Privacy Policy

Controller: The controller of personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (the “GDPR”), is CoffeeMat s.r.o., Company ID 17944023, with its registered office at Zelenečská 312/37, 198 00 Prague, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, File 378587 (“we” or “us”).

Contact: You can contact us with questions and requests concerning personal data:

• by e‑mail at podpora@coffeemat.cz,
• by phone at +420 234 092 532,
• by letter to our registered office.

Data protection officer: We have not appointed a data protection officer.

Partner kiosks: Some kiosks are operated by our business partners (franchisees). Where the payment terminal of such a kiosk is registered to that partner, the partner also processes data on payments made on that terminal as an independent controller. We share with the partner the data needed to handle a complaint or query, to the extent necessary.

Categories of data: Depending on how you use our services, we process in particular:

• identification and contact data – first name and surname, e‑mail address, phone number,
• app account data – user identifier, sign-in method (e‑mail, Apple or Google), phone number verification, settings (e.g. language and currency) and records of your acceptance of the terms,
• purchase and payment data – kiosk, date and time, drink, price and currency, payment method, transaction identifier, payment status and any refund; for card payments only the data passed to us by the payment service provider (e.g. card type or masked card number), never the full card number,
• credit, subscription, voucher and reward data – balances, top-ups, usage, redeemed vouchers, names and dedications given on a gift voucher, loyalty programme status and referral code,
• communication data – content of forms, e‑mails, text messages and in-app reports, audio recordings, transcripts and details of calls to our customer line, and records of how complaints were handled,
• technical data – device type, operating system and app version, push notification token, IP address, browser data and access logs of our servers,
• location data – only if you allow the app to access your phone’s location, to show the distance and directions to kiosks,
• business contact data – name, work e‑mail and phone, organisation, relationship to the offered location and content of the inquiry,
• job applicant data – data from your e‑mail and attached CV.

Sources of data: We obtain data directly from you, or the data are generated when you use our services. We also obtain some data from:

• payment service providers – data on payments and refunds,
• Apple or Google – name, e‑mail and account identifier if you sign in with their account,
• the buyer of a gift voucher – the recipient’s name and the dedication the buyer puts on the voucher,
• your employer – data needed to add you to a company account, if you use one,
• operators of partner kiosks – data needed to handle a complaint,
• publicly available sources – work contacts of organisations to which we offer a kiosk location (e.g. organisations’ websites and public registers).

App and account: We create and manage your account, enable sign-in and verify your phone number so that we can provide the app’s services.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Purchases and payments: We process purchases at kiosks and in the app, payments, credit, subscriptions including recurring payments, vouchers and rewards, send payment confirmations and keep accounting records.

Legal basis: performance of a contract and compliance with legal obligations in accounting and tax (Art. 6(1)(c) GDPR).

Company accounts: If you take drinks on a company account, we process data on your purchases charged to the company allowance (date, kiosk, drink and price) and make them available to your employer, to the extent necessary, for managing allowances and billing.

Legal basis: our legitimate interest in performing the contract with your employer (Art. 6(1)(f) GDPR) and performance of the contract with you.

Customer support and complaints: We handle queries, reports, complaints and requests you send us through the website form, in the app, by e‑mail, text message or phone. To find a purchase, we compare your data with the records of the kiosk and of payment providers. The website form sends you a confirmation with a case number. Our team is notified of new cases by internal notifications.

Legal basis: performance of a contract, compliance with legal obligations in handling complaints and our legitimate interest in handling queries from people who have no contract with us.

Customer line: When you call +420 234 092 532, the phone menu lets you choose a voice assistant that uses artificial intelligence or a member of our staff. Calls with the assistant are recorded or transcribed. The assistant processes the audio of the call, creates a transcript and opens a case in our support system based on the content of the call. The audio recording and the transcript are kept by the assistant’s supplier (ElevenLabs) for no longer than 2 years; the transcript and call details form part of the case in our support system. We may send you a confirmation by text message to your phone number. If you do not want to talk to the assistant, choose a member of staff in the phone menu, write us an e‑mail or use the form on our website.

Legal basis: our legitimate interest in handling calls promptly and performance of a contract.

Service messages: We send you e‑mails, text messages and in-app notifications related to the services, such as payment confirmations, information about orders and subscriptions, the outcome of a complaint or changes to the terms.

Legal basis: performance of a contract and our legitimate interest.

News and marketing: We show news and offers in the app. If we send you, as our customer, marketing e‑mails about similar products, we do so on the basis of our legitimate interest under Section 7(3) of Czech Act No. 480/2004 Coll., on certain information society services. You can opt out at any time via the link in each message or by e‑mail to podpora@coffeemat.cz. We send push notifications only to devices on which you have allowed them, and you can turn them off at any time in your phone settings.

Legal basis: legitimate interest (direct marketing) or your consent (Art. 6(1)(a) GDPR).

Kiosk operation and abuse prevention: We keep records of kiosk operation, orders and payments, protect our systems against attacks and prevent abuse of the services, for example repeated unjustified refund requests or creating accounts to collect rewards. For this purpose we also keep a record of previous complaints and compensation provided.

