as “Security/Legal Interests”) is necessary for the pursuit of the Company’s legitimate interests (GDPR Article 6, paragraph 1.f – – “1. (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular if the data subject is a child.”).

Who has access to your Personal Data?

The Company does not sell, exchange or rent personal data to third parties, whether natural or legal persons. Access to your personal data may be granted to:

α) You may not be able to provide your personal data to external partners of the Company, who may, for example, receive your personal data from the Company.a. Duly appointed external partners of the Company acting on behalf of the Company as processors and assisting the Company in the operation of the Website and in the provision of services to the public (internet service providers, IT system support providers, newsletter service providers, market research companies, (postal) transport companies or groupage companies).

1. b) Selected persons who have been authorized by the Company to process personal data for the performance of activities related to the operation of the Website and the products/services provided through it and are bound by a duty of confidentiality (e.g. Company personnel, legal advisors, accountants, tax advisors).
   
   c) Suppliers of the Company, who assist us in the execution and/or delivery of orders.
2. d) Payment providers/banks (when the user makes a payment by credit/debit card).
3. e) Public authorities, bodies, agencies, including tax authorities, if required in compliance with applicable law.
4. f) Fraud prevention and anti-fraud organisations (e.g. Anti-Electric Crime Unit).
5. g) In the event that the Company undergoes a business change, your data may be transferred. In this case, the Company will make every effort to inform you by email or any other appropriate means of the change in control of your personal data, while giving you the opportunity to exercise your rights as provided for by applicable law.

Transfer of Personal Data outside the EU and Provision of Guarantees

In the event that our Company’s partners, suppliers, service providers or authorities, as defined in clause 6 above, are located outside the European Union/European Economic Area, your personal data may be transferred to a third country.

In particular, the electronic platform for hosting data (email addresses) of recipients of our newsletters is currently located outside the EU, and the provider of the relevant service is the company ‘The Rocket Science Group LLC (Mailchimp)’, based in the USA, which is registered in the Privacy Shield system and acts as the processor on behalf of our Company. Similarly, our Website uses trackers via Facebook Inc. (Facebook pixel) and Google LLC (Google Analytics), also registered in the Privacy Shield system.

We would like to assure you that in the limited and necessary circumstances that your personal data will be transferred to a third country, i.e. a country outside the EU/EEA, the Company will take all necessary measures and provide all available guarantees in order to ensure the privacy and protection of your data. You can obtain additional information on these guarantees by sending an email to: eshop@kivu.com.cy

Retention period of your Personal Data

The Company keeps your personal data strictly for as long as required, based on the purpose for which your data was collected. The criteria that govern the determination of the data retention period include the following: (a) for the duration of the relationship between us; (b) where the processing is based on your consent, from the moment you give it until the moment you withdraw it, unless further retention is required to protect the Company’s interests; (c) as long as necessary in order for the Company to comply with a legal obligation incumbent on it; (d) as long as is appropriate in view of the legal position in which we find ourselves (such as defending rights before the courts, audits by regulatory authorities, etc.). In particular:

• Personal Data processed for the provision of Services (in accordance with clause 5.i above) will be retained by the Company for a maximum period of 20 years. The information may, however, be retained for a longer period if we need to deal with any claims in relation to the Services or in order to protect the Company’s interests in relation to potential liability in relation to the Service Provision in the context of litigation etc.
• Personal Data processed for Marketing purposes and for Advertising/Analysis purposes (subject to conditions 5.ii and 5.iv above) will be retained by the Company from the moment you grant your consent until the moment you withdraw it. If consent is withdrawn, the personal data will cease to be used for these purposes, however it may be retained by the Company as we may need to protect the Company’s interests in relation to potential liability in respect of this type of processing.
• Personal Data that is the subject of processing for Soft Spam (in accordance with clause 5.iii. above) will be retained by the Company from the time you provide it to the Company until the time you object to such processing.
• -Personal Data processed for compliance purposes (in accordance with clause 5.v. above) will be retained by the Company for the period of time required in accordance with the specific legal obligations under which the personal data were processed.
• Personal Data processed for Security/Legal Interest purposes (pursuant to clause 5.vi. above) will be retained by the Company strictly for the period of time necessary to achieve the purposes for which it was collected.

