Privacy policy
Privacy Policy - CaAmo Coffee
Last updated: 8 September 2026
1. Who we are
-------------
The controller of your personal data is HRT GLOBAL Sp. z o.o., with registered office at ul. 1 Maja 4, 33-200 Dabrowa Tarnowska, Poland.
Contact for privacy matters: sales@caamo.coffee .
Company identifiers: NIP 8711784402, REGON 529891529, KRS 0001131623.
2. Scope of this Policy
-----------------------
This Policy explains how we process personal data when you visit caamo.coffee, purchase or request products, request a quotation, use store features, subscribe to marketing communications, contact us, or interact with us as a current or prospective business customer, supplier or partner.
3. Personal data we process
---------------------------
Depending on how you interact with us, we may process:
- identity and contact data, such as name, surname, email address, telephone number and billing/shipping address;
- company data, VAT number and professional role where relevant;
- order, quotation, product, delivery and transaction information;
- customer service messages and other correspondence;
- newsletter subscription and consent/withdrawal records;
- professional contact information and source information for B2B relationship management;
- technical and usage data such as IP address, browser/device information, cookies and security logs where collected by the store or its service providers.
Payment card or other payment credentials are generally processed directly by payment service providers. We may receive payment status, transaction identifiers and related information necessary to process orders, refunds and accounting.
4. Business contacts and data obtained from public sources
----------------------------------------------------------
As part of B2B sales and supplier/customer relationship management, we may obtain professional contact details from sources other than the individual concerned. These sources may include:
- company websites and public contact pages;
- public business directories and registers;
- professional networking platforms;
- trade fairs, exhibitions and industry events;
- publicly available business profiles, including map and directory services;
- referrals and other lawful business sources.
The categories of data typically include name and surname, job title or function, company name, professional email address, professional telephone number, country, source of the contact details, and information relevant to a potential or existing business relationship.
We process such data primarily on the basis of our legitimate interests under Article 6(1)(f) GDPR, including identifying potential business partners, managing B2B relationships, responding to business opportunities, documenting communications and organising follow-up activities. Where processing is necessary to take steps at the request of an individual before entering into a contract, Article 6(1)(b) GDPR may also apply.
Where a company or professional contact makes an email address or telephone number available specifically for commercial enquiries, supplier proposals, quotation requests or similar business contact, or where a person asks us during a telephone call or other interaction to send information or an offer to a specified address, we may use that contact channel within the scope of that invitation or request.
Where Article 14 GDPR applies because personal data was not obtained directly from you, we provide the required information within the applicable time limit and, where we communicate with you, no later than at the time of the first communication, unless an exception under the GDPR applies.
5. CRM and AI-assisted business relationship management
-------------------------------------------------------
We may use customer relationship management (CRM) systems and AI-assisted tools to support business relationship management. Depending on the context, this may include processing professional contact details, correspondence, quotations, product interests, expected purchasing volumes, previous offers, target prices, follow-up dates and other information relevant to a business relationship.
These tools may be used to:
- organise and search business contact information;
- summarise communications and sales notes;
- schedule and prioritise follow-ups;
- identify products that may be relevant to an existing or potential business discussion;
- prepare internal sales recommendations and draft communications;
- maintain continuity of customer service and sales activity.
We may use specialised providers acting on our behalf, including e-commerce, CRM, cloud, IT and AI service providers. At the date of this Policy, these may include Shopify for website and e-commerce functions, Pipedrive for CRM functions and OpenAI services, including ChatGPT Business, for AI-assisted workflows. The exact providers used may change over time, provided that appropriate contractual, organisational and technical safeguards are maintained.
AI tools are used as support tools. We do not use them to make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect that individual within the meaning of Article 22 GDPR.
