Privacy Policy

PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

Cafe Twin — cafetwin.com

Last updated: 19 October 2026

This notice describes how Royal Cafe Twin S.r.l.s. collects, uses, stores and discloses the personal data of people who visit the cafetwin.com website, purchase products, create an account, subscribe to marketing communications or contact customer service.

The notice relates to processing carried out through the online shop, services connected with orders and shipments, marketing activities and the technologies used to measure interactions with electronic communications.

1. Data controller

The Data Controller is:

Royal Cafe Twin S.r.l.s.
Via Mesula 12, 00158 Rome, Italy
E-mail: marketing@cafetwin.com
Telephone: +39 06 8370 5103
Website: https://cafetwin.com/

For requests relating to the protection of personal data, you may contact the Data Controller using the contact details provided above.

2. Categories of personal data processed

Depending on the services used and interactions with Cafe Twin, the following categories of personal data may be processed.

2.1 Identification and contact data

First name, surname, billing and shipping address, e-mail address, telephone number and other information necessary to identify the customer and manage orders.

2.2 Order and transaction data

Products viewed, added to basket or purchased, order history, returns, exchanges, refunds, amounts, currency, payment status, payment method and information necessary for order fulfilment.

2.3 Data relating to the account

Username, information necessary to authenticate the account, preferences and settings, where registration features are provided.

Login credentials are processed in accordance with the technical methods adopted by the platform used.

2.4 Browsing and device data

IP address, online identifiers, browser, device and network information, technical logs, information on website usage and interactions with the pages and available features.

Any use of cookies and similar technologies is described in the Cookie Policy and in the website's consent preferences.

2.5 Communications and customer support

Data and information contained in requests sent to the Data Controller, in communications with customer service and in any disputes relating to orders or services.

2.6 Marketing data

E-mail address, newsletter subscription status, communication preferences, records of consents and withdrawals and, where applicable, information relating to interactions with marketing communications.

2.7 Data relating to e-mail tracking

When tracking is enabled and the related processing is permitted, the following may be collected:

  • opening of an email message, including any subsequent openings;

  • clicks on links contained in the message;

  • date and time of interactions;

  • technical identifiers associated with the recipient or the message;

  • IP address, where detected;

  • information about the device, operating system and email client;

  • technical information and approximate geographical location that may be inferred from the IP address;

  • additional information strictly relevant to the stated purposes and made available by the platform used.

These data may be collected through tracking pixels or equivalent technologies included in communications.

Not all the information listed above is necessarily collected in every mailing: the data actually available depend on the email client, the user's settings and the platform's features.

3. Sources of personal data

Personal data may be collected:

  • directly from the data subject, during browsing, registration, purchase, newsletter subscription or contact with the Data Controller;

  • automatically through the website, the device used and browsing technologies, in accordance with the preferences expressed and the applicable legislation;

  • through Shopify and the other providers involved in managing the store and services;

  • through Global-e, when the data subject makes purchases in international markets managed through that service;

  • through MagNews, for newsletter management activities and, where enabled and permitted, email tracking;

  • through other providers or partners involved in the provision of the services, within the limits of their respective roles and the processing actually carried out.

4. Purposes of processing and legal bases

4.1 Browsing and operation of the website

Technical data are used to enable browsing, make the requested features available, ensure website security, prevent improper use and improve the technical operation of the services.

Legal basis: performance of the requested features, legitimate interest in the security and proper operation of the website, or consent, where required for specific technologies.

4.2 Order and purchase management

Data are used to receive and manage orders, process payments, arrange shipments, handle returns and refunds, provide after-sales support and fulfil obligations connected with the sale.

Legal basis: performance of the contract or pre-contractual measures requested by the data subject, and compliance with legal obligations.

4.3 Payment management and fraud prevention

The data necessary for the transaction may be processed to verify the payment status, manage any disputes, prevent fraud and protect the security of operations.

Legal basis: performance of the contract, compliance with legal obligations and, where applicable, legitimate interest in fraud prevention and transaction security.

Complete payment instrument data may be handled directly by the payment providers, in accordance with their respective privacy policies and operating procedures.

4.4 International checkout, duties and shipping in ROW markets

For purchases made in international markets managed through Global-e, the necessary data may be processed to enable international checkout, calculate or manage applicable amounts, taxes and duties, process payments, arrange shipping, handle customs formalities and assist the customer in relation to the order.

Depending on the destination country, additional information required for customs formalities or for compliance with local regulations may be requested.

