Privacy notice
Information about how we process personal data for enquiries about coffee, services, training and business partnerships on daklakshop.cz.
Version 2026-11-10-v13
Data controllers
The companies below act as joint controllers. Dak Lak handles business enquiries and communication. SAIGON Technologies provides technical operation and administration. You may exercise your rights against either controller, including by writing to its registered address.
- Dak Lak Coffee CZ, s.r.o., Company ID 01656350, Klášterecká 1051/28, Dolní Chabry, 184 00 Praha 8, Česká republika.
- SAIGON Technologies s.r.o., Company ID 04317114, Klášterecká 1051/28, Dolní Chabry, 184 00 Praha 8, Česká republika.
Shared contact point: [email protected].
Staff access
Only authorised staff with a password and two-factor verification can manage enquiries. Access setup uses the necessary daklak_setup cookie for at most 15 minutes. We store the username, password and recovery-code hashes, and an encrypted authenticator key. Login throttling briefly retains cryptographically derived identifiers, not plaintext IP addresses. This data is not used for advertising.
What data we process
For existing customers, we require the company name and delivery address; email and phone are optional. For partnership and training enquiries, we require an email address; other contact details are optional. Team training also requires a participant range; requests to tailor the training are optional. We store the message or structured enquiry, its type and language. If you arrive through a tagged link from daklak.cz, we also store that source with the enquiry; no tracking cookie is used for this. You may provide coffee, quantities, a machine model, consumption, a proposed meeting or an estimated training participant range. We may use existing business contact details to handle your enquiry. An enquiry is not a confirmed order or booking.
We cannot handle an enquiry without its required contact and request details. Do not include passwords, payment details or sensitive personal information that is not needed.
Purposes and legal bases
We use the data to handle your request, prepare an offer and communicate with you. Where you are a party to a contract, the legal basis is steps taken at your request before entering into that contract or its performance under Article 6(1)(b) GDPR. For contact persons acting for companies, we rely on the legitimate interest under Article 6(1)(f) GDPR in handling business communication and providing an offer. Proportionate security and the protection of specific legal claims are also legitimate interests.
Submission does not create a customer account or automatically confirm an order. We do not use form data for newsletters or advertising campaigns. We do not carry out profiling or automated decisions with legal or similarly significant effects.
Recipients and storage
As you type in the company field, we search the Czech Ministry of Finance’s ARES register. Our server sends the company name or business ID being searched, not the rest of the form or the visitor’s IP address. We do not persist search queries or results; the selected or manually entered company name is saved only with the submitted enquiry. You do not have to select a result and can keep your own company name.
Access is limited to authorised personnel of the joint controllers as necessary. Contracted hosting, backup and IT-support providers may supply technical services on the controllers’ instructions. Data may be provided to public authorities where required by law.
This application’s server storage is in the EU: Czechia, Germany or Finland. The form does not transmit data to advertising or analytics services. Additional services or transfers outside the EEA must have an appropriate legal basis and safeguards and be reflected in this notice.
Cloudflare and Telegram notifications
When enabled, Cloudflare Turnstile verifies the browser before submission. Cloudflare processes technical data such as the IP address and browser or device information. Our server verifies the issued token without sending enquiry content or contact details to Cloudflare. Submission in protected mode requires JavaScript. If verification is unavailable, you can contact us by email.
When Telegram notifications are enabled, the designated internal chat receives only the enquiry reference, category, any structured coffee selection and quantities, the training participant range, and a link to the authenticated staff area. Names, companies, addresses, email, phone and free-text messages are not sent to Telegram. The link does not grant access without login. Telegram notification copies have a separate retention process; deleting an enquiry in this application does not automatically delete them.
Cloudflare and Telegram may also process data outside the EEA. Before enabling them, the operators must assess the actual recipients, processing terms, any transfers and appropriate safeguards. Hosting the database in the EU does not itself mean that all these services process data only in the EU.
Retention periods
We retain open enquiries for as long as needed to handle them. Enquiries closed without resulting business are deleted six calendar months after closure, but no earlier than six months after the last related contact. Automatic checks run hourly while the application is operating.
Contractual, accounting and tax records arising from business have separate retention periods according to their purpose and legal requirements. A specific legal claim may justify a temporary exception with a recorded reason and regular review. Deletion includes related notifications and audit records. Restoring backups must not lead to the routine reprocessing of data already deleted.
Cookies and technical data
We use only technical cookies: daklak_csrf protects the form for the browser session, daklak_receipt displays confirmation for at most one hour, and daklak_staff authenticates authorised staff for at most eight hours. They are not used for advertising; consent is not required for their strictly necessary purpose. The page URL determines the language, not a tracking cookie.
Draft content is held only in the open page’s memory, except for the optional company/address preference described below. To prevent abuse, we briefly process the IP address and request count. Daily totals of views, validation errors and accepted enquiries contain no names, email addresses, messages, IP addresses or visitor identifiers. The public website does not expose other people’s enquiries.
Remembering company and address
If you explicitly enable this option, after a successful submission we save only the company name and delivery address in this browser’s localStorage for 90 days. We do not save email, phone or enquiry contents this way. Use Forget saved details or untick the option to remove them. This does not create an account or verify identity, does not sync between devices, and should not be enabled on shared devices.
Your rights
Subject to the GDPR, you may request access, correction, erasure or restriction of processing. You may object to processing based on legitimate interests. Data portability applies in the cases specified by the GDPR, particularly automated processing based on a contract or consent.
Contact the shared contact point or either controller. We may proportionately verify your identity. We will respond without undue delay, normally within one month; any extension is governed by the GDPR. You may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7.
Supervisory authority: Úřad pro ochranu osobních údajů.