Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

2. General information on data processing

We process personal data only to the extent necessary to provide our website, process orders, communicate with customers, handle payments, deliver goods and comply with legal obligations.

3. Hosting and server log files

When you access our website, the hosting provider may process technically necessary information. This may include your IP address, date and time of access, pages or files requested, browser type, operating system and referrer URL.

This processing is necessary for the secure and reliable provision of the website and is based on Art. 6(1)(f) GDPR. Our legitimate interest is the technical functionality, stability and security of our online service.

4. Orders and contract fulfilment

When you place an order through our online shop, we process the data necessary to fulfil that order. This may include your name, billing and delivery address, email address, order information and information relating to the selected payment and delivery methods.

The legal basis is Art. 6(1)(b) GDPR. Where we are required to retain data under commercial or tax law, processing is based on Art. 6(1)(c) GDPR.

5. Shopify

We use Shopify for the technical operation of our online shop. Shopify processes data required to provide commerce functions and to process orders as part of the operation of the shop.

6. Payment processing

The data required for payment processing is transmitted to the payment provider selected by you during checkout. The payment methods currently available are displayed during the checkout process. Processing is necessary for performance of the contract pursuant to Art. 6(1)(b) GDPR.

Where payment information is processed directly by a payment provider, we receive only the information required to confirm and administer the order and payment.

7. Shipping and delivery

To deliver your order, we transmit the data required for delivery, particularly your name and delivery address and, where necessary, other information required for delivery, to the shipping provider. We use DHL in particular for shipping. The legal basis is Art. 6(1)(b) GDPR.

8. Customer account

Where a customer account is offered on our website, we process the data required to create and use that account. This may include your name, email address, delivery details and order information. Processing is necessary to provide the account functions requested by you pursuant to Art. 6(1)(b) GDPR.

9. Contact

If you contact us by email, we process the information you provide in order to handle your enquiry. Where the enquiry relates to a contract or pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR. Otherwise, processing is based on our legitimate interest in responding to enquiries pursuant to Art. 6(1)(f) GDPR.

Transactional emails through Resend

We use Resend (Plus Five Five, Inc., USA) as our email-delivery processor for the Contact form, electronic withdrawal function and coffee-comment process. We transmit the contact details and contents required for each message and, for withdrawals, the order or contract identifier, goods or services concerned, additional information, receipt timestamp and reference number. This enables us to handle your enquiry or withdrawal and send receipt and decision messages.

Contract-related and pre-contractual enquiries are processed under Article 6(1)(b) GDPR. Other enquiries are processed under Article 6(1)(f) GDPR; our legitimate interest is to respond appropriately to your communication. Processing necessary for the electronic withdrawal function and its statutory receipt confirmation is based on Article 6(1)(c) GDPR in conjunction with section 356a of the German Civil Code (BGB).

Resend processes and stores data in the United States. An Ireland sending region does not provide EU data residency. Processing is governed by Resend's Data Processing Addendum under Article 28 GDPR, which includes EU Standard Contractual Clauses for international transfers.

According to the provider's current documentation, email and log data on Free, Pro and Scale plans is retained for 30 days while an account is active; Enterprise retention may differ. After termination, the Addendum's deletion provisions apply. Our own retention of business correspondence is governed by the other provisions of this privacy policy.

Coffee comments and purchase verification

If you voluntarily submit a coffee comment, we process your display name, comment, language, email address and order number. Shopify matches the email, order number and coffee against existing order data. Only confirmed purchasers can submit a comment. The legal basis is your consent under Article 6(1)(a) GDPR, which you may withdraw for the future.

The comment is initially stored privately and reviewed by us. We use Shopify and Resend for moderation and the receipt and decision messages. If approved, we publish only the display name, comment, comment language, publication month and “Verified purchase” label. Your email and order number are never published. If declined, you receive the reason by email.

After the moderation decision, we remove the plain email address and order number from the moderation record; the internal order identifier is retained only as a hash to prevent duplicate comments. Approved comments remain available until the comment is removed or a valid deletion request is made. Resend’s retention of the messages it processes is described above.

10. Browser storage and privacy settings

Necessary functions remain available independently of optional consent. The active cart is provided by Shopify. For this purpose, Terroir stores only the technically necessary Shopify cart identifier in the terroir_shopify_cart cookie. This cookie is set by the server, is inaccessible to client-side JavaScript (HttpOnly), is transmitted only over encrypted Production connections (Secure), applies across the website and has a maximum lifetime of ten days. The identifier allows the same Shopify cart to be retrieved on later page views; it does not guarantee that Shopify will keep the cart available for ten days.

Only after your decision do we store terroir-consent in your browser’s localStorage. It contains the version, decision timestamp and your Preferences and Analytics choices, without contact details. The decision is valid for 180 days. After expiry or a material consent-version change, we ask again; optional categories remain off until then. We do not transmit the full record to Shopify. For cart and checkout requests, we transmit only the current true/false values for Analytics and Preferences; Marketing and data sale remain disabled. Shopify carries these bounded consent values into checkout so optional checkout analytics respects the same decision.

