Privacy Policy
Information on the processing of personal data under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
Ultimo aggiornamento: September 2026
This notice describes how TMB Group S.r.l. processes the personal data of users who visit coffeesuite.it, request a demo or use the Coffee Suite service. This is an English courtesy translation: in case of discrepancy, the Italian version prevails.
1. Data controller
The data controller is TMB Group S.r.l., registered office at Via Nuova Nola 273, 80036 Palma Campania (NA), Italy, VAT and Tax Code 10989521215, registered with the Naples Companies Register (REA NA-1146763), share capital 1,000.00 € fully paid up. Coffee Suite is a product of TMB Group S.r.l.
To exercise your rights or for any question, write to ciao@coffeesuite.it or, by certified email, to tmbgroup@pecaruba.it. The controller has not appointed a Data Protection Officer (DPO), as the legal requirements do not apply; the privacy contact point is the one above.
2. Categories of data we process
- Contact and demo request data: name, email, store name or URL, approximate revenue band, and any information you freely share.
- Navigation data: IP address, browser and device type, pages visited, date and time of access, and data collected via cookies (see the Cookie Policy).
- Service data: account credentials, settings, configuration data and usage logs generated while using Coffee Suite.
- Billing data: company name, VAT number, address and data needed to issue tax documents, if you subscribe to a plan.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Responding to demo or information requests and pre-contractual steps | Pre-contractual measures at your request (Art. 6.1.b) |
| Providing the Coffee Suite service and account management | Performance of a contract (Art. 6.1.b) |
| Tax, accounting and legal obligations | Legal obligation (Art. 6.1.c) |
| Site and system security, abuse prevention, service improvement | Legitimate interest (Art. 6.1.f) |
| Analytics cookies and promotional communications | Consent (Art. 6.1.a), revocable at any time |
4. Data processed on behalf of customers (merchants)
While providing the service, Coffee Suite may process personal data contained in the customer's store (for example the merchant's end-customer data: names, shipping addresses, contacts, order history). For such data, the merchant is the data controller and TMB Group S.r.l. acts as data processor under Art. 28 GDPR, on the basis of a Data Processing Agreement governing instructions, security measures and any sub-processors. The AI assistant is trainable locally: data used for training stays with the merchant and is processed in line with the DPA.
5. Retention period
| Category | Duration |
|---|---|
| Demo request / unconverted leads | Up to 24 months from last contact |
| Account and service data | For the duration of the contract |
| Accounting and tax data | 10 years, as required by law |
| Navigation data and logs | Up to 12 months, subject to security needs |
| Marketing consent | Until consent is withdrawn |
6. Recipients and processors
Data may be processed by the controller's authorized staff and shared with third-party providers appointed as processors under Art. 28 GDPR, including:
- hosting and cloud infrastructure providers;
- the Shopify platform and other connected ecommerce platforms;
- carriers and shipping services, to fulfill orders;
- email, CRM and support providers;
- consultants and providers of accounting and tax services.
Data is neither disclosed publicly nor sold to third parties. It may be shared with competent authorities where required by law.
7. Transfers outside the EU
Data is processed mainly within the European Union. Where some providers involve a transfer to third countries, this occurs only with adequate safeguards under Art. 44 ff. GDPR, such as an adequacy decision or Standard Contractual Clauses (SCC).
8. Your rights
As a data subject, you may exercise the rights under Art. 15-22 GDPR at any time:
- access to your data and information on the processing;
- rectification of inaccurate data;
- erasure ("right to be forgotten") where applicable;
- restriction of processing;
- portability of the data you provided;
- objection to processing based on legitimate interest;
- withdrawal of consent at any time.
To exercise your rights write to ciao@coffeesuite.it. You also have the right to lodge a complaint with the supervisory authority (the Italian Garante, garanteprivacy.it).
9. Automated decision-making
The controller does not carry out automated decision-making producing legal effects under Art. 22 GDPR. The AI assistant provides automated support replies to merchants' customers, without taking decisions affecting individuals' rights.
10. Security of processing
The controller adopts appropriate technical and organizational measures to protect data against unauthorized access, loss, destruction or disclosure, under Art. 32 GDPR, including encryption in transit, access controls and periodic backups.
11. Changes to this notice
The controller may update this notice to reflect legal or service changes. The updated version is published on this page with its last-updated date.