Privacy policy

Who we are

Espressisti is an independent, neutral directory of professional coffee-machine service companies in Europe. We are not affiliated with any manufacturer and we do not sell placements.

For the personal data described here, Espressisti acts as the data controller: we decide what is processed and why. You can reach us at hello@espressisti.com for any question about this policy or about a specific listing.

What data we process

Visitors: your browser sends technical data with every page request (IP address, user agent, requested page, timestamp). These are kept in short-lived server logs used for security and troubleshooting.

People who send a quote request: the name, contact details and description of the problem you type into the form, plus a hashed version of your IP address used only for rate limiting.

Reviewers: your email address (confirmed through a one-time link), your rating and review text, and the moderation decision on it.

Company owners who claim a listing: account email, the company details you provide, the VAT number used for verification and any business document you upload as evidence.

People who report incorrect data or ask for a removal: the contact details and the description you send us, kept as a record of how the request was handled.

Legal bases

Performance of a contract or pre-contractual steps: handling a quote request you send, managing an owner account, processing a claim.

Legitimate interests: operating a public directory of businesses, keeping listings accurate, moderating reviews, and preventing spam and abuse. Publishing business information about legal persons and the professional activity of sole traders falls here, balanced against the removal and objection rights described below.

Legal obligation: keeping records we are required to keep, and responding to lawful requests.

Consent: only where we explicitly ask for it, for example before sending an optional notification. You can withdraw consent at any time.

Listings built from public business data

Unclaimed listings are compiled from publicly available business sources. Each one shows the date and nature of the source it came from.

On unclaimed listings we deliberately show less than we hold. Descriptions, email addresses, opening hours and mobile numbers are never published. For companies that are legal persons, the landline can be revealed on request through a rate-limited action. For sole traders, no phone number is shown at all, no street address and no postal code are shown, and the map pin is placed on the centre of the city rather than at a specific address.

Brand information on an unclaimed listing is labelled "declared, not verified". Reviews are not accepted on unclaimed listings, and quote requests sent to them are stored for the owner rather than forwarded.

Every listing carries a "Report incorrect data" link. It is free, it does not require an account, and it is the channel for correction, objection and removal.

Removal, correction and objection

We handle removal and correction requests within 7 days. For sole traders and any listing that identifies an individual, we handle them within 72 hours.

Removing a sole-trader listing means full anonymisation: the name, legal name and address are erased, the page returns a permanent "gone" response instead of content, the entry is excluded from the sitemap and from search, and a non-reversible hash is stored so the same listing cannot be re-imported later. The anonymised record is hard-deleted after 90 days; only the suppression hash remains.

You do not need to explain why. We do not ask for a copy of an identity document unless we genuinely cannot otherwise tell who is making the request.

Who receives your data

Supabase — hosting, database, authentication and file storage, in an EU region.

Resend — delivery of transactional email (verification links, claim and moderation notifications).

The OpenStreetMap Foundation — our maps use OpenStreetMap tiles, which your browser requests directly from OSMF servers. That request reveals your IP address, your approximate map view and your user agent to the OpenStreetMap Foundation. We do not send them anything else, and no map tiles load until a page containing a map is opened.

The company you contact — when you send a quote request to a claimed listing, the content of that request is passed to that company so it can reply to you.

We do not use advertising networks, we do not sell personal data, and we do not share it for marketing purposes.

Analytics

No analytics or tracking product is installed on this site today. There is no advertising pixel, no session recording and no cross-site tracking.

If we add measurement later it will be a cookieless, aggregate-only tool that does not profile individual visitors, and this policy and the cookie policy will be updated before it goes live.

International transfers

We keep processing inside the European Union wherever our providers offer it, and our database and file storage are hosted in an EU region.

Where a provider processes data outside the EEA — for example for email delivery or support access — the transfer relies on the European Commission's standard contractual clauses together with the provider's supplementary safeguards.

How long we keep data

Quote requests: 24 months from the date they are sent, then deleted.

Reviews: for as long as the review is published; rejected reviews are deleted after 12 months.

Claim evidence (VAT checks, uploaded documents): 24 months after the decision, as proof that the listing was legitimately claimed.

Moderation and removal logs: 36 months, in a minimised form, so we can show how a decision was made.

Technical server logs: up to 30 days.

Anonymised sole-trader listings: hard-deleted after 90 days, leaving only the non-reversible suppression hash.

Your rights

You have the right to access your data, to have it corrected, to have it erased, to restrict or object to its processing, and to receive it in a portable format where the processing is based on consent or a contract.

The quickest route is the "Report incorrect data" link on the listing concerned, or an email to hello@espressisti.com. We reply within 30 days, and within 72 hours for sole-trader removals.

You also have the right to lodge a complaint with your national data protection authority — in Italy, the Garante per la protezione dei dati personali.

Changes to this policy

We update this page whenever the processing changes — a new processor, a new form, or the introduction of analytics. The date at the top always reflects the current version.