Data protection

As of October 27, 2026

Who is responsible for your data

Michael Kiels, sole trader trading as Origen 100% Colombian Coffee, Kettelerstrasse 31, 79761 Waldshut-Tiengen, Germany. If you have any questions or wish to exercise your rights, please write to info@origencolombiancoffee.com.

When you visit this website

Our website runs on Shopify. When you access it, Shopify processes technical data such as your IP address, browser, device, and the pages you visit. This is necessary to provide the website and protect it from misuse. This is based on our legitimate interest in maintaining a secure, functioning website under Art. 6(1)(f) GDPR.

When you express interest in a coffee

We receive your email address, the coffee and package size you selected, your consent, and, if applicable, your message. The request is submitted via the Shopify contact form to our support team by email. We use this information to process your request and send you a message as soon as the desired coffee becomes available for order. This does not constitute an order or a subscription to a newsletter.

The availability notification is sent with your consent under Art. 6(1)(a) GDPR. You can revoke it at any time with future effect by emailing info@origencolombiancoffee.com. The lawfulness of processing carried out before revocation is unaffected. We cannot notify you without an email address and your consent. Registration is voluntary.

To plan our range, we count requests for coffee and package sizes. We do not need to analyze your personal data for this purpose. We delete the registration data upon revocation or, at the latest, twelve months after your request. After the availability notification, we delete it within 30 days, unless statutory retention obligations or the defense of legal claims require longer storage. For the necessary proof of consent, we only store the information required for this purpose.

Other contact requests

If you contact us via a form or by email, we process your contact details and the content of your message to handle your request. For questions regarding a potential contract, the basis is Art. 6(1)(b) GDPR; otherwise, it is our legitimate interest in responding under Art. 6(1)(f) GDPR. We delete completed requests as soon as they are no longer needed, unless statutory retention obligations prevent us from doing so.

Shopify and other recipients

Shopify International Limited, c/o Intertrust Ireland, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland, provides the platform. Technical service providers, email providers, and authorized members of our team receive data to the extent necessary for the respective purpose. Shopify may also use affiliated companies and service providers outside the European Economic Area, particularly in Canada and the United States. Depending on the recipient, the transfer is based on an adequacy decision, Shopify's approved binding corporate rules, or appropriate safeguards such as the EU Standard Contractual Clauses. Further details can be found in Shopify's Privacy Notice and the Data Processing Agreement.

Additional Shopify features

Shopify Network Intelligence is enabled in the store. Shopify processes information about visits and interactions, also in combination with data from other Shopify stores, to improve services, tailor content, and make advertising more relevant. This data may be shared with Shopify and other service providers abroad. Shopify itself is responsible for data protection for these additional purposes. Your choice in the cookie banner is taken into account: without consent to optional cookies, device data from this visit will not be used for these additional purposes. You can find out more in Shopify's Privacy Notice for Consumers. You can also exercise your data protection rights against Shopify via the Shopify Privacy Portal.

Cookies and browser storage

Shopify uses technically necessary cookies, for example for security, language, and forms. Where access to your device is technically necessary, it is based on § 25(2) TDDDG. Your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR is required for optional analytics or marketing features. You can change a given consent via the cookie settings at the bottom of the page. Our inquiry form does not store your email address or message in your browser.

Your rights

Subject to statutory requirements, you have the right to access, rectification, erasure, restriction of processing, and data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation. You can object to direct marketing at any time. You can revoke your consent at any time. No decision is made solely on the basis of automated processing, including profiling, that produces legal effects or similarly significant effects.

You can lodge a complaint with a data protection supervisory authority, for example the Baden-Württemberg State Commissioner for Data Protection and Freedom of Information.