Privacy policy
Protecting your personal data is important to us. Below we inform you which data we process when you visit our online shop and when you place an order, for what purpose this happens and what rights you have.
1. Controller
The controller for data processing on this website is:
BUNCA Coffee GmbH
Kirchnerstraße 4
60311 Frankfurt am Main
Germany
Represented by the Managing Director Arsalan Ziegler
Phone: +49 69 85003577
Email: hello@bunca.de
We have not appointed a data protection officer because the statutory requirements for doing so are not met. If you have questions about data protection, please contact the address stated above.
2. Operation of the website and processing on our behalf
Our online shop runs on the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland, together with Shopify Inc., 151 O'Connor Street, Ottawa, Canada.
Shopify processes on our behalf all data arising in connection with visits to the website and with orders, in particular master data, order and payment data and access data. The legal basis is Article 6 (1) (b) GDPR for the performance of the contract and Article 6 (1) (f) GDPR for the secure and economical operation of our online offering. A data processing agreement pursuant to Article 28 GDPR is in place with Shopify.
3. Access data
Each time our website is accessed, data transmitted by your browser is collected automatically. This includes in particular the IP address, the date and time of access, the page accessed, the page previously visited, the browser used and the operating system.
This data cannot be attributed to specific individuals by us and is not merged with other data sources. It serves to provide the website technically, to ensure its stability and security and to investigate malfunctions. The legal basis is Article 6 (1) (f) GDPR. Our legitimate interest lies in error-free and secure operation.
The server log data is generated at our platform provider and is deleted there in accordance with the retention periods provided by the platform, as soon as it is no longer required for technical provision and security. Longer retention takes place only where this is necessary to investigate a specific security incident. In that case, processing is limited to the incident concerned.
4. Cookies and comparable technologies
When you visit our online shop, cookies and comparable storage technologies are used. They ensure that the shopping cart is retained, that the selected language and currency are applied, that a login to the customer account persists and that the ordering process runs securely.
Simply visiting the site sets the following cookies:
- _shopify_essential: maintains your session and secures the ordering process technically. This cookie is set by the server and cannot be read by scripts in the browser.
- localization: remembers the selected country and language. Lifetime one year.
- cart_currency: remembers the selected currency. Lifetime two weeks.
- cart: assigns your shopping cart to you so that its contents are retained as you browse. Set as soon as you add something to the cart.
Further strictly necessary platform cookies are added during an order and when you log in to a customer account, for example for session and cart management and for fraud prevention during payment.
This storage does not require consent pursuant to Section 25 (2) no. 2 TDDDG because it is strictly necessary in order for us to provide the service you have requested. The associated data processing is based on Article 6 (1) (b) and (f) GDPR.
Cookies that are not strictly necessary are only set after you have given your consent. On your first visit a banner appears in which you can allow or refuse the categories “Personalization”, “Marketing” and “Analytics” individually. The platform stores your decision in the cookie _tracking_consent with a lifetime of one year so that the banner does not reappear on every visit.
You can change your selection or withdraw your consent with effect for the future at any time. The dialog is available via “Cookie settings” in the footer of every page.
We do not embed advertising networks or social media plugins. The only services that require consent are the reach measurement under section 5, the session analysis under section 6 and the website analysis under section 7.
You can delete cookies in your browser at any time or restrict their storage. Please note that the ordering process may then no longer work fully.
5. Reach measurement by Shopify
Our platform provider Shopify collects usage data relating to our online shop in order to provide us with aggregated analyses, for example on the number of page views, the most visited pages and the ratio of visits to orders. The data transmitted includes in particular the page accessed, the page previously visited, information about the browser and device, and the IP address.
This collection is technically an integral part of the Shopify platform. We receive aggregated analyses only and no information about individual persons. The legal basis is Article 6 (1) (f) GDPR. Our legitimate interest lies in designing our offering to meet demand and operating it economically. The processing takes place within the scope of the processing on our behalf described under section 2.
