Privacy policy

Cumaru UG (haftungsbeschränkt) Müggelstraße 31 10247 Berlin Deutschland E-Mail: hello@cumaru.co Phone: +49 152 03185074

Managing directors: Thomas Verst, Denisa Pokorna

We only process personal data where needed to run this website, answer requests and start business with roasters and producers. We use no analytics or advertising trackers and never sell data.

The site is hosted by Vercel Inc. (USA). When you visit, technically necessary data is processed: IP address, date and time, page requested, browser and operating system, for secure and stable operation (Art. 6(1)(f) GDPR). Logs are deleted after a short period.

Transfers to the USA rely on the EU-US Data Privacy Framework or EU standard contractual clauses.

Content, accounts and requests are stored with Supabase Inc. If you create an account, we process the details needed to provide it (Art. 6(1)(b) GDPR).

We only use technically necessary cookies: one for the password-protected preview ("site-access"), session cookies for signing in and possibly one for your language. No consent is required for these (§ 25(2) TDDDG). We set no tracking cookies.

When you request a sample through the form, we process your name, roastery/company, email and, optionally, phone, delivery address, message and the coffees you chose, to handle your request and prepare a contract (Art. 6(1)(b) GDPR).

The request is stored in our database (Supabase) and delivered to us by email via Resend Inc. (USA). We delete it when no longer needed, at the latest two years after our last contact, unless statutory retention periods apply.

If you email or WhatsApp us, we use your details to reply. For WhatsApp, the privacy terms of WhatsApp Ireland Ltd. (Meta) also apply.

We store your email for the newsletter based on your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time – a short email is enough.

Fonts are served from our own server; there is no connection to Google Fonts.

Some pages show maps with OpenStreetMap tiles, which transmits your IP address to the OpenStreetMap Foundation (Art. 6(1)(f) GDPR).

Links to Instagram, producers' websites or traceability pages are plain links; data is only transmitted when you click them.

You have the right of access, rectification, erasure, restriction, data portability and objection (Arts. 15–21 GDPR), and may withdraw consent at any time. Contact hello@cumaru.co.

You may also lodge a complaint with a data protection authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information.