Last updated: 1 November 2026
This policy explains how NOA Coffee, Nuts and More Ltd collects and uses personal data when you visit the-noa.com, send us a gift request or contact us. We process personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data (Law 125(I)/2018) and, for cookies, the Cyprus Law on the Regulation of Electronic Communications and Postal Services (Law 112(I)/2004).
1. Who we are
The data controller is:
NOA Coffee, Nuts and More Ltd
26A Lordou Vironos Street, 1046 Pallouriotissa, Nicosia, Cyprus
Email: shop@the-noa.com · Tel.: +357 22 777727
For any question about this policy or your personal data, please contact us at the details above.
2. What personal data we collect
2.1 When you send a gift request
Through the gift request form we collect: your full name, phone number and email address; your budget range, number of gifts, the date you need them, pickup or delivery and the delivery area; your preferred way of contact; the occasions or product categories you selected; your message; and your confirmation tick. We also record the language of the page and the date and time of your request.
2.2 Allergies and dietary needs
If you choose to tell us about allergies or dietary needs, this is health-related data. We use it only to prepare a suitable gift and only with your explicit consent, which you give by ticking the consent box when you send the form. You can withdraw this consent at any time.
2.3 When you contact us directly
If you call, email or message us (for example on WhatsApp, Instagram, Facebook or TikTok), we receive the details you share with us, such as your name, number and the content of your message.
2.4 Technical data
When you visit the website, your IP address, browser and device information and the pages you request are processed by our hosting provider, our website security tool and our spam protection (Google reCAPTCHA), so that the website can be delivered and protected.
2.5 Cookies
See section 8.
We do not sell personal data and we do not use it for automated decision-making.
3. Why we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| To answer your gift request, prepare an offer, confirm and prepare your order, and arrange pickup or delivery | Steps taken at your request before entering into a contract, and performance of a contract (Art. 6(1)(b) GDPR) |
| To take into account allergies or dietary needs you tell us about | Your explicit consent (Art. 9(2)(a) GDPR) |
| To keep accounting and tax records for orders | Compliance with our legal obligations (Art. 6(1)(c) GDPR) |
| To keep the website secure and protect our forms from spam and abuse | Our legitimate interest in operating a safe website (Art. 6(1)(f) GDPR) |
| To measure the results of our advertising with the Meta Pixel | Your consent (Art. 6(1)(a) GDPR and Law 112(I)/2004) |
| To show the embedded Google Map | Your consent (Art. 6(1)(a) GDPR and Law 112(I)/2004) |
| To establish, exercise or defend legal claims | Our legitimate interest (Art. 6(1)(f) GDPR) |
We do not send marketing newsletters. If we ever wish to, we will ask for your separate consent first.
4. Who receives your data
- Our staff who handle gift requests and orders.
- Service providers who process data on our behalf: our website hosting provider and our email provider.
- Google Ireland Limited, for spam protection (reCAPTCHA), website fonts (Google Fonts) and, if you allow it, the embedded map (Google Maps).
- Meta Platforms Ireland Limited, for the Meta Pixel, only if you accept cookies.
- Delivery partners, if you choose delivery (name, phone number and delivery address only).
- Our accountants and auditors, and public authorities where the law requires it.
5. Transfers outside the European Economic Area
Google and Meta may transfer data to the United States. Such transfers are based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (for certified companies) and/or the European Commission’s Standard Contractual Clauses.
6. How long we keep your data
- Gift requests that do not lead to an order: up to 24 months from our last contact, then deleted.
- Orders and invoices: 6 years after the end of the year to which they relate, as required by the Companies Law, Cap. 113 and the Assessment and Collection of Taxes Law, or longer if needed for an audit or legal dispute.
- Allergy or dietary information: deleted once your order is completed, or earlier if you ask us.
- Your cookie choice: 6 months, stored in your browser.
- Website security logs: for a short period, normally no longer than 30 days.
7. Your rights
You have the right to: access your personal data; have it corrected; have it erased; restrict its processing; receive it in a portable format; object to processing based on our legitimate interests; and withdraw your consent at any time, without affecting processing carried out before withdrawal. To exercise any of these rights, email us at shop@the-noa.com. We will reply within one month (this may be extended by two further months for complex requests, in which case we will let you know). We may ask you to confirm your identity.
You also have the right to lodge a complaint with the supervisory authority:
Commissioner for Personal Data Protection
15 Kypranoros Street, 1061 Nicosia, Cyprus · P.O. Box 23378, 1682 Nicosia
Tel.: +357 22 818456 · Email: commissioner@dataprotection.gov.cy · www.dataprotection.gov.cy
8. Cookies
Cookies are small files stored on your device. We use strictly necessary cookies, which do not require consent, and optional cookies, which are only set if you click “Accept” in our cookie banner. Rejecting is as easy as accepting, and you can change your choice at any time.
Strictly necessary
| Cookie / storage | Provider | Purpose | Duration |
|---|---|---|---|
| noa_consent_v1 | NOA (this website) | Remembers your cookie choice | 6 months |
| pll_language | NOA (this website) | Remembers the language you chose | Up to 1 year |
| _GRECAPTCHA | Protects our forms from spam and automated abuse (reCAPTCHA) | Up to 6 months |
Optional – only with your consent
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _fbp, fr | Meta | Meta Pixel: measures visits and gift requests that come from our ads on Facebook and Instagram, and helps show our ads to relevant people | Up to 3 months |
| NID and other Google cookies | Loading the embedded Google Map in the footer | Up to 6 months |
Our pages also load fonts from Google Fonts. To display them, your browser connects to Google’s servers, which receive your IP address.
You can also delete or block cookies in your browser settings. Blocking strictly necessary cookies may affect how the website works.
9. Children
Our website is not directed at children. Under Cyprus Law 125(I)/2018, a child must be at least 14 years old to give consent to online services; if you are under 14, please ask a parent or guardian to contact us on your behalf.
10. Security
We protect personal data with appropriate technical and organisational measures, including an encrypted (HTTPS) connection, restricted access to our systems and continuous security monitoring of the website.
11. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows when it was last changed. Significant changes will be highlighted on the website.