The cookies used for this purpose are only set if you have consented to the category “Analytics” in the banner:
- _shopify_y: attributes repeat visits to the same browser. Lifetime one year.
- _shopify_s: keeps the current session together. Lifetime 30 minutes from the last access.
The legal basis for this storage on your device is Section 25 (1) TDDDG in conjunction with Article 6 (1) (a) GDPR. Without your consent these cookies are not set. What remains is the server-side, aggregated analysis without any storage on your device.
6. Session analysis with Microsoft Clarity
We use Microsoft Clarity to understand how our shop is used. Clarity records mouse movements, clicks, scrolling behaviour, the order of the pages accessed and the time spent on them. From this it creates replays of individual sessions as well as heatmaps showing which areas of a page receive attention. We use these analyses to identify usability problems and to improve our shop.
The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. According to its own statements, Microsoft processes the resulting data as an independent controller. Details can be found in the Microsoft privacy statement at microsoft.com/privacy/privacystatement.
The data processed includes in particular the pages accessed, the date and time of access, the page previously visited, information about the browser, operating system and device including screen resolution, your interactions with the page and your IP address, from which Microsoft derives the approximate location. Entries in form fields and images are masked before transmission. Their content does not reach Clarity.
Clarity is only loaded after you have consented to the category “Analytics” in the cookie banner. Before that no script from Microsoft is loaded and no cookie is set. The legal basis for the storage on your device is Section 25 (1) TDDDG; the legal basis for the subsequent processing is your consent pursuant to Article 6 (1) (a) GDPR.
After your consent, Clarity sets two cookies on our domain:
- _clck: stores a pseudonymous identifier so that several visits can be attributed to the same browser. Lifetime one year.
- _clsk: combines the page views of one session into a single recording. Lifetime one day.
Cookies that Microsoft uses for advertising purposes are not set. We permanently signal to Clarity that processing for advertising purposes is not permitted.
The data is stored in the Microsoft Azure cloud. This also involves processing by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, United States. This transfer is based on standard contractual clauses pursuant to Article 46 (2) (c) GDPR between the Microsoft entities involved. Microsoft is additionally certified under the EU-US Data Privacy Framework.
According to Microsoft, replays of individual sessions are available to us for 30 days. Recordings marked as favourites, a random sample of recordings and the heatmaps remain available for up to nine months.
You can withdraw your consent at any time with effect for the future. To do so, open “Cookie settings” in the footer of every page and withdraw your consent to the category “Analytics”. Clarity is then no longer loaded and the cookies that have been set are deleted. The lawfulness of the processing carried out until the withdrawal remains unaffected.
7. Website analysis with Google Analytics
We use Google Analytics to understand how our shop is found and used. In particular, we evaluate which channels visitors arrive through, which products they view, at which point orders are abandoned and what content is searched for. We use these evaluations to improve our range and our shop.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data on our behalf as a processor. Google’s data processing terms apply, which include a data processing agreement pursuant to Article 28 GDPR. Google Analytics is integrated through the “Google & YouTube” sales channel of our shop platform.
The data processed includes the pages accessed, the date and time of access, the page visited before, information about your browser, operating system and device, an approximate location, the products viewed, cart actions, search terms entered in the shop and completed orders with order number, order value and the items contained. Your IP address is not logged by Google Analytics. On receipt it is used only to derive the approximate location and is discarded afterwards. We do not transmit your name, address or payment data to Google.
Google Analytics is only loaded after you have consented to the “Analytics” category in the cookie banner. Before that, no script is loaded from Google and no cookie is set. The legal basis for the storage on your device is Section 25 (1) TDDDG; the legal basis for the subsequent processing is your consent pursuant to Article 6 (1) (a) GDPR.
After you consent, Google Analytics sets two cookies on our domain:
- _ga: stores a pseudonymous identifier so that several visits can be attributed to the same browser. Lifetime two years.
- _ga_ followed by an identifier of the property: records the state of the current session. Lifetime two years.