After this period of time, all data will be deleted or anonymised, with the exception of data which according to applicable law is required to be kept for a longer period of time.

What are your rights in relation to your Personal Data?

As a data subject, you have the following rights which you can exercise at any time:

1. i) Request confirmation as to whether your personal data is being processed by our Company and, if so, to access and obtain a copy of it.
2. ii) Request the correction of inaccurate data, the updating of your data or the completion of incomplete data.

iii) Request the deletion of your data if they are not necessary or if you consider that they have been processed unlawfully.

1. iv) Request the restriction of the processing of your data where you feel that the personal data is inaccurate or the processing is not necessary or is unlawful.
2. v) Withdraw your consent to the processing of your data where it serves as a legal basis for processing.

(vi) Request, subject to conditions, the portability of your data, i.e. to receive a copy of your data in a structured, commonly used and machine-readable format, and to request the transfer of your data to another controller.

(vii) Object to the processing of your data.

You also have the right to appeal to the Office of the Data Protection Commissioner. For the competence of the Authority and how to lodge a complaint, you can visit its website (www.dataprotection.gov.cy -> Information for Citizens -> Complaint Submission), where detailed information is available.

Personal data of minors.

The Company does not address and does not knowingly collect data concerning minors. If minors voluntarily visit our Website, the Company shall not be liable for any damage caused by minors. Parents/guardians may prevent a minor from accessing the Site by using available, easily accessible programs that control access to the Internet or to specific Sites. In any case, if the Company becomes aware that the user is a minor, we will not use or retain the user’s personal data.

Social Media

Our Company uses social media and applications, such as Facebook and Instagram. If you are connected to one of these networks, the network may associate your user account with your visit to our Website. For this reason, if you do not want the data retrieved from your visit to our Website to be combined with your social media account, you should log out of your social network account before you enter our Website.

Third Party Sites and Links

The Website may contain links (links, hyperlinks), advertising banners and references to websites, platforms or applications of third parties (jointly third party websites), the control of which does not belong to the Company. Similarly, access to our Website may be obtained through links to third party websites, which the Company does not control. We would like to point out that third party websites may collect your personal data for their own processing purposes. The Company does not guarantee the level and quality of each website to which it links, nor does it assume any responsibility for the content of websites that do not belong to it and/or for the conditions of collection and processing of personal data applicable to them. In view of the above, we invite you to be particularly careful and check the terms and policies (privacy/privacy, cookies) governing third party websites, as they may differ significantly from ours.

Security of Personal Data

The Company has put in place appropriate technical and organizational measures to protect your personal data. All personal data collected by the Company are stored and processed in a manner that minimises the risk of (accidental) loss, destruction or breach. For orders through the Website, our Company uses the Secure Sockets Layer / Secure Sockets Layer (SSL: RSA Encryption) protocol to ensure the protection of your personal data. A padlock will be displayed by your browser to let you know when an SSL connection is being used. This system encrypts your information before it is sent over the Internet and is among the best software available today for secure commercial transactions. Personal security is also provided to users by the password that they set when registering on the Website, which is why we urge you to choose strong passwords (a combination of letters, numbers and symbols), keep your passwords safe and protect them from unauthorized access. The Company, however, cannot guarantee the complete security of your data against persons who would attempt to circumvent security measures and/or interfere with the transfer of data over the Internet.

Changes to the Privacy Policy

This Policy may be amended at any time, at the Company’s sole discretion. For this reason, we invite you to review this Policy regularly to be aware of any changes to this Policy. Any changes to this Policy will take effect from the time they appear on this page, and will be clearly indicated with the date of the last update.

Contact

In case you have any request or questions regarding this Policy and/or wish to exercise your rights as a data subject of your personal data, you can contact us:

– By mail.

– By email: eshop@kivu.com.cy

We will make every effort to respond to your request as soon as possible.