Global-e processes the data according to its own role and responsibilities within the scope of the services actually provided. For further information, please consult Global-e's privacy policy:
https://www.global-e.com/consumer-privacy-policy-it

Legal basis: performance of the contract, compliance with legal obligations and, where applicable, legitimate interest in the proper management of transactions and fraud prevention.

4.5 Management of the account and customer service

The data is used to create and manage the account, enable access to the available features, respond to requests, handle complaints and provide assistance relating to purchases.

Legal basis: performance of the contract or requested service and, where applicable, legitimate interest in handling requests and protecting the rights of the Data Controller.

4.6 Newsletter and promotional communications

Subject to consent, where required, Cafe Twin may use contact data to send newsletters, commercial offers, product news, promotions and other communications relating to its activities.

Providing data for marketing purposes is optional. Failure to give consent does not prevent the purchase of products or the receipt of communications necessary for order management.

Where the conditions set out by the applicable legislation are met, contact data collected in the context of a purchase may also be used for communications relating to similar products or services, in compliance with the conditions and the right to object provided by law.

The recipient may stop promotional communications at any time by using the unsubscribe link in the emails or by contacting the Data Controller.

Legal basis: the data subject’s consent, where required, or another basis expressly permitted by the applicable legislation in cases where all the relevant conditions are met.

4.7 Email tracking and campaign measurement

Marketing emails may contain tracking pixels or equivalent technologies that make it possible to detect the recipient’s interactions with the message.

When tracking is active and the conditions laid down by the legislation are met, the data collected may be used to:

  • measure campaign open and click-through rates;

  • assess interaction with messages and content;

  • understand which communications are most relevant;

  • analyse and improve the effectiveness of promotional campaigns;

  • optimise content and sending frequency;

  • carry out statistical analyses and, where permitted, personalise communications on the basis of the interactions observed.

Individual measurement of opens and clicks may make it possible to associate certain events with a specific recipient, including by means of technical identifiers.

In accordance with Article 122 of Legislative Decree 196/2003, Regulation (EU) 2016/679 and the Guidelines of the Italian Data Protection Authority of 17 April 2026, the use of tracking pixels will be notified to the data subject in advance.

In cases where consent is required, tracking will be activated only after prior, freely given, specific and informed consent has been obtained. Any exceptions will be applied exclusively where the conditions laid down by law are met.

The choice not to authorise tracking does not prevent receipt of the newsletters for which the data subject remains subscribed.

Legal basis: prior consent, where required by the applicable legislation, without prejudice to the specific exemptions provided by law for processing that is strictly necessary and appropriately limited.

4.8 Security, legal compliance and protection of rights

Data may be processed to ensure service security, prevent fraud and abuse, comply with tax and accounting obligations, respond to requests from authorities, and establish, exercise or defend a right.

Legal basis: compliance with legal obligations and, where applicable, legitimate interest in security, prevention of abuse and protection of the Controller’s rights.

5. Tracking pixels: consent management and withdrawal

Email tracking is separate from the management of cookies and tracking technologies used while browsing the website.

Any consent to marketing and the preference relating to email tracking constitute separate choices.

Where consent to tracking is required, the data subject must be able to refuse tracking without being required to give up receiving newsletters.

Your tracking preference may be changed using the dedicated functionality made available by Cafe Twin, where implemented, or by submitting a request to the Data Controller.

The Data Controller will adopt the technical and organisational measures necessary to ensure that the withdrawal is respected in subsequent mailings and that tracking is not carried out where there is no valid legal basis.

Withdrawal of consent to tracking does not automatically result in unsubscribing from marketing. Unsubscribing from marketing does not, however, prevent the sending of communications strictly necessary for the performance of orders or compliance with legal obligations.

6. Processing methods and security

Data are processed using electronic tools and, where necessary, by manual means, in accordance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation.

The Data Controller adopts technical and organisational measures appropriate to the risk in order to protect personal data against unauthorised access, loss, alteration, disclosure or unlawful processing.

For email tracking activities, where technically possible and proportionate, data minimisation measures and measures to reduce the identifiability of recipients may be adopted, consistently with the principle of data protection by design and by default.

7. Recipients of personal data

Personal data may be disclosed, within the limits necessary for the purposes described above, to the following categories of recipients:

  • Shopify, as the provider of the e-commerce platform and related services;

  • Global-e, for international checkout, payments, the management of duties and taxes, and shipments in the ROW markets managed through the service;

  • MagNews, for newsletter management and email marketing activities, as well as for tracking interactions when active and permitted;

  • Truendo, for the privacy management, policy and consent functionalities actually used;

  • payment service providers;

  • couriers, logistics operators and suppliers involved in delivery and returns management;

  • hosting, infrastructure, security, customer support and IT service providers;

  • providers of analytics, advertising and marketing tools, where actually used;

  • consultants, professionals and entities assisting the Data Controller in complying with legal obligations;

  • public authorities and other entities authorised to receive the data pursuant to legal provisions.