We have not activated the “Google signals” feature. Data is therefore not combined across devices with signed-in Google accounts. We have also disabled all data sharing settings towards Google. Google may therefore not use the data collected on our behalf for its own purposes, in particular not for advertising. We have limited the retention period of user-related data in Google Analytics to fourteen months.
Processing also takes place by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States. This transfer is based on standard contractual clauses pursuant to Article 46 (2) (c) GDPR. Google is also certified under the EU-US Data Privacy Framework.
You can withdraw your consent at any time with effect for the future. To do so, open “Cookie settings” in the footer of every page and withdraw your consent to the “Analytics” category. Google Analytics will then no longer be loaded and the cookies that have been set will be deleted. The lawfulness of the processing carried out up to the withdrawal remains unaffected.
8. Fonts
The fonts used on this website are delivered from our own server or via Shopify's content delivery network. No connection to third-party servers, such as Google Fonts or Adobe Fonts, is established in the process.
9. Orders and performance of the contract
When you order from us, we process the data required for this: first and last name, billing and delivery address, email address, telephone number where applicable, and details of the chosen payment method and of the order itself.
We use this data to process your order, ship the goods, issue invoices and answer your questions about the order. The legal basis is Article 6 (1) (b) GDPR. Where we are required by law to retain records, further storage is based on Article 6 (1) (c) GDPR.
If you order as a business customer, we additionally process the name and address of your business, your role within it, the VAT identification number where you provide it, and the assignment of your order to a company location. We need this information to perform the contract with your business, to issue the invoice correctly and to apply the prices that are valid for you. The legal basis is Art. 6 (1) (b) GDPR, and Art. 6 (1) (c) GDPR for the details required for tax purposes.
10. Customer account
You can create a customer account with us, but you do not have to. An account makes later orders easier because your details are stored and you can view your order history. The legal basis is Article 6 (1) (b) GDPR.
Logging in and out of the customer account is carried out technically by Shopify. You are redirected to an address on the shopify.com domain, where you enter your email address and receive a login code. Your email address and technical information about the login process are processed in this context. You are then returned to our shop. The processing on our behalf described under section 2 applies.
You can have your customer account deleted at any time. Please contact the address stated above. Statutory retention obligations for orders already completed remain unaffected.
If your account is assigned to a business, one particularity applies: your business may name several people as buyers. All named people see the orders of the respective location, regardless of who placed them. Your name and your email address are visible to these people. We also process the assignment of your account to your business and to a location as well as your permissions. The legal basis is Art. 6 (1) (b) GDPR.
If you leave the business, the business removes your permission, or you inform us. Orders already completed remain assigned to the business.
11. Application for business customer access
You can apply for access using the form on our page for business customers. In doing so we process the name and location of your business, the type of business, your name, your email address, your telephone number, your details on your monthly requirements and any voluntary remarks.
We use this information to review your application, to contact you and, if we approve it, to set up your business and your access. The legal basis is Art. 6 (1) (b) GDPR, as the processing serves the initiation of a contract.
To verify your status as a business, we may consult publicly available sources such as the commercial register, the German company register or the confirmation of a VAT identification number with the Federal Central Tax Office. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in reserving the business customer area for businesses.
If we decline an application, we delete the information no later than six months after the decision, unless statutory retention obligations apply. If we approve it, the periods set out in section 19 apply.
12. Payment processing
Various options are available for payment. The payment details entered during the ordering process are processed by the respective payment service providers, not by us. We do not receive complete credit card details at any time.
Shopify Payments: the provider is Shopify International Limited (address as above). Shopify Payments handles credit card payments, Shop Pay, Apple Pay and Google Pay, among others. Further information can be found at shopify.com/legal/privacy.
PayPal: the provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. If you pay with PayPal, your payment data is transmitted to PayPal. Further information can be found at paypal.com.