6. Purposes and legal bases
---------------------------
Depending on the circumstances, we process personal data for the following purposes and legal bases:
- to respond to enquiries and take steps requested before entering into a contract - Article 6(1)(b) GDPR where applicable;
- to perform contracts and manage orders, deliveries, payments and customer service - Article 6(1)(b) GDPR where applicable;
- to manage B2B relationships, maintain CRM records, organise follow-ups, assess business opportunities and protect our legal claims - Article 6(1)(f) GDPR;
- to comply with accounting, tax and other legal obligations - Article 6(1)(c) GDPR;
- to send newsletter or other electronic marketing communications where consent or another legally recognised basis for that communication channel is required and has been established.
7. Newsletter and marketing communications
------------------------------------------
If you subscribe through the CaAmo Coffee website to receive updates with prices and information about available coffee beans, or otherwise give the required consent, we may send you product availability updates, price information, market updates, offers and other commercial communications consistent with the subscription presented to you. You can withdraw consent or unsubscribe at any time using the unsubscribe mechanism in the message or by contacting us at sales@caamo.coffee .
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. We may retain limited suppression information so that we can respect your request not to receive further marketing communications.
For B2B prospecting, we may process professional contact data and assess potential relevance under Article 6(1)(f) GDPR. Where a company or professional contact expressly invites commercial enquiries, supplier proposals or quotation requests through a published contact channel, or where a person asks us during a call or other interaction to send an offer or information to a specified email address, we may use that channel within the scope of that invitation or request.
Where the use of an electronic communication channel for commercial information or direct marketing requires prior consent under applicable law, we use that channel only when the relevant legal requirement has been met. A generic email address published without context is not treated by us as a blanket consent to receive any form of marketing communication.
8. Recipients and service providers
-----------------------------------
Personal data may be disclosed or made available, where necessary, to:
- hosting, website and e-commerce service providers;
- CRM, cloud, IT and AI service providers;
- email, newsletter and communication service providers;
- payment service providers and financial institutions, where relevant;
- shipping, logistics and fulfilment partners, where relevant;
- accounting, legal and professional advisers;
- public authorities where required by law.
Where a provider acts as our processor, it processes personal data on our documented instructions and under appropriate contractual safeguards.
9. International transfers
--------------------------
Some service providers or their subprocessors may process personal data outside the European Economic Area. Where this occurs, we rely on a lawful transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where applicable, or another mechanism permitted by data protection law, together with supplementary safeguards where required.
10. How long we keep personal data
----------------------------------
We retain personal data only for as long as necessary for the purpose for which it was collected and for any additional period required by law or reasonably necessary to establish, exercise or defend legal claims. Business prospect records are periodically reviewed and may be deleted or anonymised when there is no longer a reasonable business purpose or other legal basis for retaining them.
11. Your data protection rights
-------------------------------
Subject to the conditions of the GDPR, you may have the right to:
- access your personal data;
- have inaccurate data corrected;
- request erasure of data;
- request restriction of processing;
- object to processing based on legitimate interests, including direct marketing-related processing;
- receive data portability where applicable;
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
- lodge a complaint with a competent supervisory authority, including the President of the Personal Data Protection Office (UODO) in Poland.
To exercise your rights, contact us at sales@caamo.coffee . We may need to verify your identity before acting on a request.
12. Security
------------
We apply appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. Measures may include access controls, multi-factor authentication, encryption provided by relevant service providers, device security, role-based permissions, contractual controls and periodic review of integrations and user access.
13. Cookies and similar technologies
------------------------------------
Our websites may use cookies and similar technologies for essential operation, security, preferences, analytics and, where applicable, marketing. Non-essential cookies are used only where permitted by applicable law and, where consent is required, after consent has been obtained. Cookie choices should be available through the website cookie banner or settings where such technologies are used.
14. Changes to this Policy
--------------------------
We may update this Policy when our services, legal obligations or data-processing practices change. The current version will be published on the relevant website with the date of the latest update.
15. Contact
-----------
For questions about privacy or the processing of personal data, contact HRT GLOBAL Sp. z o.o. at sales@caamo.coffee or at ul. 1 Maja 4, 33-200 Dabrowa Tarnowska, Poland.