Legal
Privacy Policy
Last updated: 9 November 2026
This policy explains how Coffee Trading Society Limited (“we”, “us”) handles personal data when you visit coffeetradingsociety.com or contact us. We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988–2018.
1. Who we are
The data controller is Coffee Trading Society Limited, a company registered in Ireland (CRO No. 770864, VAT No. IE4330786WH).
- Registered office: 14E Milners Square, Santry, Dublin 9, Ireland
- Commercial address: Unit 4, The Maltings Building, Grand Canal Harbour, Dublin 8, D08 X3PK, Ireland
- Email: [email protected]
We are not required to appoint a Data Protection Officer. For any privacy question, email us at the address above.
2. What we collect and why
| Situation | Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| You send an enquiry by email (including the enquiry form, which opens your own email app) | Name, company, country, email address, the content of your message | To answer your enquiry, send samples, price lists or quotes, and manage our business relationship | Steps taken at your request before entering a contract (6(1)(b)); our legitimate interest in responding to business enquiries (6(1)(f)) |
| You message us on WhatsApp | Your phone number, WhatsApp profile name and the messages you send | To answer your enquiry | 6(1)(b) and 6(1)(f), as above |
| You visit the website | Technical data processed by our hosting provider, such as IP address, browser type and requested pages, in security and server logs | To deliver the website securely and protect it against abuse | Our legitimate interest in running a secure website (6(1)(f)) |
| Website analytics | Aggregated, cookieless page-view statistics (page, referrer, browser, device type, country, performance) | To measure and improve the website | Our legitimate interest (6(1)(f)) |
| We do business together | Contact details and business correspondence, order and invoice records | To perform the contract and meet accounting and tax obligations | Contract (6(1)(b)); legal obligation (6(1)(c)) |
The enquiry form on this website does not send or store any data on our servers. It only prepares an email in your own email app, which you choose whether to send.
We do not use your data for automated decision-making or profiling, and we do not sell personal data.
3. Cookies, analytics and tracking
This website does not set cookies and does not use advertising or cross-site tracking tools. Fonts and images are served from our own website, with no requests to Google Fonts or other third-party content providers.
To understand how the website is used, we use Cloudflare Web Analytics, a privacy-first analytics service. It is cookieless: it does not set cookies, does not use local storage, and does not fingerprint visitors or track them across websites. It collects technical page-view information only, such as the page visited, referring website, browser type, device type, country and page-load performance. We see these figures only in aggregated form and cannot identify individual visitors from them. The analytics script is loaded from Cloudflare (static.cloudflareinsights.com).
We rely on our legitimate interest (GDPR Art. 6(1)(f)) in measuring and improving our website. Because no cookies or similar technologies are stored on or read from your device, no cookie banner or consent is required. You can block the script with a content blocker without any effect on the website. See Cloudflare Web Analytics and Cloudflare’s privacy policy.
If we add any other tools in the future, we will update this policy and ask for your consent where the law requires it.
4. Who we share data with
- Cloudflare, Inc.: hosts and delivers this website and processes technical connection data and provides our cookieless website analytics on our behalf, as our processor. See Cloudflare’s privacy policy.
- Our email provider: stores emails you send us, as our processor.
- WhatsApp (Meta Platforms Ireland Limited): if you contact us on WhatsApp, Meta processes your data as an independent controller under its own terms. See WhatsApp’s privacy policy.
- Social networks (Instagram, Facebook, X, TikTok): our website only links to these platforms. Nothing is embedded, so no data is sent to them unless you click a link. Their own privacy policies then apply.
- Professional advisers and authorities, such as our accountants or the Revenue Commissioners, where needed to meet legal obligations.
5. International transfers
Some providers, such as Cloudflare and Meta, may process data outside the European Economic Area, including in the United States. Where this happens, transfers rely on the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.
6. How long we keep data
- Enquiries that do not lead to business: up to 24 months after our last contact, then deleted.
- Customer and supplier records: for the duration of the relationship and then for 6 years, in line with Irish tax and company-law requirements.
- Hosting and security logs: kept by Cloudflare for a short period under its standard retention policies.
7. Your rights
Under the GDPR you have the right to access your personal data, correct it, have it erased, restrict or object to its processing (including processing based on legitimate interests), and receive it in a portable format. To exercise any of these rights, email [email protected]. We will reply within one month.
You also have the right to lodge a complaint with the Irish supervisory authority, the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. Website: www.dataprotection.ie.
8. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page.