Privacy

The data controller is S.U.D.A.N. S.r.l., with registered office at Via Privata Tanaro 7/A, 20128 Milan, Italy, VAT no. 03161490150. Caffè Carati is one of its brands.

For privacy information and to exercise your rights, you can write to operazioni@caffesudan.com, to our certified email (PEC) address sudancaffe@pecdata.it or to our registered office address.

We have not appointed a data protection officer (DPO).

When you browse, the services that host and protect the site process technical data such as your IP address, the browser you use, the page requested and the date and time of access.

When you request a tasting, we collect the name of your bar, your town or city, your name and your phone number. You can add your email, the blend you would like and a message. We also record the date of the request, its handling status and any link to the contact created in our management system.

The form uses a check field and the time elapsed since the page was opened to counter automated submissions. These values are not stored in the request record.

To limit abuse, we derive a protected fingerprint from your IP address. This is pseudonymised data, not anonymous data. The plain IP address is not saved in the request record, but it may appear in our providers’ technical logs.

When you write to us or phone us, we process the contact details and information you give us in order to reply to you.

In your message, include only information relevant to your request. Avoid health data, identity documents and unnecessary personal information.

We use the form data to call you back, arrange the tasting and handle the follow-up to your request, including through our agents.

If you are acting for your own business as a sole trader, the legal basis is taking the pre-contractual steps you have asked us to take: Article 6(1)(b) GDPR.

If you are writing on behalf of a company, the legal basis is our legitimate interest in replying and in managing relations with its contact persons: Article 6(1)(f) GDPR. The same interest justifies replying to other communications we receive, where the contractual basis does not apply.

We process technical and anti-spam data to run the site and prevent abuse, on the basis of our legitimate interest in the security of the service.

Where necessary, we process data to comply with legal obligations, under Article 6(1)(c) GDPR, or to establish, exercise or defend legal claims, on the basis of the legitimate interest provided for in Article 6(1)(f) GDPR. Text of the GDPR.

We do not use contacts collected through the site to send promotional emails. We do not ask for your consent to processing in order to handle your request.

Filling in the form is your choice and is not a legal obligation.

The name of your bar, your town or city, your name and your phone number are required to submit the form and arrange to get back to you. If you do not provide them, you can still use the contact details on the Contact page.

Email and message are optional. You can leave the blend set to “Not sure yet”: this does not stop you from requesting a tasting.

Technical data about your connection is needed in order to use the site.

The form sends the data over an encrypted connection to Bottega, our internal management system. The request goes into a queue reserved for managers. A manager reviews it and may either transfer it to the Onda Vision management system, to arrange to get back to you, or discard it.

Managers may receive a notification containing the name of the bar, town or city, blend and a link to the request. The content of the Web Push notification is encrypted by Bottega all the way to the browser on the recipient’s device. The delivery service processes the technical data needed to deliver it. How Web Push encryption works.

If the form does not receive confirmation that it has been sent, it tries to open your email program with a pre-filled email addressed to operazioni@caffesudan.com. The email is sent only when you send it yourself. Without JavaScript, the form uses this method directly.

Our business mailbox uses Microsoft 365. Your email service operates under its own terms and privacy notices.

The following may access the data, to the extent necessary:

• authorised staff and the agents responsible for getting back to you and for the tasting;
• providers of hosting, email, management systems, IT support and notification delivery;
• authorities and other recipients provided for by law or needed to protect a right.

Providers that process data on our behalf act as data processors, under the agreements provided for in Article 28 GDPR. For some technical and service data, they may act as independent controllers, under their own privacy notices.

Request data is not published on the site.

Vercel Inc. hosts the site through an international network and may also process technical data in the United States.

Railway Corporation hosts Bottega and its database in California, in the United States. Data sent through the form is therefore transferred to the United States.

Vercel and Railway state that they participate in the EU-US Data Privacy Framework. The European adequacy decision applies to recipients holding a valid certification and to the processing covered by it. Their agreements also include the European Commission’s standard contractual clauses for transfers that require them, together with the applicable protection measures. Vercel privacy notice, Vercel agreement, Railway privacy notice, Railway agreement.

