Legal
Privacy Policy
Last updated: 31 October 2026
1. Data Controller
Kaffebønna is the data controller for personal data collected via this website and the online shop.
- Kaffebønna
- Stortorget 3, 9008 Tromsø
- Email: post@kaffebonna.no
2. What information we collect
Contact form
When you send us a message via the contact form, we collect:
- Name
- Email address
- Phone number (optional)
- Type of inquiry
- Message content
Job application
When you submit a job application via the website, we collect:
- Full name
- Email address
- Phone number
- Desired position
- Availability (full-time, part-time etc.)
- Start date
- Free text about yourself
- CV (uploaded file)
Please do not include national ID numbers, health information or other sensitive information in your application or CV. We do not need it.
Technical information
When visiting the website, the following technical information may be recorded via third-party services (see sections 5 and 7):
- IP address
- Browser type and version
- Operating system
- Pages visited and time
3. Online shop
When you shop in the online shop, we process the information needed to deliver your order:
- Name
- Delivery address
- Email address and phone number
- What you ordered, the price and your chosen delivery method
- Order number, receipt and any complaints
Payment is handled by Shopify and Vipps MobilePay. We never see your card number or other payment details, only that the order has been paid.
| Purpose | Legal basis |
|---|---|
| Processing, delivering and following up your order | Contract (GDPR art. 6(1)(b)) |
| Bookkeeping the sale and keeping accounting records | Legal obligation (GDPR art. 6(1)(c), Norwegian Bookkeeping Act) |
| Responding to a bakery request from a business | Steps prior to a contract (GDPR art. 6(1)(b)) |
Recipients: Shopify (shop platform and checkout, under a data processing agreement; data may be processed in Canada and the USA), Vipps MobilePay (payment), Posten Bring (shipping) and Vercel (website hosting). See sections 5 and 6.
Bakery request from a business
The bakery request form for businesses collects company name, contact person, email, phone, what you would like to order, preferred date and time, pickup or delivery and an optional message. The request is sent to us by email via Brevo and deleted within 12 months after it has been answered. Please do not write health information about named people in the message; list the allergens to avoid instead.
4. Purpose and legal basis
| Purpose | Legal basis |
|---|---|
| Responding to inquiries via the contact form | Consent (GDPR art. 6(1)(a)) |
| Processing job applications | Consent (GDPR art. 6(1)(a)) |
| Online shop and orders (see section 3) | Contract and legal obligation (GDPR art. 6(1)(b) and (c)) |
| Stopping spam in the forms (Cloudflare Turnstile) | Legitimate interest (GDPR art. 6(1)(f)) |
| Delivering the website and the scripts it uses | Legitimate interest (GDPR art. 6(1)(f)) |
| Displaying maps and locations, including the map’s usage statistics (Mapbox) | Consent (GDPR art. 6(1)(a)) |
| Displaying video | Legitimate interest (GDPR art. 6(1)(f)) |
| Showing stock levels in the online shop (Shopify) | Legitimate interest (GDPR art. 6(1)(f)) |
| Remembering choices you have made (consent, closed notices, shopping cart) | Legitimate interest (GDPR art. 6(1)(f)) |
| Visitor statistics (PostHog and Vercel Web Analytics) | Consent (GDPR art. 6(1)(a)) |
5. Processors and other recipients
We use the following services. They process data on our behalf, or deliver content directly to your browser:
Vercel
The website is hosted by Vercel Inc. (USA). The server functions that receive forms and orders run in the EU (Frankfurt), but pages are delivered via Vercel’s global network, which sees your IP address. With your consent we also use Vercel Web Analytics, which counts page views without cookies. Read more in Vercel’s privacy policy (opens in a new tab).
Brevo
Messages from the contact form, job applications with CVs and bakery requests from businesses are sent to us by email via Brevo (France), which also sends the confirmation to you. The data is processed in the EU. Read more in Brevo’s privacy policy (opens in a new tab).
Cloudflare Turnstile
To stop spam, Cloudflare Turnstile checks that the forms are sent by a human. Turnstile only loads when you scroll to or start using a form, and then receives your IP address and technical signals from your browser and device. Cloudflare Inc. is based in the USA. Read more in Cloudflare’s privacy policy (opens in a new tab).
jsDelivr og unpkg
Some scripts (animations, smooth scrolling and video playback) are loaded from the public content delivery networks jsDelivr and unpkg. Your browser then sends its IP address to them. The networks are global and run partly on US providers. Read more in jsDelivr’s privacy policy (opens in a new tab).
Mapbox
We use Mapbox (Mapbox Inc., USA) to display interactive maps of our locations. The map only loads when you click “Show map”, or after you have clicked “Accept” in the consent banner. Until then nothing is sent to Mapbox. When the map loads, Mapbox receives your IP address and technical information, and the map sends usage statistics (telemetry) to Mapbox. For this the map stores a random ID in your browser (see section 7). Read more in Mapbox’s privacy policy (opens in a new tab).
