Effective from: 16 June 2026 · Version 1.0
1. Who we are
This Privacy Notice explains how Giesen Coffee Roasters B.V. ("Giesen", "we", "us") processes personal data in connection with GiesenCloud, our software-as-a-service platform for coffee roasteries.
Controller details:
- Giesen Coffee Roasters B.V.
- Industrieweg 15, 7071 CK Ulft, The Netherlands
- Chamber of Commerce (KvK): 09165753
- privacy@giesen.com
For any privacy question you can contact us at privacy@giesen.com.
2. What this notice covers
This notice covers personal data we process about customers and their users, prospects, newsletter and marketing subscribers, and visitors to our website.
It does not cover personal data that our customers process through GiesenCloud about their own data subjects (such as a roastery's wholesale customers) — for that data, our customer is the controller and Giesen is a processor. The terms for that processing are in our Data Processing Agreement.
3. What personal data we process and why
| Category | Purpose | Lawful basis |
|---|---|---|
| Account data (name, email, password hash, 2FA secret, language preference) | Provide the service | Contract performance |
| Team / organisation data | Provide the multi-tenant service | Contract performance |
| Authentication and activity logs | Security, abuse detection, regulatory obligation | Legitimate interest + Art. 32 obligation |
| Billing data (billing address, VAT ID, payment-method token via Stripe) | Process subscriptions and invoices | Contract performance; legal obligation (tax) |
| Roast telemetry linked to operators | Provide GiesenLive / Profiler features | Contract performance |
| Support communications | Respond to support requests | Contract performance + legitimate interest |
| Marketing communications | Send newsletter / product updates | Consent (opt-in) — withdrawable at any time |
| Error and performance data (Sentry) | Detect and fix defects | Legitimate interest |
| Website usage / cookies | Operate the website; analytics | Consent / legitimate interest — see our Cookie Policy |
| Team data used to prepare AI training sets | Anonymise data before AI model training (see Section 4) | Legitimate interest — with team-level opt-out |
4. AI features and model training
GiesenCloud includes AI features such as roast suggestions and anomaly detection. This section explains how data is used for them.
Training on anonymised data. We use anonymised team data — including roasts and roast profiles — to train the machine-learning models behind these features. Before any data is used for training:
- all identifiers of your team, your users, and any natural person are removed;
- no personally identifiable information is included in training data;
- data from one customer is never disclosed to another customer.
The anonymisation step itself is processing of personal data and is based on our legitimate interest in improving the service. Once anonymised, the training data is no longer personal data.
Opt-out. Your team can turn this off at any time in Settings → Privacy & Data in the app. The setting takes effect immediately for future training runs. By default it can be changed by the team owner and managers.
AI assistants you connect (MCP). You can connect third-party AI assistants (such as Claude or ChatGPT) to your team's data through scoped access tokens. If you do, the data the assistant retrieves is transmitted to the AI provider you chose, under your own agreement with that provider — those providers are not our sub-processors. Tokens are limited to your team and role permissions and can be revoked at any time in Settings → Integrations.
No automated decision-making. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects within the meaning of GDPR Art. 22. AI output in GiesenCloud consists of suggestions that you review and act on yourself.
5. Where the data goes
We use a number of trusted third-party services (sub-processors and other recipients). The complete, current list — including each provider's purpose, the data involved, and its location — is published at /trust/sub-processors. Changes to that list are announced on that page at least 30 days in advance.
International transfers (to the US and other non-adequate countries) rely on Standard Contractual Clauses and, where applicable, the recipient's EU-US Data Privacy Framework certification.
We never sell personal data.
6. How long we keep your data
- Account data: while you have an active account, then deleted within 30 days of a deletion request, with full purge from encrypted backups within 90 days
- Authentication and audit logs: 365 days
- Invoices: 7 years (Dutch tax law)
- Marketing list: until you opt out + 30 days proof
- Backups: encrypted backups may retain deleted data for up to 90 days before being purged
7. Your rights
Under the GDPR you have rights to access, rectify, erase, restrict, port, object, withdraw consent, and lodge a complaint. Several of these are available directly in the app:
- Export your personal data: Profile → Your data
- Delete your account: Profile → Delete Account
- Object to AI training use of your team's data: Settings → Privacy & Data (team owners and managers)
- Unsubscribe from marketing: the link in every marketing email
For anything else, contact privacy@giesen.com. We aim to respond within 30 days.
Our lead supervisory authority is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
8. Security
We implement appropriate technical and organisational measures including TLS in transit, encryption at rest, multi-tenant isolation, two-factor authentication, role-based access control, comprehensive audit logging, and regular security reviews. The full, current overview is published at /trust/security.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours and inform affected users without undue delay.
9. Cookies and similar technologies
We use strictly necessary cookies to operate the platform (session, security) and — on our marketing website only — analytics. The details, including names, purposes, and retention periods, are in our Cookie Policy.
10. Children's data
GiesenCloud is a B2B service. We do not knowingly collect personal data from children under 16.
11. Changes to this notice
Material changes are communicated by email and by in-app notice. Where a new version requires re-acceptance, you will be prompted on next login. The current version is always available at /legal/privacy.
12. Contact
- privacy@giesen.com
- Postal: Giesen Coffee Roasters B.V., Industrieweg 15, 7071 CK Ulft, The Netherlands
You may also lodge a complaint with the Autoriteit Persoonsgegevens. We would always prefer to resolve concerns directly first.