Privacy Policy

Last updated: 6 November 2026

This policy explains what personal data Cafendo processes when you visit cafendo.com, create an account, save favourites, write reviews, subscribe to our newsletter or manage a roaster profile, why we do it and what rights you have. We process personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Romanian data protection law.

Who we are

Cafendo is a trade name of WEB PUSH S.R.L., a Romanian company with its registered office at Strada Gheorghe Doja nr. 24, ap. 6, Oradea, Bihor County, Romania, registered with the Trade Register under no. J05/533/2015, tax identification code RO34330674 ("Cafendo", "we", "us"). We are the controller of the personal data described in this policy.

For any question about your data, write to contact@cafendo.com or by post to the address above, marked "Data protection".

What Cafendo is, and what that means for your data

Cafendo is a guide to independent specialty coffee: we show coffees, equipment and roasters from many independent shops. We do not sell anything, take no orders and take no payments. When you click "Buy" or visit a roaster's website, you leave Cafendo and continue on the roaster's or retailer's own shop. That shop is responsible for your order, payment, delivery and any personal data you give it there, under its own privacy policy.

What data we process

When you simply browse

Technical data: your IP address, browser and device type, the pages you request and the time of the request. Our hosting provider records these in server logs to deliver the site and keep it secure.
Your choices on the site: the language you picked and the country you want coffee shipped to, kept in small cookies (see our Cookie Policy).
Visit statistics: we use Ahrefs Web Analytics to count visits, popular pages and where visitors come from. It works without cookies and does not identify you personally, and it runs only if you allow visit statistics in the cookie banner.
Clicks to shops: when you click a "Buy" button or a roaster's website link, we record which product or roaster it was, the time, the language of the page and the country your visit came from (as a two-letter code). We do not store your IP address or link these clicks to your account. We use these counts to show roasters how many visitors Cafendo sends them.

When you create an account

Your email address and password (stored only as a secure one-way hash, never in readable form);
Your first and last name, if you give them;
The language you chose for your account;
The coffees you save as favourites;
Reviews you write: your rating, your text and the name shown with it (your first name and the initial of your last name).

Accounts created on the former Cafendo shop were carried over with the data held for them then (such as name, email, and in some cases phone number and address). We do not use the phone number or address for anything on the current site, and you can ask us to delete them, or your whole account, at any time.

When you manage a roaster profile

If you use a roaster account, we also process the profile details you send us (website, city, country, social media links, logo and cover picture) and the email address of the account that sent each change, so we can review changes before they are published.

When you subscribe to our newsletter

We process your email address, the language of the page you subscribed on, where on the site you subscribed, and the dates you subscribed, confirmed and unsubscribed. You are added to the list only after you confirm by opening the link in the email we send you (double opt-in). Every newsletter has a link to unsubscribe, and you can unsubscribe at any time.

When you write to us

We keep your messages and our replies so we can answer you and follow up.

We do not ask for or knowingly process special categories of data (such as health data), and the site is not intended for children under 16.

Why we use your data and on what legal basis

To run your account (sign-in, favourites, reviews, roaster profile, password reset emails): necessary to provide the service you asked for (Art. 6(1)(b) GDPR).
To deliver the site, remember your language and shipping country, and keep the site secure (server logs, protection against abuse and fraud): our legitimate interest in running a working, safe website (Art. 6(1)(f) GDPR).
To count visits with Ahrefs Web Analytics: your consent, given in the cookie banner (Art. 6(1)(a) GDPR). You can withdraw it at any time from "Cookie settings" at the bottom of every page.
To report clicks to roasters (anonymous click counts): our legitimate interest in showing roasters the value of Cafendo (Art. 6(1)(f) GDPR).
To moderate reviews and roaster profile changes: our legitimate interest in keeping the content accurate and lawful (Art. 6(1)(f) GDPR).
To send you the newsletter you subscribed to: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by unsubscribing; withdrawing it does not affect anything sent before.
To comply with the law, for example when an authority lawfully requests information (Art. 6(1)(c) GDPR).

We do not sell your personal data, we do not show advertising based on your profile, and we do not make decisions about you based solely on automated processing.

We send the newsletter only to people who subscribed and confirmed their address. Account emails (for example a password reset) are sent only when they are needed for your account.

Who processes data on our behalf

We use carefully chosen service providers that process data only on our instructions and under a data processing agreement:

Vercel Inc.: hosting of the website; requests are served from its Frankfurt (Germany) region.
Neon Inc.: hosting of our database.
Cloudflare Inc.: domain name system (DNS) and network services.
Resend (Plus Five Five Inc.): sending account emails such as password resets, and the newsletter.
Ahrefs Pte. Ltd.: cookie-free visit statistics, only if you allow them in the cookie banner.

Some of these providers are based in, or may access data from, the United States or other countries outside the European Economic Area. In those cases transfers are protected by the EU-U.S. Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.

We may also disclose data to public authorities when the law requires it, or to establish, exercise or defend legal claims.

Your public reviews (rating, text and shown name) are visible to everyone who visits the product page.

How long we keep your data

Account data: for as long as you have an account. When you delete it, we delete or anonymise your data within 30 days, except for what we must keep by law.
Reviews: while your account exists; after the account is deleted, a published review may remain without any link to you, shown only with the name it was published under, unless you ask us to remove it.
Server logs: kept by our hosting provider for a short period, usually a few days.
Click counts to shops: do not contain personal data and are kept for statistics.
Newsletter: while you are subscribed. A subscription that is never confirmed is deleted after 30 days. After you unsubscribe we keep your address and the dates for up to 3 years, as proof of your consent and so we never write to you again by mistake.
Messages to us: for as long as needed to handle your request, and up to 3 years afterwards for any follow-up.

How we protect your data

All traffic to cafendo.com is encrypted (HTTPS). Passwords are stored only as one-way hashes, sessions are signed, and access to the database and administration tools is limited to the people who need it. No method of transmission or storage is completely secure, but we work to protect your data and to act quickly if anything goes wrong.

Your rights

Under the GDPR you have the right to:

access your data and receive a copy of it;
rectify inaccurate or incomplete data;
erase your data ("right to be forgotten"), including deleting your account;
restrict processing in certain cases;
data portability: receive the data you gave us in a structured, machine-readable format;
object at any time to processing based on our legitimate interests;
withdraw consent at any time, where processing is based on consent, without affecting what was done before.

To use any of these rights, write to contact@cafendo.com, preferably from the email address of your Cafendo account so we can confirm it is you. We answer within one month; for complex requests this can be extended by two more months, and we will tell you if so. Exercising your rights is free of charge.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, www.dataprotection.ro. We would appreciate the chance to resolve your concern first, so please contact us.

Links to other websites

Cafendo links to roasters' shops, retailers and other websites. When you follow such a link, the other website's privacy policy applies. Links to roasters' shops may carry a tag (for example "utm_source=cafendo") so the shop can see that you came from Cafendo; this tag contains no personal data. Some links to Amazon are affiliate links, marked as such, for which Cafendo may earn a commission on qualifying purchases.

Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell account holders by email or on the site.