Legal basis: our legitimate interest in safe operation and protection against fraud.

Business partners: We handle inquiries about kiosk locations, company services and franchising that you send us through the forms on our websites (including matchamat.cz and franchise.matchamat.cz) or by e‑mail, and we negotiate cooperation. We may contact organisations where a kiosk could be placed at work contacts from public sources; you can object to this at any time and we will stop contacting you.

Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in developing the kiosk network.

Job applicants: If you send us an application, we use your data to select employees or contractors.

Legal basis: steps taken at your request prior to entering into a contract; longer retention only with your consent.

Website: When you visit our website, our servers process technical data about the access to ensure operation and security. See Article XI for details.

Legal basis: our legitimate interest.

Legal obligations and claims: We also keep data to comply with obligations under the law (e.g. accounting and tax rules) and to establish, exercise or defend legal claims.

Legal basis: compliance with legal obligations and our legitimate interest.

Artificial intelligence tools: In customer support we use automated tools, including artificial intelligence tools. They help us sort messages, find purchases in kiosk and payment records and prepare replies. We pass on data from a case only to the extent needed to handle it.

Automated decisions: Some simple cases may be handled automatically according to fixed rules, for example a refund of the price of a drink that was not dispensed after the payment and kiosk records have been checked, or, conversely, the rejection of a request that does not meet the rules (e.g. a complaint about the taste of a drink made more than 24 hours after the purchase, when under Article XI(3) of the terms and conditions it can no longer be reliably assessed, or a repeated request for compensation). Decisions are based on data about the purchase, the payment, the kiosk status and previous complaints. Automated handling is necessary for prompt performance of the contract (Art. 22(2)(a) GDPR).

Human review: You have the right to have an automated decision reviewed by a member of our staff, to express your point of view and to contest the decision. A reply to the e‑mail with the outcome reopens your case and is first assessed by our automated support system. If you want a member of our staff to review the decision, say so in your reply or write to podpora@coffeemat.cz; we will pass such a request to a member of our staff for assessment.

Voice assistant: If you choose the assistant on our customer line, you are talking to a voice assistant powered by artificial intelligence, not to a person; you can choose a member of staff in the phone menu. The assistant does not decide on refunds; it passes the call on as a case to our support system.

Other decision-making: Apart from the cases described in this Article, we do not use automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.

Processors: For some activities we use suppliers who may handle the data only on our instructions:

• Hostinger – servers running our website, app and customer support system (data centres in the European Union),
• Google – e‑mail and office tools (Google Workspace) and delivery of app notifications (Firebase Cloud Messaging),
• Zadarma – telephone line and text messages,
• GoSMS – text messages sent by the app, such as verification codes,
• ElevenLabs – voice assistant on our customer line,
• Anthropic and OpenAI – artificial intelligence tools for customer support and for communication with business partners,
• kiosk technology suppliers – control software, payment terminals and cloud services for operating kiosks and processing orders,
• accountants, tax advisers and legal advisers.

Independent controllers: We also disclose data to recipients who process them as independent controllers under their own policies:

• payment service providers – Global Payments, ČSOB, GoPay and Qerko,
• Apple and Google – when you download the app and when you sign in with your Apple or Google account; Google also when you view a map in the Android app, which uses Google Maps,
• operators of partner kiosks – to the extent needed to handle a complaint about a purchase at their kiosk,
• your employer – for company accounts, to the extent set out in Article III(3),
• OpenStreetMap Foundation – when you view the map on our website (Article XI(4)) and the kiosk map in the app, which loads map tiles directly from tile.openstreetmap.org (the foundation thus receives your device’s IP address),
• the operator of the Telegram service – the content of internal alerts to our team (paragraph 4),
• public authorities, courts and other persons where the law requires us to do so.

Sale of data: We do not sell personal data and do not disclose it to third parties for their own marketing.

Internal alerts: We use messages in the Telegram service to alert our team to new cases and inquiries and to how they are being handled. A message may contain data needed for prompt handling, such as your name, contact details, a description of the problem and purchase details. The content of the messages is processed by the operator of the Telegram service, which is established outside the European Economic Area, under its own policy (https://telegram.org/privacy).

When transfers occur: Some suppliers (in particular Google, Anthropic, OpenAI, ElevenLabs and kiosk technology suppliers) may also process data outside the European Economic Area, for example in the USA or in Asia.

Safeguards: Transfers to these suppliers take place only under the conditions of Chapter V GDPR, i.e. on the basis of an adequacy decision of the European Commission (for recipients in the USA that participate in the EU–U.S. Data Privacy Framework) or on the basis of standard contractual clauses approved by the European Commission. We will provide information on the safeguards used on request.

