Join the waitlist

Privacy policy

Last updated:

Here I explain what data I collect when you visit caffeos.com, join the waitlist or ask for advice, what I use it for and what you can do about it.

Who is responsible

CaffeOS is a project by Oscar Penalva. I am the controller of your data, as a private individual.

  • Name: Oscar Penalva
  • Address: Hopfengasse 17/2/10, 4020 Linz, Austria
  • Email: hello@caffeos.com

What data I collect

If you join the waitlist, I collect what you enter in the form:

  • Where your café is at: whether you're about to open one or it's already open.
  • Your name, your email, and your city and country.
  • Your WhatsApp or phone number, with the country code, if you choose to give it.
  • If you're about to open: when you want to open, what stage you're at and, if you want to tell me, what worries you most.
  • If your café is already open: how many locations you have and which POS system you use.

The form also stores the language of the page you signed up from, the date you sent it and how you reached the site (for example, the name of a campaign if you came in through one of its links, or "direct" if not).

Where your café is at, your name, your email, your city and country and, depending on what you choose, when you want to open and what stage you're at, or how many locations you have, are required: without them I can't know who you are or what you're interested in. Everything else is optional. In the free text field, please don't write sensitive data such as health information.

If you ask for advice, I collect what you enter in the advisory form: your contact details, what your café or project is like and what you need help with. Your answers also record that you came from this site.

If you only visit the site, the server that delivers it logs technical data about each visit, such as your IP address, your browser and the page you request.

If you accept analytics in the cookie notice, Google Analytics collects which pages you view, how you reached the site (for example, from a search engine or a link), your device type, browser, language and approximate country or city. To work out the location it uses your IP address, which according to Google's documentation is processed on servers in the European Union and discarded before anything is stored: Google Analytics doesn't store the IP addresses of European visitors. If you don't accept, the Google script doesn't load and your browser doesn't connect to Google.

What I use it for

  • To write to you when the CaffeOS Build beta is ready to try, if you're about to open, or when CaffeOS for open cafés comes out, if yours is already open.
  • To reply to your request for advice and, if you want us to work together, to prepare how.
  • To understand your situation and ask you about it, if you've left me a phone number or told me what worries you.
  • To keep the site working and protected against abuse.
  • To see which pages get read and where people come from, so I can improve the site, if you accept analytics.

I don't sell your data, I don't send you third-party advertising and I don't use it for profiling or automated decisions.

Legal basis

  • Waitlist: your consent (Art. 6(1)(a) GDPR), which you give me by ticking the box in the form. You can withdraw it at any time by emailing me at hello@caffeos.com. Withdrawing it doesn't affect anything done with your consent before.
  • Advisory: handling the request you make by sending the form, before a possible contract (Art. 6(1)(b) GDPR).
  • Server logs: my legitimate interest (Art. 6(1)(f) GDPR) in keeping the site working and protected against abuse.
  • Analytics: your consent (Art. 6(1)(a) GDPR), which you give me by pressing "Accept" in the cookie notice. You can withdraw it at any time by pressing "Cookies" at the bottom of any page and choosing "Decline". Withdrawing it doesn't affect anything done with your consent before.

Who else processes your data

I work with these providers, which process data only on my behalf and under a data processing agreement:

  • Netlify, Inc. (USA): hosts the site and receives form submissions. It checks every submission with a spam filter (Akismet), which analyses its content and the IP address it was sent from.
  • Namecheap, Inc. (USA): the hello@caffeos.com mailbox, where form notifications reach me and where I write to you from.
  • Tally BV (Belgium): the advisory form. It stores your answers in the European Union. To detect errors in the form it uses Sentry (Functional Software, Inc., USA).
  • Google Ireland Limited (Ireland): Google Analytics, only if you accept it. It processes visit data on my behalf and may transfer it to Google LLC (USA).

The advisory form only loads if you press "Abrir el formulario" (open the form). When you do, your browser downloads the form's fonts from Google Fonts (Google LLC, USA), which receives your IP address. If you give me your phone number and we talk on WhatsApp, WhatsApp processes that conversation under its own privacy policy.

Outside the European Union. Netlify, Sentry and Google LLC are certified under the EU-U.S. Data Privacy Framework, which the European Commission considers to provide an adequate level of protection. The contracts of Netlify and Sentry also include the Commission's standard contractual clauses, and Namecheap's contract relies on them.

I don't share your data with anyone else, unless the law requires me to.

How long I keep it

  • Waitlist: until you unsubscribe or, at most, two years after our last contact. After that I delete it from the Netlify form and from my mailbox.
  • Advisory: until your request is resolved or, at most, two years after our last contact. After that I delete it from Tally and from my mailbox. If we end up working together, I keep what the law requires, such as invoices.
  • Server logs: Netlify keeps them for a limited time, to keep the site working and protected. Netlify doesn't publish a fixed period. I don't use them for anything else.
  • Analytics: Google Analytics keeps the data of each visit for two months, the shortest period it allows. Aggregated reports (how many visits a page had in a month, for example) contain no data about any one person and are kept longer. Google's cookies last two years, unless you delete them first or withdraw your consent.

Your rights

You can ask me at any time to access your data, correct it, delete it, restrict its use, receive it in a format you can take elsewhere, or object to its processing where I rely on my legitimate interest. Email me at hello@caffeos.com and I'll reply within one month at most.

If you're not happy with how I handle your data, you can lodge a complaint with the Austrian supervisory authority, the Datenschutzbehörde (dsb.gv.at, dsb@dsb.gv.at), or with the authority in your country of residence in the European Union.

Security

The site is always served over an encrypted connection (HTTPS), and I'm the only person with access to the form data.

Changes to this policy

If I change how I process your data, I update this page and its date. If the change affects what you consented to, I'll write to you first.