Coffeeride Escapes is run by Bor from Slovenia, so the EU General Data Protection Regulation (GDPR) applies. This page explains what personal data we collect, why, and what you can do about it. We do not sell your data and we do not use it for advertising.
Who is responsible
The data controller is:
- Business
- Rožca Kolar d.o.o.
- Address
- Cesta na Brdo 37, 4000 Kranj, Slovenia
- Registration number
- 2198584000
- VAT ID
- SI44379463
What we collect
- Purchases: your email, the product, the amount, the country used for tax, when you requested immediate delivery, and your download link activity. Stripe handles your card details; we never see them.
- Free route preview: your email, to send you the download link and know who took it. If you tick the box for occasional updates, we only add you once you download the preview from that email, which shows the address is yours. We store when you asked and when you confirmed.
- Custom-trip inquiries: your name, email, group size, when you want to ride, your message, and the campaign tags of the link that brought you (such as utm_source).
- Emails you send us: your address and whatever you write.
- Website statistics: only if you accept analytics cookies. Without consent, Google Analytics doesn't load at all.
- Technical logs: our host records IP addresses and browser details briefly to keep the site secure and running.
Why, and on what legal basis
- To deliver what you asked for (contract, or steps before one): the pack, the preview download, answering your inquiry.
- Legal obligations: keeping purchase records for tax.
- Legitimate interest: two follow-up emails after a purchase (tips and a request for feedback), and keeping the site secure. Every follow-up has an unsubscribe link.
- Consent: marketing updates and analytics cookies. You can withdraw consent anytime.
Who processes it
We use these providers, each bound by a data processing agreement:
- Vercel: website hosting, and bot protection on our forms (Vercel BotID, run with its partner Kasada) (USA)
- Supabase: database and file storage (EU, Frankfurt)
- Stripe: payments and tax calculation (USA and EU)
- Resend: sending email (USA)
- Google: our email inbox (Gmail) and, with your consent, website statistics (Google Analytics)
Where data goes to the US, the transfer is covered by the EU-US Data Privacy Framework or the EU's standard contractual clauses.
How long we keep it
- Purchase records: 10 years, as Slovenian tax law requires for invoices.
- Download links: they stop working after 30 days.
- Custom-trip inquiries: 2 years after our last contact, or longer if we plan a trip together.
- Preview signups and updates list: until you unsubscribe or ask us to delete them.
- Technical logs: a few days to a few weeks, set by our host.
Your rights
You can ask to see, correct, delete or export your data, restrict or object to processing, or withdraw consent. Email clubcoffeeride@gmail.com and we will answer within a month. You can also complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, ip-rs.si) or the data protection authority where you live.
Cookies
We only set analytics cookies if you click Accept in the cookie banner. Change your choice anytime via Cookie settings in the footer. Stripe sets its own cookies on its checkout page to prevent fraud. To keep bots out of our forms, Vercel BotID checks your browser and may set short-lived security cookies; these are needed for the site to work, so they don't ask for consent. After you buy a pack, we keep one cookie with your checkout reference for 24 hours so the thank-you page can offer your download; it's needed for that, so it doesn't ask for consent either.
Children
The site is not meant for children under 16 and we do not knowingly collect their data.
Changes
If we change this policy, we update the date at the top. Significant changes that affect you will be announced by email.