Periods: We keep data only for as long as necessary for the purpose concerned and then delete or anonymise them. Specifically:

• app account – for as long as it exists; after the account is deleted we delete or anonymise the data, except for data that we must or need to keep under the following points,
• data on purchases, payments, credit, subscriptions and vouchers – 10 years from the end of the year in which the transaction took place (accounting and tax rules),
• complaints and communication with customer support, including call transcripts – 3 years after the case is closed,
• audio recordings of calls to our customer line and their transcripts held by the voice assistant supplier – 2 years after the call,
• records of complaints and compensation for abuse prevention – 3 years after the case is closed,
• marketing communications – until you object or withdraw your consent, for customers no longer than 3 years after the last purchase,
• notification token – until you sign out of the app or delete your account,
• business partner inquiries – for the duration of negotiations and then 3 years after the last contact, unless a contract is concluded,
• job applications – 6 months after the selection ends, with your consent no longer than 2 years,
• website access logs – usually no longer than 5 weeks.

Longer retention: We may keep data longer if necessary to establish, exercise or defend a legal claim (e.g. during a dispute), for the duration of that need.

Overview of rights: Under the conditions set out in the GDPR you have the right:

• of access to your personal data and to a copy of them (Art. 15 GDPR),
• to rectification of inaccurate data (Art. 16 GDPR),
• to erasure (Art. 17 GDPR),
• to restriction of processing (Art. 18 GDPR),
• to portability of the data you have provided to us (Art. 20 GDPR),
• to object to processing (Art. 21 GDPR),
• not to be subject to a decision based solely on automated processing without the possibility of human review (Art. 22 GDPR),
• to withdraw your consent at any time where processing is based on consent; withdrawal does not affect processing carried out before it.

Right to object: Where we process data on the basis of legitimate interest, you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time and without giving reasons; we will then no longer use the data for that purpose.

Exercising your rights: You can exercise your rights by e‑mail at podpora@coffeemat.cz, by phone or by letter (Article I). To avoid disclosing data to an unauthorised person, we may verify your identity, usually using the e‑mail or phone number registered in your account. We will reply without undue delay and within one month at the latest; in complex cases we may extend this period by a further two months and will let you know. Exercising your rights is free of charge.

Deleting your account: You can delete your app account yourself at any time in the app (Account → Delete account) or at https://coffeemat.org/delete-account. If you have unused credit in your account, ask for a refund before deleting the account (Article VI(6) of the Czech terms and conditions at https://www.coffeemat.cz/vop).

Supervisory authority: You have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, https://uoou.gov.cz. If your habitual residence is in Slovakia, you may also contact the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), https://dataprotection.gov.sk.

Data needed for a contract: The data needed to create an account, to make a purchase in the app and to handle a complaint (in particular your e‑mail or phone number) are necessary to conclude and perform the contract; without them we cannot provide the service concerned. You can buy a drink at a kiosk without giving any contact details.

Voluntary data: Other data, such as optional form fields or access to your phone’s location, are provided voluntarily.

Measures: We protect personal data with technical and organisational measures, in particular encrypted communication, password hashing, access control (only authorised persons have access to data, to the extent necessary), backups and regular software updates. However, no data transmission over the internet is completely secure.

Payment cards: Payment card data are processed by payment service providers in line with the PCI DSS security standard; we do not have the full card number. We will never ask you for your card number, CVV/CVC security code or PIN.

Cookies: The www.coffeemat.cz website does not use cookies or any analytics or advertising tools.

Local storage: If you pause the animations on our website, your browser saves this choice in local storage (localStorage) under the key cm-motion. This value stays in your browser only, is not sent to us and you can delete it in your browser settings.

Server logs: Our servers log technical data about access (IP address, time, page address and browser data). When you search in a form or submit it, we pass your IP address and browser data to our support system to protect it against abuse (e.g. limiting the number of searches and submissions); for a submitted form, the support system stores them with the case.

Map: The kiosk map on our website uses OpenStreetMap map tiles, which your browser loads directly from the servers of the OpenStreetMap Foundation (tile.openstreetmap.org) when the map is displayed. The foundation thus receives your IP address and browser data and processes them under its own policy (https://osmfoundation.org/wiki/Privacy_Policy). The list of kiosks is loaded by your browser from our server coffeemat.org; the 3D kiosk model is loaded from our server franchise.matchamat.cz only when you open it.

Forms: While you fill them in, the form for reporting a problem with a purchase and the feedback form load the list of kiosks from our support system and send it the text you type in the drink name field so that they can offer you matching drinks. The problem report form also sends our support system the selected kiosk and the time of purchase so that it can offer you matching purchases. All other data, in particular your name, contact details and message, are sent only when you click the submit button.

Links: Links to other websites (e.g. Google Maps, the App Store, Google Play or social networks) lead to services of other operators; once you follow a link, their policies apply.

Voucher shop: The gift voucher shop at https://voucher.coffeemat.cz uses cookies that are necessary to submit an order securely and the gv_lang cookie, which remembers your chosen language for one year. It preselects the language and currency based on the country derived from your IP address.

Updates: We may change this policy, for example when our services, suppliers or the law change. The current version is always published at https://www.coffeemat.cz/gdpr. We will inform you of material changes by e‑mail or in the app.

Language versions: This English version is a translation; in case of any discrepancy, the Czech version prevails.

Effective date: This policy is effective from 16 November 2026 and replaces all previous versions of the CoffeeMat personal data protection rules and policies.