Privacy Policy

In compliance with Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018 (LOPDGDD).

Data Controller:

Identity: Michael Wolf trading as The Coffee Canvas

NIF: Z1922196E

Address: Calle Gran Capitán, 80 | 04003 | Almería | Spain

Email: hello @thecoffeecanvas.com

When you submit an order request through our website form, we collect the following personal data:

• Full name

• Company or event name

• Email address

• Information you voluntarily provide about your order (quantity, occasion, design notes)

We do not collect payment information directly. We do not collect sensitive personal data.

Purpose and Legal Basis for Processing:

| Purpose | Legal Basis |

• Processing and responding to order requests | Execution of a pre-contractual relationship (Art. 6.1.b GDPR)

• Managing confirmed orders and customer relationships | Execution of a contract (Art. 6.1.b GDPR) |

• Sending order-related communications | Execution of a contract (Art. 6.1.b GDPR) |

• Sending marketing communications (only if you have consented) | Consent (Art. 6.1.a GDPR) |

• Compliance with legal obligations | Legal obligation (Art. 6.1.c GDPR) |

Data Retention:

Your personal data will be retained for the duration of our commercial relationship and for a minimum of five (5) years after its conclusion, in compliance with applicable Spanish tax and commercial law obligations. If you consent to marketing communications, your data will be retained until you withdraw your consent.

Recipients of Your Data:

Your personal data will not be sold or transferred to third parties, except:

• Service providers acting as data processors who assist in the operation of our business (e.g. email platform, order management tools), bound by data processing agreements

• Public authorities, where required by law

Your personal data is processed by The Coffee Canvas within the EEA. However, some of our service providers (including our website hosting provider, Hostinger) may process data outside the EEA. Where this occurs, transfers are protected by EU Standard Contractual Clauses or other appropriate safeguards in accordance with GDPR Articles 44–49. For more information, see Hostinger's Privacy Policy at www.hostinger.com/legal/privacy-policy.

Your Rights:

Under GDPR and LOPDGDD, you have the following rights regarding your personal data:

• Right of access - to know what data we hold about you

• Right of rectification - to correct inaccurate or incomplete data

• Right of erasure - to request deletion of your data ("right to be forgotten")

• Right to restriction of processing - to limit how we use your data

• Right to data portability - to receive your data in a structured, machine-readable format

• Right to object - to object to processing based on legitimate interest or for direct marketing

• Right to withdraw consent - at any time, without affecting the lawfulness of processing prior to withdrawal

To exercise any of these rights, please send a written request to hello@thecoffeecanvas.com, including a copy of your identity document. We will respond within one (1) month of receipt.

If you believe your rights have not been respected, you have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD) at www.aepd.es, or with the data protection authority of your country of residence within the EU.

Data Security:

The Coffee Canvas implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or disclosure, including HTTPS encryption and restricted access to personal data.