Privacy Policy - Your Data & Privacy Rights

This Privacy Policy explains how Novebar, operated by Daniel Samer ("we", "us", or "our"), collects, uses, discloses, and protects your personal data when you use our home-espresso and specialty-coffee review blog.

Novebar provides buying guides, product comparisons, and practical knowledge on espresso machines, portafilter machines, grinders, bean-to-cup machines, and barista accessories. We participate in affiliate programs (primarily Amazon Associates and coffee-gear partner networks), which may use tracking technologies to attribute referrals.

We are committed to protecting your privacy and ensuring your personal data is handled in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

Data Controller:
Novebar
Operated by Daniel Samer
Am Alefskamp 50
47198 Duisburg
Germany
Email: blogs@samer.email
Phone: +49 15225669203

By using our platform, you confirm that you have read and understood this Privacy Policy.

We collect the following categories of personal data:

Account Data:
- Name and username
- Email address
- Password (encrypted)
- Profile information you provide

Profile Data:
- Profile picture (if uploaded)
- Biography and description
- Preferences and settings

Technical Data:
- IP address
- Browser type and version
- Device information
- Operating system
- Time zone and location data
- Cookies and similar technologies (see our Cookie Policy)

Usage Data:
- Pages visited and features used
- Time spent on the platform
- Actions taken (clicks, interactions)
- Referral source

Communication Data:
- Messages and correspondence with us
- Feedback and support requests
- Survey responses

We collect data directly from you, automatically through your use of the platform, and occasionally from third parties (such as social login providers, where applicable).

We use your personal data for the following purposes:

Service Delivery:
- To create and manage your account
- To provide and maintain our services
- To process transactions and send related information

Communication:
- To respond to your inquiries and support requests
- To send service-related notifications
- To send marketing communications (with your consent)

Improvement and Development:
- To analyze usage patterns and improve our services
- To develop new features
- To conduct research and analytics

Security and Compliance:
- To protect against fraud and unauthorized access
- To comply with legal obligations
- To enforce our Terms of Service

Legal Bases for Processing (GDPR):
- Contract performance: Processing necessary to provide our services
- Consent: Processing based on your explicit consent
- Legitimate interests: Processing for our legitimate business interests
- Legal obligation: Processing required by law

We do not sell your personal data. We may share your information in the following circumstances:

Service Providers:
We work with third-party companies that help us operate our platform, such as:
- Hosting and cloud infrastructure providers
- Payment processors
- Analytics services
- Email service providers

These providers are contractually obligated to protect your data and use it only for specified purposes.

Legal Requirements:
We may disclose your data when necessary to:
- Comply with legal obligations or valid legal process
- Protect our rights, property, or safety
- Investigate potential violations of our Terms
- Protect against legal liability

Business Transfers:
In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. We will notify you of any such change.

With Your Consent:
We may share your data for other purposes with your explicit consent.

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, including:

Active Accounts:
- Account data is retained while your account is active
- You may request deletion at any time

After Account Deletion:
- Most data is deleted within 30 days
- Some data may be retained longer for legal compliance (e.g. transaction records for tax purposes)
- Anonymized data may be retained for analytics

Specific Retention Periods:
- Account information: Duration of account plus 30 days
- Transaction records: 10 years (legal requirement)
- Support correspondence: 3 years
- Server logs: 90 days

We review our retention practices regularly to ensure we do not keep data longer than necessary.

Under the General Data Protection Regulation (GDPR), you have the following rights:

1. Right of Access: You may request a copy of your personal data and information about how it is processed.

2. Right to Rectification: You may request correction of inaccurate or incomplete personal data.

3. Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data under certain circumstances.

4. Right to Restriction of Processing: You may request that we limit how we use your data.

5. Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format.

6. Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes.

7. Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

8. Right to Lodge a Complaint: You may file a complaint with a supervisory authority if you believe your rights have been violated.

To exercise any of these rights, please contact us at blogs@samer.email. We will respond to your request within 30 days.

Supervisory Authority:
The competent authority is the data protection supervisory authority of the German federal state in which the operator is established. A directory of all German supervisory authorities is published by the Federal Commissioner for Data Protection and Freedom of Information: https://www.bfdi.bund.de

We use cookies and similar technologies to collect information and improve your experience. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

Types of Cookies:
- Necessary cookies: Required for the platform to function
- Analytics cookies: Help us understand how visitors use our site

You can control cookies through:
- Our cookie consent banner
- Your browser settings
- The cookie settings page

We implement appropriate technical and organizational security measures to protect your personal data, including:

Technical Measures:
- Encryption of data in transit (TLS/SSL)
- Encryption of sensitive data at rest
- Secure password hashing
- Regular security updates and patches
- Firewall and intrusion detection systems

Organizational Measures:
- Restricted access to personal data on a need-to-know basis
- Regular security training
- Incident response procedures
- Regular security assessments

While we strive to protect your data, no method of transmission over the internet is completely secure. We cannot guarantee absolute security but commit to taking all reasonable steps to protect your information.

If you suspect a security breach, please contact us immediately.

Our platform is not intended for children under 18 years of age. We do not knowingly collect personal data from children under 18.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately. We will take steps to delete such information from our systems.

If we learn that we have collected personal data from a child under 18, we will delete that information as quickly as possible.

Your data is primarily processed within the European Union. When we transfer your data outside the EU/EEA, we ensure appropriate safeguards are in place:

- Standard Contractual Clauses approved by the European Commission
- Adequacy decisions by the European Commission
- Other legally recognized transfer mechanisms

By using our platform, you understand that your information may be transferred to, stored in, and processed in countries outside your country of residence.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons.

When we make changes:
- We will update the "Last updated" date above
- For material changes, we will provide prominent notice (e.g. email notification or a banner on the platform)

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

Your continued use of the platform after changes take effect constitutes acceptance of the revised Privacy Policy.

If you have questions about this Privacy Policy or our data practices, please contact us:

Daniel Samer
Am Alefskamp 50
47198 Duisburg
Germany

Email: blogs@samer.email
Phone: +49 15225669203

For GDPR-related inquiries, you may also contact the competent supervisory authority. The competent authority is the data protection supervisory authority of the German federal state in which the operator is established; a directory of all German supervisory authorities is published by the Federal Commissioner for Data Protection and Freedom of Information at https://www.bfdi.bund.de