Privacy policy

Privacy Policy

Last updated: September 2026

This Privacy Policy explains how Morning Glory Shop, trading as Morning Glory Coffee, collects and uses your personal data when you visit https://morningglorycoffee.shop, buy from us, subscribe to our coffee, or contact us.

We are the controller of that data under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).

Read this together with our Cookie Policy, which covers cookies and similar technologies in detail.

1. Our details


Controller	Morning Glory Shop, trading as Morning Glory Coffee
Address	Garenkokerskade 49 A, 2013 AK Haarlem
KvK	42139501
Privacy contact	hello@morningglorycoffee.shop
Data protection officer	We are not required to appoint one, and have not. Privacy questions go to the address above.

2. The personal data we collect

You give us:

Identity and contact data — name, email address, delivery and billing address, phone number.
Order data — what you ordered, order number, order history, delivery preferences, gift messages.
Account data — email, password (stored hashed, never in readable form), saved addresses, subscription settings.
Payment data — we receive confirmation of payment, the method used, and the last four digits and card type. We never receive or store your full card number or security code; those go directly to our payment provider.
Communications — the content of emails, contact form messages and support conversations.
Marketing preferences — whether you have opted in to our newsletter and, separately, to our roaster's newsletter.

We collect automatically:

Technical data — IP address, browser and device type, operating system, language, and the pages you view.
Usage data — how you move through the shop, what you view, what you add to the basket. Beyond what is strictly necessary to run the shop, this is only collected with your consent through cookies and similar technologies.
Back-in-stock interest data — where you ask to be notified about a sold-out product, or view or click a sold-out variant. See section 5.

We do not knowingly collect special categories of personal data (health, religion, political opinion and so on), and we ask you not to send them to us. Coffee preferences are not special category data.

3. Why we use your data, and our legal basis

What we do	Data used	Legal basis (GDPR art. 6)
Take, process, deliver and invoice your order	Identity, contact, order, payment	Contract — art. 6(1)(b)
Manage your account	Account, identity, contact	Contract — art. 6(1)(b)
Run your coffee subscription, take recurring payment, notify you before each dispatch	Account, order, payment	Contract — art. 6(1)(b)
Handle returns, refunds, warranty claims and complaints	Identity, contact, order, communications	Contract — art. 6(1)(b); legal obligation — art. 6(1)(c)
Keep invoices and accounting records	Identity, contact, order, payment	Legal obligation — art. 6(1)(c), art. 52 Dutch General Tax Act
Product safety, recalls and food incident handling	Identity, contact, order	Legal obligation — art. 6(1)(c); vital interests — art. 6(1)(d) where health is at risk
Send our newsletter and offers	Email, name, marketing preferences	Consent — art. 6(1)(a). For existing customers we may email you about similar coffee under legitimate interests — art. 6(1)(f) — and every message has a one-click unsubscribe
Pass your email to our roaster for their newsletter, if you tick that box	Email, name	Consent — art. 6(1)(a)
Notify you when a sold-out product is back	Email, product/variant	Consent — art. 6(1)(a)
Understand which products sell out and are in demand	Anonymous or pseudonymous interest events	Legitimate interests — art. 6(1)(f): running our range sensibly. Storage or reading on your device requires your consent
Analytics and advertising (Meta, Google, TikTok)	Technical, usage, identifiers	Consent — art. 6(1)(a), via the cookie banner
Prevent fraud, abuse and payment risk	Technical, order, payment	Legitimate interests — art. 6(1)(f): protecting the shop from fraud
Secure, maintain and improve the website	Technical, usage	Legitimate interests — art. 6(1)(f)
Establish, exercise or defend legal claims	As relevant	Legitimate interests — art. 6(1)(f)

Where we rely on consent, you can withdraw it at any time — see section 9. Withdrawing does not affect processing already carried out.

Where we rely on legitimate interests, we have weighed those interests against your rights and concluded they do not override them. You may object at any time (section 9), and we will tell you the outcome of the balancing exercise.