Klarna: the provider is Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, represented in Germany by Klarna Bank AB, German Branch, Chausseestraße 117, 10115 Berlin, Amtsgericht Charlottenburg HRB 217291 B. If you select a Klarna payment method, we transmit the data required for processing to Klarna. Klarna processes this data under its own responsibility.
For payment methods involving deferred payment, such as purchase on account or payment by instalments, Klarna carries out its own identity and credit check and may obtain information from credit agencies for this purpose. We have no influence on this check or its outcome. The legal basis for this is Klarna's legitimate interest in securing against the risk of payment default pursuant to Article 6 (1) (f) GDPR. Further information and the rights available to you vis-à-vis Klarna can be found in Klarna's privacy notices at klarna.com.
The legal basis for the transfer to the payment service provider you have selected is Article 6 (1) (b) GDPR, as it is necessary for the performance of the contract.
13. Shop Pay and Sign in with Shop
Components of the Shop Pay service operated by Shopify are loaded on our pages. Shop Pay enables an accelerated checkout in which address and payment data can be stored for returning customers. This also includes the "Sign in with Shop" function.
The technical components of this function are already loaded when our pages are accessed so that the checkout is available without delay. Your payment and address data is only processed by Shop Pay once you actively use the function. In that case, Shopify processes the data you enter under its own responsibility. The legal basis is Article 6 (1) (b) GDPR for the performance of the contract and otherwise Article 6 (1) (f) GDPR based on our interest in a smooth ordering process. Further information can be found at shopify.com/legal/privacy.
14. Shipping
In order to deliver your order, we pass on your name and delivery address to the shipping company engaged. We ship with DHL. If you have provided us with your email address or telephone number for shipment tracking, these may also be transmitted. The legal basis is Article 6 (1) (b) GDPR.
To create shipping labels we use an application provided by DHL that is connected to our shop. It accesses the order and customer data required for shipping. The transfer takes place in order to perform the contract pursuant to Article 6 (1) (b) GDPR.
15. Accounting
For accounting purposes we transfer order and invoice data from our shop to the accounting software Lexware Office. The data transferred is the information required to create and post invoices, in particular name, address, email address and the details of the order.
The connection between our shop and the accounting software is provided by an application of Eshop Guide GmbH, Husemannplatz 5a, 44787 Bochum, Germany, registered in the commercial register under HRB 18144. The provider of the accounting software itself is Haufe Group SE, Munzinger Straße 9, 79111 Freiburg im Breisgau, Germany, Amtsgericht Freiburg HRB 722188. Both process the data on our behalf on the basis of a data processing agreement pursuant to Article 28 GDPR.
The legal basis is Article 6 (1) (c) GDPR, as we are required by law to keep proper accounts and to retain records.
16. Newsletter
If you subscribe to our newsletter, we process your email address in order to send you information about our products, offers and events. The legal basis is your consent pursuant to Article 6 (1) (a) GDPR.
Subscription procedure: subscription takes place using the double opt-in procedure. After you sign up, you receive an email in which you must expressly confirm your subscription. Only then do we add you to the distribution list. This ensures that no one can be subscribed using someone else's email address.
Evidence data: to demonstrate your consent, we store the time of subscription, the time of confirmation and the IP address used. The legal basis for this is Article 6 (1) (c) GDPR in conjunction with our obligation to demonstrate consent pursuant to Article 7 (1) GDPR.
Dispatch service provider: your subscription is first recorded and confirmed via the Shopify platform. To send the newsletters we use the Brevo platform, to which your email address is transmitted for this purpose. The provider and contracting entity for us is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, registered in the commercial register of Amtsgericht Charlottenburg under HRB 133191. It is a subsidiary of Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France. Brevo processes your data on our behalf on the basis of a data processing agreement pursuant to Article 28 GDPR. Brevo also analyses whether and when a newsletter email was opened and whether links contained in it were clicked, so that we can better tailor our newsletters to the interests of our recipients. This analysis is part of your consent.
