Privacy policy
Last updated:
1. Who we are
Arnau & Co. Coffee Limited, trading as Arnau Avalos ("we", "us"), runs this website, arnauavalos.com, and is the controller of the personal data described in this policy. We are registered in England and Wales under company number 16980311, and our registered office is at 167–169 Great Portland Street, London W1W 5PF, United Kingdom.
For anything to do with this policy or your data, write to us at privacy [at] arnauavalos.com. We have not appointed a data protection officer; that address reaches the people responsible for data protection here.
Our representative in the European Union, appointed under Article 27 of the EU GDPR, is El Volcancito S.L. (B75914077), Carrer de Mejía Lequerica 26, 08028 Barcelona, Spain. If you are in the EU, you can raise anything in this policy with them by post at that address, or with us at privacy [at] arnauavalos.com.
2. The short version
This website has no forms and asks you for nothing. If you write to us, we use what you send to answer you. Our hosting provider processes technical data, such as your IP address, to deliver the site and keep it secure. We do not sell personal data, we do not share it for advertising, and we use no advertising or tracking cookies.
3. What we collect, and why
When you email us, we receive your email address, your message and anything else you choose to include. We use this to answer your enquiry.
Please do not put sensitive information — for example about health, beliefs, or other people — in your message. We have no need for it and would rather not receive it.
4. Our lawful bases
Where you deal with us on behalf of a company, we rely on our legitimate interest in responding to you and doing business with the company you represent. Where you deal with us for yourself — for example as a sole trader — we rely on the processing being necessary to take steps at your request before entering into a contract, and to perform it. To deliver the site, we rely on our legitimate interest in keeping it secure and working. Where the law requires us to keep or disclose something, we rely on that legal obligation.
We do not send marketing, and we do not use what you send us to advertise to you.
5. Who handles your data for us
We do not sell personal data and we do not share it for advertising. The producers whose coffee we sell never receive your messages. The providers that process data on our behalf are:
Cloudflare, Inc. hosts and delivers this site. It processes the technical data of each request (such as IP address and browser type) to deliver and protect the site.
Bluehost (part of Newfold Digital) hosts our email accounts. It processes the messages we send and receive in order to provide that service.
6. International transfers
Cloudflare and Bluehost are US companies, so what you send can be processed outside the UK and the European Economic Area. Where that happens, we rely on safeguards recognised under UK and EU law: the Standard Contractual Clauses, together with the UK Addendum or International Data Transfer Agreement, included in our providers' data processing terms, and, where a provider is certified, the EU–US Data Privacy Framework and its UK Extension. Write to privacy [at] arnauavalos.com if you would like detail on the safeguard that applies to a particular transfer.
7. How long we keep it
Our correspondence with you is deleted in periodic reviews, no later than 24 months after our last exchange, unless we are doing business together or the law requires us to keep something longer.
8. Cookies, analytics and device storage
Our own code sets no cookies and stores nothing on your device, and this site has no analytics. Some Cloudflare security features may set strictly necessary cookies (such as __cf_bm) to protect the site.
There are no advertising, social-media or tracking cookies here, no Google Analytics, no third-party video, maps or chat widgets, and fonts are served from our own domain. Our security policy blocks scripts and connections to anyone except our own domain.
9. Your rights
You can ask us for a copy of your data, ask us to correct or delete it, object to processing based on our legitimate interests, ask us to restrict it, and receive the data you gave us in a portable form.
To use any of these rights, write to privacy [at] arnauavalos.com. We may need to confirm you are who you say you are, and we will reply within one month.
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk). If you are in the European Economic Area or Switzerland, you can also complain to your local supervisory authority, and if you are in the EU you can contact our representative named in section 1. Wherever you are, local law may give you further rights, and we will honour them as it requires.
10. People in the film
If you appear in the film on this site and want something corrected or removed, write to privacy [at] arnauavalos.com.
11. Children
This site is for trade buyers. It is not aimed at children, and we do not knowingly collect their data.
12. Security
The site runs over HTTPS only, and a strict security policy keeps third-party scripts out.
13. Changes to this policy
This policy describes the site as it is today. Before we add new features, we will update this policy, and where the law requires it we will ask for your consent. The date at the top shows when it last changed.