4. Newsletters — ours and our roaster's

We sell coffee roasted by Morning Glory Coffee ("the Roaster"), our partner roastery, and we work closely with them. When you sign up for a newsletter you can choose, separately and independently:

to receive our newsletter from Morning Glory Coffee's webshop; and/or
to receive the Roaster's own newsletter, sent by the Roaster.

These are two separate choices with two separate tick boxes. Neither is ticked in advance, and neither is a condition of buying anything from us.

If, and only if, you tick the second box, we pass your email address and name to the Roaster. From that moment the Roaster is an independent controller of that data: they decide what to send you and how long to keep it, and their own privacy notice applies, available at https://www.morningglorycoffee.nl/policies/privacy-policy. We are not responsible for their processing.

You can unsubscribe from either newsletter at any time, independently, using the unsubscribe link in any message. Unsubscribing from ours does not unsubscribe you from theirs, and the other way round — to leave the Roaster's list, use the unsubscribe link in their email or contact them directly.

5. Back-in-stock notifications

When a product is sold out you can ask us to email you when it returns.

We store your email address together with the product and variant you asked about, and the date. We use it for one purpose only: to send you that notification.
We send one notification per request. We do not add you to our newsletter on the basis of a back-in-stock request — that requires a separate opt-in.
You can ask us to delete a pending request at any time by emailing support@morningglorycoffee.shop.
We delete a back-in-stock record 30 days after we send you the notification. If the product never comes back, we delete the request after 12 months — long enough to cover a seasonal coffee returning with the next harvest, and no longer.

We also count, in aggregate, how often sold-out products are viewed and clicked, so we know what to restock. These counts use a short-lived session identifier and are not linked to your name, email or order history. Where this involves storing or reading anything on your device, we do it only with your consent through the cookie banner.

This service runs on our own database, hosted for us by a database hosting provider within the EU acting as our processor under a written agreement. Access is restricted to us. The provider is named in the list of recipients in section 6, which we keep up to date.

6. Who we share your data with

We do not sell your personal data. We share it only with the following, and only as far as necessary.

Processors acting on our instructions. Each is bound by a written data processing agreement under art. 28 GDPR and may use your data only on our instructions.

Recipient	What they do	Where the data is processed
Shopify International Ltd	Runs our webshop, checkout, customer accounts and order records	Ireland (EU), with onward transfers as described in section 7
Shopify Payments	Card payments taken at our checkout	EU, with onward transfers as described in section 7
Mollie B.V.	iDEAL and other payment methods	Netherlands
PostNL N.V.	Delivers your order	Netherlands
DHL	Delivers your order	Netherlands / EU
Klaviyo	Sends our newsletter and transactional email	United States, with safeguards as described in section 7
Supabase	Hosts our back-in-stock database	European Union
Moneybird B.V.	Our bookkeeping and invoicing	Netherlands

Independent controllers. These decide for themselves what they do with the data, and their own privacy notices apply.

Recipient	What for	Basis
Morning Glory Coffee (our partner roastery)	Their own newsletter, if you ticked that box — see section 4	Your consent
Meta, Google, TikTok	Advertising and measurement, and — for Google — video you choose to play from our embedded brewing guides. For some of this we and the platform are joint controllers under art. 26 GDPR	Your consent, via the cookie banner
Tax authorities, auditors and regulators (Belastingdienst, NVWA, ACM, Autoriteit Persoonsgegevens)	Where we are legally required to provide information	Legal obligation
Lawyers, debt collectors, insurers	Establishing or defending legal claims	Legitimate interests

If our business is sold or transferred, your data may transfer with it. We will tell you beforehand and the buyer will remain bound by this policy.

7. Transfers outside the EEA

We prefer suppliers that store data in the EU or EEA.

Our webshop, payments, delivery, bookkeeping and back-in-stock database are all processed within the EU.

