Privacy policy

Controller

The controller responsible for processing personal data on this website is LOS ANDES EUROPE GmbH, Neuenburger Straße 19, 10969 Berlin. Email: info@losandeseurope.de, phone: +49 30 81804105.

For any question about data protection and for exercising your rights, an informal message to info@losandeseurope.de is sufficient.

The key points at a glance

• We do not set cookies ourselves; only Cloudflare may set a technically necessary security cookie to protect the website.
• We do not use any tools for audience measurement, analytics or advertising, and we do not create usage profiles.
• Fonts are stored on our own server; no connection is made to Google Fonts. Only a Google map that you load yourself may fetch fonts from Google.
• Google Maps maps are only loaded when you click on them.
• We use form entries only to handle your request.
• The links to our pages on LinkedIn and Facebook are plain links; no connection to these networks is made when you visit this website.

Hosting, delivery and server logs (Cloudflare)

This website is operated and delivered via the Cloudflare Workers platform of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Whenever a page is requested, Cloudflare processes technically necessary connection data: IP address, date and time, the requested address, browser identifier (user agent) and the previously visited page (referrer). Without this data, the pages cannot be delivered or protected against attacks.

For requests that are not served as a ready-made file, such as submitting a form or requesting a page that does not exist, Cloudflare creates technical logs. They are used for troubleshooting and security and are deleted automatically after a few days, depending on the plan after seven days at the latest. We do not write the content of your form entries to these logs.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely, reliably and quickly. Cloudflare processes the data as a processor on the basis of a contract under Art. 28 GDPR.

Contact form

If you write to us using the contact form, we process the information you enter: type of enquiry, intended use, company, name, email address and message, and optionally also phone number, required quantity, product reference and reply language. In addition, the form transmits the address of the page from which you are writing and the language of that page.

We use this information to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or an offer, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering enquiries.

Your enquiry is delivered as an email to our mailbox info@losandeseurope.de, with your email address set as the reply address. The required fields are the type of enquiry (technically necessary and preselected), the intended use (to be selected by you), company, name, email address and message; without them we cannot process the enquiry. Phone number, required quantity, product reference and reply language are optional. No automated decision-making takes place.

Protecting the forms against misuse

To limit too many submissions within a short time, we create a non-reversible check value (hash) from your IP address, the current date and a secret key when you submit a form. We do not store the IP address itself for this purpose. The check value is used only to count submissions within one minute and changes daily.

To prevent the same message from being sent twice, we store at Cloudflare, for 24 hours, a hash of a random identifier of the submission. The entry is then deleted automatically. Name, email address or message are not stored in the process.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting the forms against misuse and duplicate submissions.

Cloudflare Turnstile

To protect our forms against automated submissions, we use Cloudflare Turnstile of Cloudflare, Inc. (see Hosting for the address). As soon as you start filling in a form, your browser loads a script from challenges.cloudflare.com for this purpose; it is not loaded while you only read a page. Turnstile uses technical characteristics of your connection and your browser, such as IP address, browser identifier and page address, to check whether a human is using the form. Turnstile does not receive your form entries. When you submit the form, our server verifies the result with Cloudflare.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protection against misuse and automated attacks. Insofar as your device is accessed in the process, this is strictly necessary for sending the form at your request (section 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). Cloudflare also partly uses these signals under its own responsibility to improve the detection of automated access.

Sending the form emails (Brevo)

To send the emails from the contact form, we use the Brevo service of Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, a subsidiary of Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France. The emails are sent to our mailbox from the sender address website@losandeseurope.de. For this purpose, Brevo receives the content of the email, that is, your form entries including your email address, and processes them exclusively on our behalf on the basis of a data processing agreement under Art. 28 GDPR that forms part of Brevo's terms of use.

Brevo hosts the data on servers in France, Germany and Belgium. For customer support and maintenance, Brevo may involve affiliated companies and sub-processors outside the European Economic Area, in particular in the USA and in India. These transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses.

Brevo stores sending and delivery logs for a limited period in order to prove delivery and fix errors. The legal basis is the same as for the contact form: Art. 6(1)(b) GDPR for handling your enquiry and Art. 6(1)(f) GDPR for secure and traceable sending.

Communication by email

If you send us an email or we reply to you, we process your email address, your name and the content of the message. Our mailboxes are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, which acts as a processor on the basis of a contract under Art. 28 GDPR.

The legal basis is Art. 6(1)(b) GDPR for enquiries about contracts and offers, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering your message.

Applications

If you apply to us by email to bewerbung@losandeseurope.de, we process your information to carry out the application procedure. The legal basis is Art. 6(1)(b) GDPR, supplemented where applicable by section 26 BDSG (German Federal Data Protection Act). Every application is read by a human; there is no automated assessment, ranking or rejection.

If you are not hired, we delete your documents no later than six months after the procedure has ended.

