Privacy notice
1. Controller
Blooms Coffee Club GmbH
An der Frauenkirche 18, 01067 Dresden
Represented by: Hakan Özgür, Geschäftsführer
hello@7-labs.de
2. What COFFEE+ is
COFFEE+ is a Blooms project. A person can receive a limited coffee benefit, then choose exactly one further person. Some campaigns also issue a limited public allocation. The application manages invitation codes and links, deadlines, acceptances, the next person, cancellations and redemptions.
3. Data processed
Depending on use: first and last name; campaign email and, only if enabled, mobile number; campaign, invitation/benefit codes, status and timestamps; public/invited origin and invitation relationship; redemption/check-in; internal pilot steps (opening, starting acceptance, sharing view, WhatsApp/copy clicks); voluntary feedback; email delivery status; essential session/security data. The selected language is stored for pages and recipient emails.
4. Website access and server logs
Access processes technically necessary IP, time, URL, transfer status, browser and OS data to deliver the site, analyse faults and prevent attacks. Basis: GDPR Art. 6(1)(f), secure and stable operation. The host may keep server logs; its published policy provides limited regular retention, potentially longer for security incidents.
5. Essential session
A necessary PHP session associates invitation codes, secures forms, recognises signed-in guests and protects administration. No analytics, advertising or social-media tracking cookies are used. The session also retains the selected interface language.
6. Opening and checking invitations
Opening a short link or entering a code processes the code, campaign, expiry and session data to check existence, validity and unused status. Basis: GDPR Art. 6(1)(b) where necessary for the requested feature; Art. 6(1)(f) additionally for security and abuse checks.
7. Starting or accepting
Public registration stores name and email, checked by confirmation link. Reservation is temporary until confirmation and released on expiry. Personal invitations store the campaign fields plus campaign, status, time and inviter relationship. Basis: GDPR Art. 6(1)(b) to provide/administer the requested benefit; additionally 6(1)(f) to prevent repeat redemption, abuse and exceeding limited benefits.
8. Choosing another person
Choosing another person creates an invitation storing code, inviter, activation/expiry and status. The recipient is generally unnamed until they accept, when the relationship is recorded. COFFEE+ may supply a prepared text with the inviter’s first name and link. The user chooses the recipient.
9. Confirmation emails
Where email collection and confirmation are enabled, the address is used to confirm acceptance/redemption and send campaign information, including place, time, redemption instructions and links. Basis: GDPR Art. 6(1)(b). Acceptance, decline or later cancellation may notify the inviter if email and that campaign feature are available; these messages serve only the invitation process.
10. Optional email reminders
Additional reminders require express, voluntary consent under GDPR Art. 6(1)(a), withdrawable at any time for the future through an unsubscribe link. Refusal or withdrawal does not affect a confirmed Coffee+. The current system does not use the address for advertising unrelated to the campaign.
11. Redemption and check-in
Authorised staff can find the participant in the digital list and confirm redemption. Status and time are stored to fulfil the benefit and prevent multiple redemption. Basis: GDPR Art. 6(1)(b), additionally 6(1)(f) for security and evidence.
12. Abuse prevention
Rate limits protect vulnerable operations, including repeated wrong codes or failed admin logins. The application stores a SHA-256 hash of the IP, action, attempt count and possible block time, not a permanent plaintext IP. Basis: GDPR Art. 6(1)(f), protecting the system, benefits and accounts from automated attacks and abuse.
13. Hosting and email delivery
The website, database and current email delivery use ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf. The provider processes technical and personal data for hosting/email; where acting as processor, under a GDPR Art. 28 agreement. Intentional transfer of participant data outside the EU/EEA is not planned in current operations.
14. External links and social media
External website/social-media links may appear on pages or in emails. They do not load social plugins or pixels in COFFEE+. Only clicking leaves COFFEE+; the external provider’s privacy notice then applies.
15. WhatsApp
COFFEE+ does not itself send WhatsApp messages. Selecting “Send with WhatsApp” opens WhatsApp with a prepared text and invitation link. The user chooses the recipient and sends there. WhatsApp’s privacy information applies to subsequent processing.
16. Recipients and authorised access
Access is limited to those needing participant data for administration, campaign control, support or redemption. Blooms controls its own campaigns. For a legally separate external operator, roles would be set per campaign by actual decisions over purposes and essential means, not contract labels alone: processor, independent or joint controller. Processing on behalf requires a GDPR Art. 28 agreement.
17. Internal pilot analysis, no advertising trackers
Internal product/pilot logs record invitation opening, acceptance start, sharing view and sharing clicks, linked to the campaign and existing invitation/guest. This event table stores no IPs and creates no advertising profiles. Voluntary feedback on declining or not choosing a next person is linked where needed. Basis: GDPR Art. 6(1)(f), testing/improving the pilot and detecting unclear steps or technical drop-offs. No external analytics, ad trackers, social pixels, cross-campaign profiling or solely automated decisions with legal or similarly significant effects under GDPR Art. 22.
18. Retention
Personal participation, invitation and redemption data are kept only as needed for the campaign, analysis, abuse prevention and administration. Normal deletion: no later than 30 days after campaign end, unless legal retention or legal claims require longer. Deletion in the current MVP is initiated administratively. A CSV snapshot may be archived before pilot reset, under the same deletion and purpose limits. Sessions normally end with the browser session; security/server logs only last as technically needed. Guest language settings are removed when their guest record no longer exists.
19. Required information
Required fields are necessary to assign and correctly redeem a Coffee+. Without them, the relevant feature cannot be used. Optional details and reminder consent are not required to accept a Coffee+.
20. Data subject rights
Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction and data portability. Processing under Art. 6(1)(f) can be objected to under the legal conditions. Consent may be withdrawn at any time for the future. Send requests to hello@7-labs.de; reasonable identity checks may be required to prevent unauthorised disclosure.
21. Right to complain
You may complain to a data protection authority. For non-public controllers based in Saxony, the generally competent authority is Sächsische Datenschutz- und Transparenzbeauftragte, Maternistraße 17, 01067 Dresden; post@sdtb.sachsen.de.
22. Data security
Technical and organisational safeguards include server sessions, CSRF protection, prepared database queries, admin password hashing and rate limits for vulnerable operations. They are reviewed and adjusted for the development stage and actual use.
23. Changes to this notice
This notice is updated when functions, recipients, providers, legal bases or privacy roles materially change. The version published in the COFFEE+ application is the applicable version.