Andorra Coffeeshop B.V. – Privacy policy

Article 1. Definitions

1.1. In this privacy policy, the following terms are defined as below, unless explicitly stated
otherwise:
Subject: The natural person whose Personal Data is being processed;
Andorra Coffeeshop: The user of this privacy policy: Vodka Trading B.V. trading
under the name “Andorra Coffeeshop”, located at Witbolstraat
4 in Amsterdam, the Netherlands, registered with the
Chamber of Commerce under Chamber of Commerce number
34255723;
Agreement: The agreement between Andorra Coffeeshop and the Data
Subject whereby the Data Subject places an order with
Andorra Coffeeshop via the Website;
Personal Data: Data that can be used to identify a natural person;
Website: The website https://andorracoffeeshop.com/ managed by
Andorra Coffeeshop.
1.2. Unless the context indicates otherwise, terms defined in the singular also refer to the plural
and vice versa.

Article 2. Controller

2.1. Andorra Coffeeshop is the controller with regard to the Personal Data processed through the
Website and in the context of the Agreement. The contact details of Andorra Coffeeshop are:
Andorra Coffeeshop
Witbolstraat 4
1032 LD Amsterdam
[0031202184660][email protected]
2.2. Andorra Coffeeshop considers due care in handling Personal Data of paramount importance.
With regard to the processing of Personal Data, Andorra Coffeeshop acts in accordance with
the General Data Protection Regulation (GDPR).
2.3. Andorra Coffeeshop processes the Data Subject’s Personal Data within the meaning of the
GDPR when the Data Subject has provided this Personal Data to Andorra Coffeeshop via
the Website or when the Data Subject enters into the Agreement.

Article 3. Personal data

3.1. Andorra Coffeeshop collects and processes the following data:
a. First name and surname;
b. Residential address;
c. Delivery address (if the delivery address differs from the residential address of the Data
Subject);
d. E-mail address;
e. Telephone number;
f. IBAN and name;
g. Age;
h. Information about the visit to the Website.
3.2. Andorra Coffeeshop does not process any special Personal Data of Data Subjects.

Article 4. Principle and purposes of data processing

4.1. The principle of the processing of the Personal Data is to perform the Agreement, to comply
with statutory obligations, the consent of the Data Subject or the legitimate interest of
Andorra Coffeeshop.
4.2. Andorra Coffeeshop collects and processes the (Personal) data for the following purposes:
a. To perform the Agreement;
b. To create an account on the Website for the Data Subject;
c. To send the order;
d. To contact the Customer about the Agreement;
e. To handle a question, comment or complaint;
f. To fulfil administrative duties;
g. To make payments;
h. To send newsletters;
i. To check the age of the Data Subject;
j. To improve the Website;
k. To generate general statistics about the use of the Website.
4.3. Providing the first name and surname, residential address, telephone number, e-mail address
and age is a contractual obligation. Without these details, no Agreement can be concluded.
4.4. Andorra Coffeeshop will not keep the Personal Data longer than is strictly necessary to
achieve the purposes, described in Article 4.2, for which the Personal Data is processed.
4.5. Andorra Coffeeshop only processes Personal Data that is, at least, required for the existing
purposes. Andorra Coffeeshop aims to process as little Personal Data as possible.
4.6. Andorra Coffeeshop will not process the Personal Data for purposes other than those
described above.

Article 5. Newsletter

5.1. Andorra Coffeeshop only sends newsletters to the Data Subject if the Data Subject has
subscribed to the newsletter.
5.2. Every newsletter that is sent to the Data Subject contains a link by which means the Data
Subject can unsubscribe from the Andorra Coffeeshop newsletter.

Article 6. Deletion of Personal Data

6.1. Andorra Coffeeshop will delete Personal Data from its systems without unreasonable delay
if, for instance:
a. The Personal Data is no longer required for the purposes for which it was processed;
b. The Data Subject objects to his Personal Data being processed and this objection is
justified;
c. The Personal Data is incorrect or superseded.
6.2. Andorra Coffeeshop is not obliged to delete Personal Data if it concerns one of the situations
described in the law in which the “right to oblivion” does not apply.

Article 7. Disclosure of Personal Data to third parties

7.1. Andorra Coffeeshop will disclose the Personal Data of the Data Subject to third parties if:
a. Andorra Coffeeshop has received the explicit prior consent of the Data Subject. The
Data Subject can withdraw his consent for his Personal Data to be disclosed to third
parties at any time;
b. One of the statutory principles applies under which the disclosure of Personal Data to
third parties is permitted;
c. It is required for the performance of the Agreement;
d. The data is forwarded to a processor engaged by Andorra Coffeeshop for the purposes
listed in this privacy policy, such as an ICT service provider, an accountant, payment
provider or carrier with whom Andorra Coffeeshop has entered into an agreement or
another legal act under which the processor provides sufficient guarantees in respect of
the technical and organisational security measures in connection with the processing to
be performed;
e. This has been requested by an authority such as the police or the judiciary. Before
Andorra Coffeeshop discloses Personal Data to an authority, it will check the powers of
this authority.