Applying via LinkedIn

For advertised positions you can also use our job posting on LinkedIn instead of sending an e-mail. The link on our website is a plain link: only when you click it do you move to LinkedIn; before that, no data is transmitted to LinkedIn.

On LinkedIn, LinkedIn Ireland Unlimited Company processes your data under its own responsibility and its own privacy policy (https://www.linkedin.com/legal/privacy-policy). We process application data that we receive via LinkedIn like any other application, only for the application procedure; the information in the Applications section applies.

Our LinkedIn page

We operate a company page on LinkedIn (https://www.linkedin.com/company/los-andes-europe/) and link to it on this website, including in the footer. The link is a plain link: no connection to LinkedIn is made when you visit our website, and no content, scripts or cookies from LinkedIn are loaded. Only after a click does your browser open the page in a new tab; no information is transmitted about which of our pages you came from.

For people in the European Union, LinkedIn is operated by LinkedIn Ireland Unlimited Company (“LinkedIn”). When you visit our page on LinkedIn, LinkedIn processes your data under its own responsibility, including with cookies and similar technologies. LinkedIn itself determines the purposes, legal bases and retention periods of this processing and describes them in its privacy policy (https://www.linkedin.com/legal/privacy-policy). We have no influence on this processing.

LinkedIn provides us with statistics on the use of our page (“Page Insights”). LinkedIn compiles them from information in members’ profiles, such as job function, country, industry, seniority, company size and employment status, and from their interaction with our page, such as whether someone follows it. We only receive the statistics in aggregated form and cannot attribute them to any individual person. LinkedIn and LOS ANDES EUROPE GmbH are joint controllers for this processing (Art. 26 GDPR). In the agreement on this (https://www.linkedin.com/legal/l/page-joint-controller-addendum), LinkedIn assumes responsibility for providing the statistics, for informing members and for fulfilling their rights; according to that agreement, the lead supervisory authority is the Irish Data Protection Commission.

We use these statistics to see which posts attract interest and to align our page accordingly. Insofar as we are a joint controller for this processing, we rely on Art. 6(1)(f) GDPR; our legitimate interest lies in presenting our company and our coffees in line with demand where customers and business partners look for information. LinkedIn describes in its privacy policy which legal basis it relies on for its own processing.

If you follow our page, comment on posts or send us a message via LinkedIn, we see the information that you share there publicly or with us, such as profile name, profile picture, information on your occupation and company, and the content. We use it only to reply to you, to handle your enquiry and to manage our page. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in communicating with customers, business partners and interested parties through the channel they choose themselves. If your message is aimed at a contract or an offer, the legal basis is Art. 6(1)(b) GDPR. LinkedIn also processes messages and comments; for confidential matters, please write to us by email or via the contact form. For applications, the section Applying via LinkedIn applies.

LinkedIn also processes data outside the European Union, in particular in the USA. According to its own information, LinkedIn bases these transfers on the European Commission’s adequacy decision for the EU-US Data Privacy Framework and on the European Commission’s standard contractual clauses (https://www.linkedin.com/help/linkedin/answer/a1343190). You can exercise your rights under the section Your rights against LinkedIn, for example via the account settings, and also against us; an informal message to info@losandeseurope.de is sufficient. We forward requests concerning the page statistics to LinkedIn without delay.

Our Facebook page

We operate the page “Los Andes Coffee” on Facebook (https://www.facebook.com/profile.php?id=61595884569888) and link to it in the footer of this website. The link is a plain link: no connection to Facebook is made when you visit our website, and no content, scripts or cookies from Facebook are loaded. Only after a click does your browser open the page in a new tab; no information is transmitted about which of our pages you came from.

For people in the European Union, Facebook is operated by Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4, Ireland (“Meta”). When you visit our Facebook page, Meta processes your data under its own responsibility, including with cookies and similar technologies and even if you do not have a Facebook account. Meta itself determines the purposes, legal bases and retention periods of this processing and describes them in the Meta Privacy Policy (https://www.facebook.com/privacy/policy/). We have no influence on this processing.

Meta provides us with statistics on the use of our page (“Page Insights”). Meta compiles them from events that occur when our page and its content are viewed and used. We only receive aggregated statistics and have no access to the underlying event data. Meta and LOS ANDES EUROPE GmbH are joint controllers for this processing (Art. 26 GDPR). Under the Page Insights Controller Addendum (https://www.facebook.com/legal/terms/page_controller_addendum), Meta takes on providing information about this processing and fulfilling the rights of data subjects; according to that addendum, the lead supervisory authority is the Irish Data Protection Commission. Meta’s information on this is available at https://www.facebook.com/legal/terms/information_about_page_insights_data.

We use these statistics to see which posts attract interest and to align our page accordingly. Insofar as we are a joint controller for this processing, we rely on Art. 6(1)(f) GDPR; our legitimate interest lies in presenting our company and our coffees in line with demand where customers and business partners look for information. Meta describes in its privacy policy which legal basis it relies on for its own processing.

