Data protection
Privacy and cookie policy
Review version. The website is under construction and password-protected. This policy describes the current configuration and will undergo legal validation before the public launch.
1. Data controller
The controller is Tchibo Coffee Service S.R.L., 91 Piersicilor Street, Jilava, Ilfov County, Romania, registered under no. J2020003317237, company identification number 22221282. The domain is owned by Tchibo GmbH, Hamburg, Germany, and will remain its property after the public launch; Tchibo Coffee Service S.R.L. operates the website content.
Local privacy contact: contact@tchibo2go.ro · +40 756 077 398.
Tchibo Coffee Service group data protection contact: datenschutz@tchibo-coffeeservice.de.
2. Data we process
The website only facilitates requests for information or quotations; it does not allow orders or contracts to be concluded online. When you submit a form, we may process your first and last name, contact details, company, customer number, selected options and message. When you access the website, technical data required to deliver and secure the service is processed: IP address, date and time, requested resource, HTTP status, transferred volume, referring page, browser type, operating system and browser language. We also process your language preference and cookie choices.
3. Purposes and legal bases
- delivering and securing the website: legitimate interests, Article 6(1)(f) GDPR;
- answering enquiries and preparing a quotation: pre-contractual steps, Article 6(1)(b) GDPR, and legitimate interests;
- compliance with legal obligations: Article 6(1)(c) GDPR;
- analytics, optional services or marketing: only with consent under Article 6(1)(a) GDPR if such services are configured.
4. Recipients and service providers
Data may be accessed, only where necessary, by Tchibo group companies, authorised distributors or partners responsible for your enquiry and by hosting, IT maintenance, security, communications and email providers acting under contractual confidentiality and data protection obligations. Data may be disclosed to authorities where required by law.
5. International transfers
We aim to process data within the European Union and European Economic Area. If an approved provider involves a transfer outside the EEA, it will only take place under a valid legal mechanism such as an adequacy decision or standard contractual clauses, with supplementary measures where required.
6. Retention periods
Contact form enquiries are retained for 2 years from submission, unless a legal obligation or the defence of a legal claim requires a different period. If a newsletter is enabled, subscription data is retained for 2 years from subscription or until unsubscribe. Technical and security logs are normally retained for no longer than 30 days, except where an incident is being investigated. The language preference is retained for 12 months. Authorisation to access the under-construction site is retained for up to 30 days. Strictly technical cookies last for the session or, where applicable, no more than 13 months. Cookie choices are kept for up to 180 days, until withdrawal or publication of a new policy version.
7. Cookies and local storage
Strictly necessary cookies do not require consent. Optional technologies are blocked until you approve them in the banner. The current configuration does not contain GTM/GA4 identifiers and does not activate optional analytics or marketing scripts.
| Name | Purpose | Duration |
|---|---|---|
| wb_locale | Stores the selected language | 12 months |
| wb_preview | Authorises access to the protected review version | up to 30 days |
| wb_preview_error | Temporarily displays the result of a failed access attempt | 60 seconds |
| wb_cookie_consent | HttpOnly cookie for consent choices and policy version | up to 180 days, until withdrawal or a version change |
The “Cookie settings” button, available after your first choice, allows you to change or withdraw consent. Withdrawal does not affect the lawfulness of prior processing.
8. Your rights
Subject to the GDPR, you have rights to information, access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw consent. This website does not use solely automated decision-making that produces legal effects concerning you.
You may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing, 28-30 Gheorghe Magheru Boulevard, District 1, Bucharest, email anspdcp@dataprotection.ro.
9. Changes
We will update this policy when services, providers or legal requirements change. A new policy version reopens the consent banner.
Review version published on 19 August 2026. Updated for review: 21 October 2026.