Personal data does leave the EEA in these cases: our email marketing provider (Klaviyo) is established in the United States; our advertising and analytics platforms (Meta, Google, TikTok) process data in the United States; and Shopify may make onward transfers within its group. Where that happens, we rely on:

an adequacy decision by the European Commission, including the EU–US Data Privacy Framework where the recipient is certified under it; or
the European Commission's Standard Contractual Clauses, together with supplementary technical and organisational measures where the transfer risk assessment requires them.

You can ask us for a copy of the safeguards we rely on by emailing support@morningglorycoffee.shop.

8. How long we keep your data

Data	Retention period	Why
Order, invoice and payment records	7 years from the end of the financial year	Dutch statutory tax retention (art. 52 AWR)
Account data	While your account is open, then 12 months after you close it or after 3 years of inactivity	Lets you reopen an account and settles any outstanding order questions
Newsletter subscription	Until you unsubscribe. We then keep a minimal suppression record indefinitely	So we do not email you again by mistake
Back-in-stock requests	30 days after we send the notification; 12 months if the product never returns	The purpose is spent once you are notified
Aggregate interest events	The session identifier is removed after 90 days, leaving anonymous counts we keep indefinitely	Anonymous counts let us compare demand year on year without holding personal data
Support and complaint correspondence	2 years after the matter is closed, and longer while a claim is live or reasonably foreseeable	Consumer non-conformity claims expire 2 years after notification (art. 7:23 lid 2 BW); order records are kept separately for 7 years
Product safety and recall records	10 years from the date we last supplied the product	Matches the technical documentation period under the General Product Safety Regulation and the 10-year long-stop for product liability claims
Cookie and marketing data	As set out in our Cookie Policy	Varies by cookie

After these periods we delete the data or irreversibly anonymise it.

9. Your rights

Under the GDPR you have the right to:

Access — get a copy of the personal data we hold about you;
Rectification — have inaccurate or incomplete data corrected;
Erasure — have data deleted where we no longer need it, where you withdraw consent, or where you successfully object. This does not extend to records we must keep by law, such as invoices;
Restriction — have us pause processing while a dispute about accuracy or our legitimate interests is resolved;
Data portability — receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible;
Object — object at any time to processing based on legitimate interests, and absolutely and at any time to direct marketing. If you object to direct marketing, we stop immediately, no questions asked;
Withdraw consent — at any time, without affecting processing already carried out;
Not be subject to automated decision-making — we do not carry out automated decision-making or profiling that produces legal effects for you or similarly significantly affects you.

How to exercise them. Email support@morningglorycoffee.shop. We reply within one month; if a request is complex we may extend this by two further months and will tell you why within the first month. Exercising your rights is free, unless a request is manifestly unfounded or excessive. We may ask you for information to confirm your identity.

Complaints. If you are unhappy with how we handle your data, please tell us first — we would like the chance to fix it. You also have the right to complain to the Dutch supervisory authority:

Autoriteit Persoonsgegevens Postbus 93374, 2509 AJ Den Haag autoriteitpersoonsgegevens.nl

If you live in another EU country, you may complain to your local supervisory authority instead.

10. Security

We take appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), restricted access on a need-to-know basis, hashed passwords, access controls on our back-in-stock database, and contractual security obligations on our processors.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, and we will notify the Autoriteit Persoonsgegevens within 72 hours where required.

11. Children

Our webshop is not aimed at children. In the Netherlands, children under 16 need parental consent for online services that rely on consent. We do not knowingly collect data from children under 16. If you believe a child has given us their data, contact us and we will delete it.

12. Cookies

We use cookies and similar technologies. Non-essential cookies — including analytics and advertising — are set only after you consent through our cookie banner, and you can change or withdraw your choice at any time.

Full details, including the categories we use and how to change your settings, are in our Cookie Policy.

13. Changes to this policy

We may update this policy. The current version is always on this page with the date it was last updated. If we make a material change — for example a new purpose or a new category of recipient — we will tell you by email or a prominent notice on the website before it takes effect.

14. Contact

For any privacy question or to exercise your rights: support@morningglorycoffee.shop

The controller's identity and address are in section 1 above; our other company details are on our Company Details page.