Bunny CDN
We use Bunny CDN to deliver video content. Bunny may log technical information in connection with content delivery. Read more in Bunny’s privacy policy (opens in a new tab).
PostHog
If you choose “Accept” in the consent banner, we use PostHog for visitor statistics: the pages you open, where you came from, your device and browser type, your IP address (used for a rough location, like country and city) and clicks on phone, email, directions and social media links. We don’t record your screen, track mouse movements or build an advertising profile. The data is stored in the EU (Frankfurt). Read more in PostHog’s privacy policy (opens in a new tab).
Supabase
The publishing tool we use to update texts, opening hours and images on the website stores that content and our staff accounts with Supabase (Supabase Inc., USA). No visitor data is stored there. Read more in Supabase’s privacy policy (opens in a new tab).
Anthropic
Texts that our staff write in the publishing tool are machine-translated into English and Chinese using Anthropic (Anthropic PBC, USA). No visitor data is sent. Read more in Anthropic’s privacy policy (opens in a new tab).
Shopify
The online shop uses Shopify. When you open a page in the shop, your browser fetches stock levels directly from Shopify, which then receives your IP address. Orders and checkout are handled by Shopify as our data processor (the Shopify group, Canada; data may be processed in Canada and the USA). Read more in Shopify’s privacy policy (opens in a new tab).
Vipps MobilePay
If you pay with Vipps or MobilePay, the payment is processed by Vipps MobilePay AS (Norway).
Posten Bring
Posten Bring AS (Norway) delivers parcels from the online shop. They receive your name, delivery address, phone number and email address so they can deliver, notify you and track the parcel.
6. Transfers outside the EEA
Some of the services in section 5 are run by companies in the USA or Canada, so data may be transferred there:
- USA: Vercel, Cloudflare, Mapbox, Supabase, Anthropic, Shopify and the providers behind jsDelivr and unpkg.
- Canada: Shopify.
Transfers to the USA rely on the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses (SCC). Canada has an adequacy decision from the European Commission.
7. Cookies and local storage
The website stores a few items in your browser, either as cookies or in the browser’s local storage (localStorage). Most of them only remember choices you have made. The statistics tool PostHog only stores anything if you have chosen “Accept”. If you choose “Decline”, no statistics data is stored.
| Name | Purpose | Duration |
|---|---|---|
| kb-cookie-consent localStorage | Remembers your consent choice | 12 months, or until this privacy policy changes |
| kb-banner:… localStorage | Remembers that you closed a notice on the website | Until you clear your browser data |
| mapbox.eventData… localStorage | Mapbox: random ID and timestamp for the map’s usage statistics (consent, as for the map itself) | Until you clear your browser data |
| kb-shop-cart-v3 localStorage | Online shop: the contents of your cart | Until you clear your browser data |
| kb-shop-checkout localStorage | Online shop: the ID of your cart at Shopify, so the cart is emptied after you have paid | Until the order is completed or the cart expires |
| kb-shop-stock sessionStorage | Online shop: cached stock levels, no personal data | 60 seconds, and deleted when the tab is closed |
| kb_shop Cookie | Staff access code while the online shop has not yet opened | 30 days |
| ph_…_posthog Cookie and localStorage | PostHog: tells visits apart (only with consent) | 365 days |
| Shopify Cookies | Set by Shopify at checkout, on Shopify’s own domain. See Shopify’s cookie policy (opens in a new tab). | See Shopify |
You can change your choice at any time:
8. Retention period
- Contact inquiries: Deleted within 12 months after the inquiry has been answered.
- Job applications: Deleted within 6 months after the recruitment process ends, unless you have consented to longer storage.
- Online shop orders: Accounting records, such as orders and receipts, are kept for 5 years after the end of the financial year, as required by the Norwegian Bookkeeping Act. Other data is deleted when it is no longer needed for the order, complaints or the right of withdrawal.
- Bakery requests from businesses: Deleted within 12 months after the request has been answered.
- Your consent choice: Stored in your browser for 12 months. After that, or when this privacy policy changes, we ask again.
- Technical information: Processed by third parties in accordance with their own policies.
- Visitor statistics: Kept in PostHog for up to 12 months, then deleted.
9. Your rights
You have the right to:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request that inaccurate information be corrected.
- Erasure: Request that your data be deleted.
- Restriction: Request that processing be restricted.
- Data portability: Receive your data in a structured format.
- Objection: Object to processing based on legitimate interest.
- Withdraw consent: You can withdraw your consent at any time.
To exercise your rights, contact us at post@kaffebonna.no.
10. Complaints
If you believe that the processing of your personal data does not comply with the regulations, you can file a complaint with the Norwegian Data Protection Authority (opens in a new tab).
11. Changes
We may update this privacy policy as needed. Any changes will be published on this page with an updated date.