Depending on the nature of the service and the processing, such parties may act as data processors, independent data controllers or, where the relevant conditions are met, joint controllers.

The Data Controller verifies the actual roles of suppliers and adopts the agreements and safeguards required by the applicable legislation.

8. International data transfers

To enable the provision of services, some data may be transferred, stored or processed in countries other than the data subject's country of residence.

Such transfers may relate, in particular, to e-commerce services, international checkout, payments, shipping, communications management and technological infrastructure.

Where data is transferred outside the European Economic Area, the transfer takes place in compliance with the conditions laid down by the GDPR, on the basis of an adequacy decision or other appropriate safeguards, such as standard contractual clauses, where necessary.

Specific information on the countries concerned and the applicable safeguards depends on the providers actually used and the configuration of the services.

For processing activities carried out by Global-e, the data subject may consult the relevant privacy notice, without prejudice to the need to verify the data flows applicable to the Cafe Twin configuration.

9. Retention periods

Personal data is retained for the period necessary to achieve the purposes for which it was collected, in compliance with legal obligations and the principles of storage limitation.

In particular:

  • data relating to orders, invoicing and accounting is retained for the periods required by the applicable legislation;

  • the data of the account is retained for as long as the account remains active and for the period necessary to manage obligations, disputes or claims;

  • data relating to support requests is retained for the time necessary to handle the request and any subsequent disputes;

  • data used for marketing is processed until consent is withdrawn or the purpose ceases, without prejudice to the need to retain the information necessary to document preferences and comply with objections;

  • data relating to email tracking is retained for the time necessary for the stated purposes, in accordance with minimisation criteria and the actual settings of the platform used;

  • technical and security data is retained for the period necessary for the purposes of protecting the service and any applicable obligations.

The actual retention periods are defined by the Controller according to the categories of data, the systems used and the applicable regulatory obligations.

10. Cookies and similar technologies

The site may use cookies and similar technologies to enable the operation of the requested features, ensure security, store preferences and, where permitted, carry out statistical analysis or marketing activities.

Information relating to cookie categories, providers, purposes, duration and the methods for managing preferences is made available in the Cookie Policy and in the site's consent management panel.

The management of the site's cookies is separate from the management of tracking pixels included in email communications. Preferences expressed for cookies do not automatically constitute consent to newsletter tracking, nor vice versa.

11. Nature of data provision

The provision of data necessary for order management, payments, shipping and contractual support is required in order to provide the requested services. Failure to provide such data may prevent the purchase or service from being carried out.

The provision of data for promotional purposes and consent to tracking, where required, are optional. Refusal to consent to marketing or tracking does not prevent the purchase of products or the receipt of communications necessary for order management.

12. Data subject's rights

In the cases provided for by the GDPR, the data subject may exercise the following rights:

  • obtain confirmation as to whether processing is taking place and access their personal data;

  • request the rectification of inaccurate data or the completion of incomplete data;

  • request the erasure of data in the cases provided for by law;

  • request restriction of processing;

  • receive the data in a structured format and, where applicable, request its portability;

  • object to processing based on legitimate interest, in the cases provided for by the legislation;

  • withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;

  • object at any time to the processing of personal data for direct marketing purposes, including any profiling related to such marketing;

  • lodge a complaint with the Data Protection Authority.

To exercise their rights, the data subject may contact the Controller at marketing@cafetwin.com.

The data subject may also contact the Data Protection Authority through the official channels available on the website https://www.garanteprivacy.it/.

13. Minors

The Cafe Twin website and services are not specifically intended for minors. The Controller does not knowingly intend to collect personal data relating to minors in breach of the applicable legislation.

If a parent or guardian believes that a minor has provided personal data inappropriately, they may contact the Controller to request verification and, where the relevant conditions are met, erasure.

14. Third-party websites and services

The website may contain links to third-party websites, platforms or services. The use of such services may be subject to the privacy notices of the respective providers.

The Controller is not responsible for processing carried out independently by third parties outside its control, without prejudice to responsibility for processing carried out on behalf of the Controller and for the obligations provided for by the applicable legislation.

15. Changes to this privacy notice

This privacy notice may be updated to reflect regulatory, organisational or technical changes and changes to the services used.

The updated version will be published on the website with the date of the update indicated. Where a change requires specific information to be provided or new consent to be obtained, the Data Controller will adopt the methods required by the applicable legislation.