For Microsoft 365, subscriptions registered in Italy and covered by the EU Data Boundary provide for storage and processing in the European Union and EFTA countries. The exceptions documented by the provider still apply, including some access for support and some processing for security purposes. For transfers outside the European Economic Area, Microsoft provides the safeguards described in its agreements, including standard contractual clauses. Data location, transfer safeguards.

Onda Vision is provided in the private cloud of EdiSoftware, which also manages its backups. The service is hosted on Microsoft Azure, on servers in the European Union, in Ireland.

Notification delivery services may also use infrastructure outside Europe. The content travels encrypted all the way to the device; for any transfers of personal data, the safeguards provided for the service used apply.

You can ask for information and a copy of the applicable safeguards by writing to operazioni@caffesudan.com.

We apply the following periods:

• Requests that do not become business relationships: deletion within 12 months of the last substantive contact with you. If there has been no other contact, the period runs from the request. Internal activities alone do not restart it.
• Discarded requests, spam and duplicates: deletion within 30 days of being discarded.
• Copy in Bottega after transfer to Onda: deletion within 90 days of the verified transfer. Data remaining in Onda follows the periods set for the request or for the business relationship.
• Fingerprint derived from the IP address: deletion within 24 hours of collection, separately from the other data.

If you become a customer, we keep the data needed to manage the relationship. Documents subject to legal obligations or needed to protect rights follow their own retention periods. This does not automatically extend the retention period for the form as a whole.

Requests received by email follow the same time limits. We delete emails that are simply a copy of a request within 90 days of its verified transfer to Onda. If handling continues by email, the 12-month period from the last substantive contact applies, or the period for the business relationship. Deletion covers received and sent messages, attachments and the deleted items folder, and is carried out by the staff responsible.

After deletion from the mailbox, technical copies may remain recoverable according to Microsoft 365 settings and timescales: normally 14 days, which can be extended to up to 30, unless specific retention obligations apply. These copies are not used for ordinary operations. Data deletion in Exchange Online.

The request queue in Bottega is excluded from our backups. Data transferred to Onda, on the other hand, is included in the backups managed by EdiSoftware.

The platforms’ technical logs are kept for the periods set by the provider and the service used, for operational, security and abuse-detection purposes. The period for which logs can be viewed in the dashboards does not necessarily coincide with the period after which all internal records are deleted. Railway logs, Vercel logs.

If a specific obligation or a dispute requires longer retention, we keep only the data needed, for the relevant period.

The site does not use application cookies, persistent local storage or session storage, advertising tools or visitor analytics tools. It does not create identifiers to recognise you on later visits.

The images on the Home page and the symbol shown in the intro are chosen at random, without remembering the previous choice. To decide whether to show the intro on other pages, the site uses the information about the page you came from that your browser provides, without saving it in local storage.

Your browser may keep technical copies of images, fonts and other site files in its cache so that they load faster. You can delete them in your browser settings.

We do not use tools that require the consent provided for by Article 122 of the Italian Privacy Code; that is why we do not show a consent banner. Guidance from the Garante (the Italian Data Protection Authority).

In the cases provided for by the GDPR, you can:

• access your data and receive a copy of it;
• correct or complete it;
• ask for it to be erased or for its processing to be restricted;
• receive the data you have provided in a structured format and transfer it to another controller, where the conditions for portability are met;
• object to processing based on legitimate interest, on grounds relating to your particular situation.

If you object, we stop the processing unless there are overriding compelling legitimate grounds or we need to establish, exercise or defend legal claims.

Write to operazioni@caffesudan.com. We reply without undue delay and within one month. In the cases provided for by the GDPR, we may extend this period by a further two months, telling you the reason within the first month. Information on your rights.

You can lodge a complaint with the Garante per la protezione dei dati personali and apply to the courts.

The form uses anti-spam checks that may block or ignore some submissions. You can always contact us by email or phone.

The commercial assessment is made by a person. We do not carry out profiling, nor do we take decisions based solely on automated processing that have legal or similarly significant effects on you.

Before using the data for other purposes, we will give you the necessary information and check the applicable legal basis.