Privacy Policy

1. Controller

The controller responsible for data processing on this website is:
Zisimou GmbH (Roastau)
Hauptstraße 50
52372 Kreuzau
Germany
Represented by the managing director Georgios Zisimou
Phone: 0 24 22 – 50 20 47
Email: info@roastau.de

2. Data protection officer

We have not appointed a data protection officer, as we are not legally required to do so (§ 38 BDSG). For all questions about data protection, please contact us at info@roastau.de.

3. General information on data processing

We process personal data only to the extent necessary to provide a functioning website, to process your orders and enquiries, or where you have given your consent. We do not sell personal data and do not use it for advertising profiles.

4. Hosting and server log files

This website runs on our own server in Germany; no external hosting provider is involved. Each time a page is accessed, the server automatically records the IP address, date and time of access, the page requested, the referrer and the browser used. We need this data to deliver the website and to keep it secure, for example to detect and fend off attacks. The legal basis is our legitimate interest in the secure and reliable operation of the website (Art. 6 (1) (f) GDPR). The data is not merged with other data sources and is deleted once it is no longer required for these purposes.

5. Email

Our mailbox (info@roastau.de) and the emails sent by our shop, such as order confirmations, run through the provider Hostinger (Hostinger International Ltd., Cyprus), which processes this data on our behalf (Art. 28 GDPR).

6. Cookies and Google Analytics

We use technically necessary cookies, for example to keep your shopping cart, your login and your cookie choice. They do not require consent (§ 25 (2) TDDDG); the legal basis for the associated processing is Art. 6 (1) (b) and (f) GDPR.

Only if you choose “Accept cookies” in our cookie banner do we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics sets cookies (prefix “_swag_ga”, lifetime up to two years) and records, for example, the pages you visit, how long you stay, where your visit came from, device and browser information, your approximate location and steps of the ordering process (products, order value). We only receive aggregated statistics that help us improve our shop. Google Analytics 4 does not store IP addresses. The legal basis is your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). Google processes the data on our behalf under a data processing agreement; data may also be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR). Analytics data is deleted after no more than 14 months. More information: policies.google.com/privacy.

You can withdraw your consent at any time with effect for the future via “Cookie settings” at the bottom of every page.

7. Orders and customer account

When you place an order, as a guest or with a customer account, we process the data required for this (name, billing and delivery address, email address, the order and payment data and, if you create an account, your password in encrypted form) to conclude and perform the contract (Art. 6 (1) (b) GDPR). You can close your customer account at any time. Data subject to commercial and tax retention obligations is stored for the statutory periods, as a rule six or ten years (§ 257 HGB, § 147 AO; Art. 6 (1) (c) GDPR).

8. Payment

Online payments (for example card, Apple Pay, Google Pay, bank transfer, Pay by Bank and Klarna, as shown at checkout) are processed by the payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands (“Mollie”). For this we transmit to Mollie your name, email address, billing and delivery address, the order amount and the ordered items. You enter card or account details directly with Mollie; on our checkout page the card fields are loaded from Mollie, so we never see your full card details. If you choose Apple Pay, Google Pay or Klarna, the respective provider also receives the data needed for the payment. Mollie can store your card for future purchases if you choose this. Mollie processes the data as an independent controller, also to prevent fraud and to meet its legal obligations; see mollie.com/privacy.

If we offer prepayment, invoice or cash on delivery, we receive the transfer details (name, IBAN, amount, reference) from our bank, and for cash on delivery the shipping company collects the amount due on delivery. The legal basis for all payment processing is Art. 6 (1) (b) GDPR; for fraud prevention, Art. 6 (1) (f) GDPR.

9. Shipping

To deliver your order we pass your name and delivery address, and for cash on delivery the amount to be collected, to the shipping company commissioned with the delivery (Art. 6 (1) (b) GDPR).

10. Contact form, email and withdrawal form

If you contact us via the contact form or by email, or declare your withdrawal via the withdrawal form, we process your details (name, email address and your message; phone number and order number if you provide them) to answer your enquiry or to process the withdrawal (Art. 6 (1) (b) GDPR, otherwise Art. 6 (1) (f) GDPR). We delete the data once your enquiry has been dealt with, unless statutory retention obligations apply.

11. Product reviews

Customers with a customer account can review products. We publish the review with its title, text and star rating on the product page under your first name and the initial of your last name. The legal basis is your decision to publish a review (Art. 6 (1) (a) GDPR). You can ask us to remove your review at any time.

12. Newsletter

We only send our newsletter with your consent (Art. 6 (1) (a) GDPR) and use the double opt-in procedure: your subscription only becomes active once you confirm it via the link in the confirmation email. You can unsubscribe at any time, for example via the link in every newsletter email.

13. Your rights

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interests (Art. 21 GDPR)
• Right to withdraw a consent given, with effect for the future (Art. 7 (3) GDPR)

An email to info@roastau.de is enough.

14. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

15. Changes to this privacy policy

We adapt this privacy policy when our data processing or the legal situation changes.
Last updated: 2 October 2026.