Retention period: we store your data for as long as your consent is in place. After a withdrawal we delete your email address from the distribution list. We retain the evidence data relating to your consent and your withdrawal for the duration of the statutory limitation periods in order to be able to demonstrate the lawfulness of the earlier dispatch.
Withdrawal: you can withdraw your consent at any time with effect for the future. Please use the unsubscribe link at the end of every newsletter email or write to us at hello@bunca.de. The lawfulness of the processing carried out until the withdrawal remains unaffected.
17. Contacting us
If you contact us by email, by telephone or via a form, we process your details in order to answer your enquiry. The legal basis is Article 6 (1) (b) GDPR where your enquiry relates to the initiation or performance of a contract, otherwise Article 6 (1) (f) GDPR based on our legitimate interest in answering enquiries.
We delete your enquiry and the associated correspondence as soon as the matter has been concluded and no statutory retention obligations prevent this.
18. Recipients and transfers to third countries
We only pass on personal data where this is necessary for the performance of the contract or where we are legally obliged to do so. Recipients are in particular the platform operator, the payment service providers, the shipping company, the providers of our accounting software and its interface, our newsletter dispatch service provider and our tax advisor. If you have consented to the session analysis under section 6 or the website analysis under section 7, Microsoft or Google respectively is added as a recipient.
Processing outside the European Union may take place at Shopify, in particular in Canada and in the United States. An adequacy decision of the European Commission exists for Canada. For transfers to the United States we rely on the EU-US Data Privacy Framework or on standard contractual clauses pursuant to Article 46 (2) (c) GDPR. If you have consented to the session analysis under section 6 or the website analysis under section 7, processing by Microsoft or Google in the United States takes place in addition.
19. Retention period
We store personal data only for as long as is necessary for the purposes stated. We retain data from orders beyond this for as long as commercial and tax retention obligations exist. Under Section 257 of the German Commercial Code and Section 147 of the German Fiscal Code these are six or ten years depending on the document. Processing is restricted during this period.
20. Your rights
You have the following rights with regard to your personal data:
- Right of access pursuant to Article 15 GDPR
- Right to rectification pursuant to Article 16 GDPR
- Right to erasure pursuant to Article 17 GDPR
- Right to restriction of processing pursuant to Article 18 GDPR
- Right to data portability pursuant to Article 20 GDPR
- Right to object to processing pursuant to Article 21 GDPR
If you have consented to processing, you can withdraw that consent at any time with effect for the future.
21. Right to object
Where we process data on the basis of legitimate interests pursuant to Article 6 (1) (f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
22. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The authority responsible for us is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden, Germany
Phone: +49 611 1408-0
Email: poststelle@datenschutz.hessen.de
23. Necessity of providing data
The provision of your data is neither required by law nor by contract. However, without the details required for an order we cannot conclude a contract with you and cannot fulfil your order.
24. No automated decision-making
Automated decision-making, including profiling, pursuant to Article 22 GDPR does not take place.
25. Electronic withdrawal function
Using the button "Vertrag widerrufen" in the footer you can withdraw from your contract directly on our website. The function is available at widerruf.bunca.de and needs no customer account. We process your name, the details identifying your contract and the email address to which we send the confirmation of receipt. Under section 356a(2) of the German Civil Code we are not permitted to ask for more than these three details, and you do not have to give a reason.
We use this data to receive your withdrawal, to confirm its receipt to you stating date and time, and to reverse the contract. The legal basis is Art. 6(1)(b) GDPR for reversing the contract and Art. 6(1)(c) GDPR for the confirmation of receipt required by law and its documentation.
The page runs on our own web space at IONOS SE, Elgendorfer Strasse 57, 56410 Montabaur, Germany, which processes the data on our behalf pursuant to Art. 28 GDPR. The servers are located in Germany. Your details are not stored in a database; they are sent by email to us and to you. No third-party services are embedded and no cookies are set.
26. Changes to this privacy policy
We adapt this privacy policy as soon as changes to our website or to the legal situation make this necessary. The version published here applies in each case.
Last updated: 16 September 2026
