This Privacy Policy explains how Acha Matcha collects, uses, shares, and protects personal data when you visit the website, join the launch waitlist, contact us, or purchase products.
1. Who is responsible for your data
The controller responsible for the processing described in this Privacy Policy is:
Vanessa Grace Acha Anoh
Acha Matcha
Berlin, Germany
privacy@achamatcha.de
You may use the privacy email address above for questions about this policy or to exercise your data protection rights.
2. When this policy applies
This Privacy Policy applies when you visit achamatcha.de or another Acha Matcha Shopify storefront, join the launch waitlist, contact Acha Matcha, create a customer account, or purchase products. Independent third-party services are governed by their own privacy notices.
3. Personal data we collect
3.1 Information you provide
- Waitlist and marketing information, including your email address, consent status, and subscription preferences.
- Correspondence, including information you send when you contact Acha Matcha or make a privacy request.
- When shopping is available, order and account information such as your name, billing and delivery address, contact details, order history, returns, and customer-service records.
- Payment information is handled by the payment provider presented at checkout. Acha Matcha generally receives transaction confirmation and limited payment details rather than full card information.
3.2 Information collected automatically
- Device and connection information, including IP address, browser type, operating system, language, approximate location, cookie identifiers, and other technical identifiers.
- Website activity, including pages viewed, timestamps, referral information, and interactions needed to operate, secure, and improve the website.
- Cookie and privacy-choice information, including choices made through Shopify's cookie banner or customer privacy controls.
4. Why we use personal data and our legal bases
Launch waitlist and marketing
We use your email address to send the launch announcement, the first-tin offer, and closely related Acha Matcha communications. The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time by using an unsubscribe link or contacting privacy@achamatcha.de.
Orders and customer service
When shopping is available, we use customer and order information to process purchases, deliver products, manage returns, answer requests, and administer the customer relationship. The legal basis is performance of a contract or steps requested before a contract under Article 6(1)(b) GDPR.
Legal obligations
We process and retain records where necessary to comply with tax, accounting, product-safety, consumer-protection, or other legal obligations. The legal basis is Article 6(1)(c) GDPR.
Security and service integrity
We process limited technical information to prevent fraud, protect the website, diagnose errors, and establish or defend legal claims. The legal basis is our legitimate interests under Article 6(1)(f) GDPR, balanced against your rights and reasonable expectations.
Optional cookies and similar technologies
Where consent is required, analytics, personalization, or advertising technologies are used only after consent under Article 6(1)(a) GDPR and applicable device-storage rules. You may change your choices through the available cookie or privacy controls.
5. Shopify and other recipients
The website and launch waitlist are hosted through Shopify. Acha Matcha generally determines why customer information is processed, while Shopify processes information to provide the commerce platform. Shopify may also process certain information for its own purposes, depending on the services and settings used.
We disclose personal data only when necessary to the following categories of recipients:
- Shopify, its affiliates, and approved subprocessors providing hosting, commerce, security, communications, and related platform services.
- Payment, delivery, email, professional, and technical service providers engaged to perform services for Acha Matcha.
- Public authorities, regulators, courts, or professional advisers where disclosure is required by law or needed to protect legal rights.
- A genuine buyer, successor, or adviser in connection with a business reorganization, financing, merger, or sale, subject to appropriate safeguards.
Acha Matcha does not sell personal data for money. Depending on Shopify settings, Shopify services may use data across merchant services as explained in Shopify's Consumer Privacy Policy. Where applicable law requires consent or an opt-out choice, the relevant Shopify privacy controls will be provided.
Shopify Consumer Privacy Policy
6. International data transfers
Shopify and other providers may process personal data outside Germany or the European Economic Area. Where a destination does not benefit from an adequacy decision, transfers are protected through a legally recognized mechanism, such as the European Commission's Standard Contractual Clauses, together with supplementary safeguards where required.
7. How long we keep personal data
- Waitlist and marketing information is kept while your consent remains active and the relevant Acha Matcha communications continue. It is removed when you withdraw consent or when the purpose ends. A minimal suppression record may be retained so that we can respect an unsubscribe request.
- Order, invoice, and accounting records are retained for the period required by applicable German tax and commercial law.
- Customer-service and correspondence records are kept only as long as reasonably needed to resolve the matter and establish or defend legal claims.
- Cookie and consent records are kept according to the duration shown in the relevant privacy controls or as needed to demonstrate your choices.
When a retention period ends, personal data is deleted or anonymized unless continued storage is required by law.
8. Cookies and similar technologies
The website uses technologies that are necessary to load pages, protect the store, maintain sessions, remember privacy choices, and provide requested functions. These technologies may be used without consent where they are strictly necessary.
Where optional analytics, personalization, or advertising technologies are used, they are controlled by the applicable cookie banner or customer privacy settings. Optional technologies are not activated before consent where opt-in consent is required. You can refuse or later change optional choices without losing access to the core website.
9. Marketing choices
You can withdraw marketing consent at any time by selecting the unsubscribe link in an email or contacting privacy@achamatcha.de. Withdrawal does not affect processing that occurred before withdrawal. We may retain the minimum information necessary to record and respect your choice.
10. Your data protection rights
Subject to the conditions and limits in applicable law, you may have the right to:
- obtain information about and access to your personal data;
- correct inaccurate or incomplete personal data;
- request deletion or restriction of processing;
- receive certain personal data in a portable format;
- object to processing based on legitimate interests or to direct marketing;
- withdraw consent at any time; and
- lodge a complaint with a data protection supervisory authority.
To exercise a right, email privacy@achamatcha.de. We may request information needed to verify your identity. A request is normally free of charge, subject to the exceptions permitted by law.
11. Children
The website and launch waitlist are not directed to children under 16, and Acha Matcha does not knowingly collect personal data from children under 16. If you believe a child has provided personal data, contact privacy@achamatcha.de so that we can review and, where appropriate, delete it.
12. Security
We use reasonable technical and organizational safeguards appropriate to the nature and risk of the personal data. No online service can guarantee absolute security. If a personal data breach creates a legal notification obligation, we will notify the relevant authority and affected individuals as required.
13. Changes to this policy
We may update this Privacy Policy when our services, providers, legal obligations, or data practices change. The effective date at the top identifies the latest version. Material changes will be communicated where required by law.
14. Contact and complaints
Please contact Acha Matcha first at privacy@achamatcha.de so that we can address your concern.
You may also lodge a complaint with the Berliner Beauftragte für Datenschutz und Informationsfreiheit or with the supervisory authority where you live or work, or where an alleged infringement occurred.
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
Germany
mailbox@datenschutz-berlin.de
Berlin data protection complaint information