If you comment on or react to our posts or send us a message via Facebook, we see the information that you share there publicly or with us, such as profile name, profile picture and the content. We use it only to reply to you, to handle your enquiry and to manage our page. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in communicating with customers, business partners and interested parties through the channel they choose themselves. If your message is aimed at a contract or an offer, the legal basis is Art. 6(1)(b) GDPR. Comments are publicly visible, and Meta also processes messages; for confidential matters, please write to us by email or via the contact form.

Meta also processes data outside the European Economic Area, in particular in the USA. According to its own information, Meta bases these transfers on adequacy decisions of the European Commission and otherwise on the European Commission’s standard contractual clauses with supplementary safeguards, for example for transfers to Meta Platforms, Inc. in the USA, or on derogations provided for by law. You can exercise your rights under the section Your rights against Meta, for example via the Facebook settings, and also against us; an informal message to info@losandeseurope.de is sufficient. We forward requests concerning Page Insights to Meta without delay.

Google Maps

On some pages you can display a map from Google Maps. The map is only loaded when you click “Load map”. Before that, there is no connection to Google. After the click, your browser connects to servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; at least your IP address and the page address are transmitted to Google, including to servers of Google LLC in the USA. Google may use cookies or similar technologies and may also use the data for its own purposes. To display it, the map loads content from Google, such as Google Maps, Google programming interfaces (APIs) and resources provided by Google such as fonts.

The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, section 25(1) TDDDG). You can withdraw it at any time with effect for the future by reloading the page; the map will then only be loaded after another click. Further information: https://policies.google.com/privacy

Google Search Console

To check how our website appears in Google Search, we use Google Search Console. We confirmed ownership of the domain through an entry in the Domain Name System (DNS). For this purpose we embed neither scripts nor cookies from Google on this website; no connection to Google is established when you visit our pages. Search Console shows us data that Google collects when operating Google Search, such as search queries, impressions, clicks and the position of our pages, only in aggregated form; we cannot attribute it to individual persons. Google processes this data in connection with the use of Google Search under its own responsibility (https://policies.google.com/privacy). Google Analytics and Google Tag Manager are not used on this website.

Storage in the browser and fonts

We do not set cookies ourselves. To protect the website against automated access, Cloudflare runs a short check script on every page, loaded from our own address, and may set the security cookie “cf_clearance” (stored for up to one year); it is used neither for analysis nor for advertising. In your browser’s storage we only keep what a feature of the website needs: your coffee watchlist (“losandes:watchlist”, localStorage); that you have closed the hint in the coffee guide or opened the guide, so that it does not appear again (“la-guide-hint-shown”); which list you opened a product from, so that the back link returns you to that list with its filters and position (“la-last”, “la-list”, “la-prod”, “la-back”); and the editions you selected for an enquiry on the Café y Ciencia page (“cyc-enquiry”). The last three are kept in sessionStorage and are deleted when you close the tab. This information does not leave your browser and is not transmitted to us. You can delete it at any time in your browser settings. The basis is section 25(2) no. 2 TDDDG.

The fonts of this website are stored on our own server. No connection is made to providers such as Google Fonts when a page is loaded. Only when you load a Google map may it fetch fonts provided by Google (see the Google Maps section).

Recipients and transfers to third countries

Depending on the feature used, the recipients of your data are: Cloudflare (operation of the website, protection of the forms), Brevo (sending the form emails), IONOS (email mailboxes) and, only after your click, Google (map display). Beyond that, we only pass on your data if we are legally obliged to do so.

Cloudflare and Google also process data in the USA. The transfer is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, under which Cloudflare, Inc. and Google LLC are certified, and additionally on the European Commission’s standard contractual clauses. Brevo may use sub-processors in the USA and in India for customer support and maintenance; details are given in the section on sending the form emails. What LinkedIn and Meta process when you use our pages on these networks is set out in the sections Our LinkedIn page and Our Facebook page.

Retention periods

• Server logs at Cloudflare: a few days, depending on the plan seven days at the latest.
• Check value for limiting submissions: only for counting within one minute.
• Lock against duplicate submissions: 24 hours.
• Enquiries by form or email: until your request has been dealt with. If a business relationship results, we keep business letters for the statutory periods (six years under section 257 HGB, the German Commercial Code; ten years for accounting records under section 147 AO, the German Fiscal Code).
• Applications: no later than six months after the procedure has ended, unless you are hired.
• Comments and messages on our pages on LinkedIn and Facebook: we delete them as soon as they are no longer required for handling them and there is no statutory retention obligation, insofar as the platform allows this. A message that we delete may remain stored with the sender and with the operator; how long LinkedIn and Meta store data is determined by the operators. If a business relationship results from a message, the same retention periods apply as for enquiries by form or email.
• Watchlist in the browser: until you delete it. Other information in the browser: until you close the tab. Cloudflare security cookie “cf_clearance”: up to one year.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). An informal message to info@losandeseurope.de is sufficient.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59-61, 10555 Berlin, www.datenschutz-berlin.de.