Article 8. Right of inspection, right to data portability, rectification and deletion

8.1. On request, Andorra Coffeeshop will grant the Data Subject access to all his Personal Data on Andorra Coffeeshop’s records and Andorra Coffeeshop will give the Data Subject a free copy of this data in an adequate format so the Data Subject himself can disclose the Personal Data to a third party. 8.2. Andorra Coffeeshop offers the Data Subject the opportunity to rectify or delete any incorrect data about him on Andorra Coffeeshop’s records. 8.3. The request for access, a copy, change or deletion of Personal Data can be submitted to Andorra Coffeeshop in writing or by e-mail. See Article 2.1 for the contact details of Andorra Coffeeshop. Andorra Coffeeshop will respond to such a request as soon as possible and in any case within 1 month.

Article 9. Objection

9.1. The Data Subject can object to Andorra Coffeeshop about the processing of his Personal
Data if he has good reason given his specific situation. After Andorra Coffeeshop has
received the objection from the Data Subject, Andorra Coffeeshop will stop processing the
Personal Data of the Data Subject, unless Andorra Coffeeshop has legitimate interests in the
processing of Personal Data that outweigh the interests of the Data Subject.

Article 10. Right to restriction

10.1. If the Data Subject has submitted a request for the adjustment, supplement or deletion of his
Personal Data or if he has submitted an objection against the processing of his Personal
Data and the handling, processing and completion of this request or objection take some
time, the Data Subject may ask Andorra Coffeeshop to restrict the processing of his Personal
Data.

Article 11. Handling a request

11.1. To ensure the request regarding Personal Data has been made by the Data Subject in
question, Andorra Coffeeshop may ask the Data Subject to send a copy of his proof of ID
along with the request. In this copy, the Data Subject has to obscure his photo, MRZ
(machine-readable zone, the strip with numbers at the bottom of the passport), passport
number and citizen service number (BSN). This will protect the privacy of the Data Subject.
11.2. If at the request of the Data subject, Andorra Coffeeshop corrects, supplements or deletes
Personal Data of the Data Subject or ends or restricts the processing of the Personal Data or
has processed a withdrawn consent, Andorra Coffeeshop will notify the Data Subject
accordingly.

Article 12. Security measures

12.1. To prevent unauthorised access to Personal Data, loss, theft and unlawful use of Personal
Data, Andorra Coffeeshop has taken various security measures, including measures against
unauthorised access, use, changes, unlawful and unintended destruction and unintended
loss of the Personal Data. Among other things, Andorra Coffeeshop has taken the following
security measures:
a. The use of secured systems with strong passwords to prevent unauthorised access to
information systems;
b. The use of anti-virus software;
c. The Website uses a secure connection;
d. Regularly carrying out software updates.
12.2. Andorra Coffeeshop imposes a duty of confidentiality on persons engaged by or entering the
employment of Andorra Coffeeshop and who, for the purpose of their duties, take cognizance
of Personal Data, such as details in a contract for services, an employment contract or a nondisclosure agreement.
12.3. Only employees of Andorra Coffeeshop who must have access to Personal Data in the
context of their position/activities, are granted access to the Personal Data by Andorra
Coffeeshop.

Article 13. Third-party privacy policy

13.1. This privacy policy does not apply to third-party websites such as social media websites that
are hyperlinked to this Website. Andorra Coffeeshop does not accept any responsibility or
liability with regard to the way in which these websites handle Personal Data. For more
information about the way in which these third parties handle Personal Data, etc., please
consult the privacy policy of the website in question.

Article 14. Changes

14.1. Andorra Coffeeshop reserves the right to unilaterally make changes to this privacy policy.
The latest version of Andorra Coffeeshop’s privacy policy can be found on the Website.

Article 14. Changes

15.1. The Website uses functional and analytical cookies.
15.2. A cookie is a small text file that is stored in the browser of the Data Subject’s device when he
first visits the Website.
15.3. The Data Subject can opt out of cookies by setting his Internet browser in such a way that it
no longer stores cookies. In addition, the Data Subject can also delete all previously saved
information through his browser settings. More information about enabling, disabling and
deleting cookies can be found in the instructions and/or the Help feature of the Data Subject’s
browser. When the Data Subject deletes or disables functional cookies, it may affect the
correct functioning of the Website and the Data Subject may no longer be able to put
products in his shopping basket.
15.4. The type of cookie and its purposes:

The type of cookie	The purpose for which the cookie is placed
Functional cookies	They ensure the Website functions correctly. These cookies are used, for example, so that the Data Subject can place a product in his shopping basket. Functional cookies enable the Website to recognise the Data Subject when the Data Subject visits the Website again. This is convenient as it means the Data Subject does not have to log into the Website every time he visits it.
Analytical cookies	By using analytical cookies, Andorra Coffeeshop can see how the Website is used and it can improve the Website on the basis of that information. Analytical cookies are not used by third parties and they are not linked to the name or the e-mail address of the Data Subject. Andorra Coffeeshop’s settings of Google Analytics are such that visitors of the Website remain anonymous.

Article 16. Submitting a complaint

16.1. If the Data Subject believes that the processing of Personal Data by Andorra Coffeeshop is
not in accordance with this privacy policy and/or the applicable laws and regulations, the Data
Subject can file a complaint with the Dutch Data Protection Authority or a supervisory
authority in the country where the Data Subject resides.