With Preferences consent, an explicitly selected language can be stored as terroir-language and read on later visits. Automatic language detection does not store a language preference. Without valid Preferences consent, we remove existing language entries. You can change or withdraw your choice through “Privacy settings” in the footer at any time; withdrawing Preferences removes the saved language. If browser storage is blocked, your choice lasts only for the current page session.

The current Account prototype separately uses trr_users and trr_me in localStorage. It can hold local profile, address, order and payment-display data, and reversibly encoded prototype passwords. Signing out retains local user records. This prototype is not production-ready authentication and is scheduled for replacement by Shopify account architecture; Preferences consent does not legitimize it.

11. Analytics services

With your consent, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand website use and improve our services. The legal bases are Article 6(1)(a) GDPR and, for storing or accessing information on your device, section 25(1) TDDDG. Without Analytics consent, we do not load Google Analytics or send Analytics requests, including consent-free measurement signals.

Measurement may include page views, scrolling, outbound-link clicks, file downloads and selected product, cart, checkout and Coffee Finder interactions, together with technical browser/device information, timestamps and pseudonymous cookie identifiers. Google technically receives your IP address when a connection is made. Our analytics page URLs exclude search terms, other URL query parameters and fragments. When a campaign link contains a complete, technically constrained set of utm_source, utm_medium and utm_campaign values, the analytics page URL may include those campaign values and valid optional UTM values. Free-text, duplicate, incomplete or technically invalid UTM data is discarded; page titles use controlled values. Contact, digital withdrawal and account routes are excluded from our route measurement. After consent, Shopify checkout measurement is limited to shipping-information and payment-information submission with bounded cart values; this checkout pixel sends no contact, address, payment, customer, cart or order identifiers and no purchase event. Form contents and account data are not transmitted. We do not use User-ID or user-provided-data capabilities; our integration disables Google signals and advertising personalization.

When our server-side purchase measurement is active and you have consented to Analytics, Terroir processes a purchase event after Shopify confirms payment. A random, revocable consent reference is carried on the cart and order for this purpose; it contains no contact details. In a PostgreSQL database operated through Databricks’ Neon service in Frankfurt, we store a purpose-limited pseudonymous Google Analytics identifier, an HMAC transaction identifier derived from Shopify’s internal order identifier, currency, total value, tax, shipping, controlled product details and technical processing state. We do not store or send to Google your name, email address, postal address, telephone number, customer or payment data, cart or checkout identifiers, or the unchanged Shopify order identifier. Detailed purchase and webhook data is deleted after 30 days. The consent reference is valid for no more than 180 days; its associated record is deleted no later than 30 days after expiry or withdrawal unless temporarily required by an unfinished processing operation. Solely to prevent duplicate purchase events, the pseudonymous HMAC transaction identifier is retained for 14 months. Withdrawal suppresses purchase events not yet transmitted, but does not retroactively delete data already sent to Google. The purchase event is initially not linked to a browser session, campaign or User-ID, and past orders are not transmitted retrospectively.

When you move from Terroir to Shopify checkout after granting Analytics consent, Google adds the short-lived _gl parameter immediately before navigation. It contains only pseudonymous Google Analytics cookie identifiers so the same visit and original campaign attribution can continue in checkout; it is sent only to the exact Shopify checkout host, is valid for about two minutes according to Google, and is not stored separately by Terroir.

The _ga and _ga_CSKWCG6NLW cookies help recognize visits. Our integration configures a 180-day lifetime without automatic renewal; browsers may impose shorter limits. Retention at Google depends on the Analytics property settings and provider terms. A specific property retention period is not confirmed here. You can withdraw consent for the future at any time through “Privacy settings” in the footer. We then stop further analytics events and remove identifiable GA cookies belonging to this integration where technically possible. Withdrawal does not retroactively delete data already transmitted.

Google may also process data through Google LLC and other affiliates outside the European Economic Area. Processing exclusively within the EU is not guaranteed. Google’s processing terms include international-transfer arrangements, including Standard Contractual Clauses where applicable. See Google’s use of data from partner sites and the Google Data Processing Terms. No marketing or advertising trackers are installed.

12. Retention period

We retain personal data only for as long as necessary for the relevant processing purpose or for as long as statutory retention obligations apply. Once the purpose no longer applies and statutory retention periods have expired, the data is deleted unless another legal basis permits its continued storage.

13. Recipients and service providers

Personal data may be disclosed, to the extent necessary, to service providers that support us in operating the online shop, processing payments, hosting the website and delivering orders. Data is disclosed only where necessary for the relevant purpose and permitted under applicable data-protection law.

14. Your rights

Under the GDPR, you have in particular the following rights:

• Right of access under Art. 15 GDPR
• Right to rectification under Art. 16 GDPR
• Right to erasure under Art. 17 GDPR
• Right to restriction of processing under Art. 18 GDPR
• Right to data portability under Art. 20 GDPR
• Right to object under Art. 21 GDPR
• Right to lodge a complaint with a data protection supervisory authority

15. Competent supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW) is, in particular, the supervisory authority responsible for us.