Privacy Policy

Puca Italian Essence Ltd, trading as Puca Coffee

Last updated: Aug 2026

Puca Coffee is committed to protecting your privacy and handling your personal information fairly, transparently and securely.

This Privacy Policy explains what personal data we collect, how we use it, the service providers that may process it, and the rights available to you under the General Data Protection Regulation (GDPR) and Irish data protection law.

1. Who We Are

This website and the Puca Coffee business are operated by:

Puca Italian Essence Ltd
trading as Puca Coffee
2 Kellystown Road
Ticknock
Sandyford
D18 X0H9
Dublin
Ireland

VAT Number: IE4416111PH

Email: [email protected]

Website: www.pucacoffee.ie

For the business processing described in this Privacy Policy, Puca Italian Essence Ltd, trading as Puca Coffee, is the Data Controller. This means that we decide why and how personal data is used in connection with our business.

2. What Personal Data We Collect

The information we collect depends on how you interact with Puca Coffee.

2.1 Orders and Customer Accounts

When you place an order, create an account or purchase from us, we may collect:

  • Your name
  • Billing and delivery addresses
  • Email address
  • Telephone number
  • Customer account details
  • Order number and order history
  • Products purchased
  • Delivery information
  • Discounts or promotional codes used
  • Order notes and communications
  • Cancellation, return, refund and replacement information
  • Payment status and payment references
  • Tax, invoice and transaction information

We do not receive or store your full credit or debit card number.

2.2 Online Withdrawal, Returns and Refund Requests

When you use our online withdrawal, return or refund processes, we may collect:

  • Your name
  • Email address
  • Order number
  • Products and quantities concerned
  • The date and time of your request
  • The reason for a return or refund, where provided
  • Photographs, videos or supporting files you choose to send
  • Any optional message you provide
  • The status and outcome of the request
  • Related communications, payment and refund records

We use this information to verify the order, acknowledge your request, manage the return or refund, communicate the next steps, prevent duplicate or fraudulent requests and maintain appropriate legal and customer-service records.

Withdrawal and return information is not used for unrelated marketing unless you have separately consented to marketing.

2.3 Contact Forms, Email and Customer Support

When you contact us through a website form, email, telephone or another support channel, we may collect:

  • Your name
  • Email address
  • Telephone number, where provided
  • Order number or order information
  • Product or coffee-machine details
  • Machine model and serial number
  • Warranty and purchase information
  • Photographs, videos or other files you choose to provide
  • The contents of your enquiry and our response
  • Internal support notes reasonably necessary to manage your enquiry

Please avoid sending sensitive personal information that is not necessary for us to deal with your enquiry.

2.4 Customer Relationship Management

Customer and business-contact information may be stored in our customer relationship management systems, including Jetpack CRM, for purposes such as:

  • Order and customer history
  • Customer support
  • Product and machine enquiries
  • Warranty support
  • Business and wholesale enquiries
  • Follow-up communications
  • Managing ongoing customer relationships
  • Maintaining appropriate records of communications and outcomes

2.5 Subscriptions

Where you create or manage a product subscription, including through WP Swings subscription services, we may process:

  • Your identity and contact details
  • Subscription number
  • Products included in the subscription
  • Subscription status
  • Renewal dates
  • Payment and renewal status
  • Pauses, cancellations and reactivations
  • Related order and customer-support history

2.6 Marketing Preferences and Consent Evidence

Where you subscribe to marketing communications or make a marketing choice, we may process:

  • Your name and email address
  • Your subscription or opt-out status
  • The date, time and source of the consent
  • The form, page or process used
  • Technical evidence recorded with the consent, where available
  • Newsletter delivery, opening and click information
  • Unsubscribe and suppression records

Marketing-consent evidence may be held in WordPress, WooCommerce, Brevo or related systems.

You can unsubscribe from marketing at any time by using the unsubscribe link in an email or by contacting us.

2.7 Live Chat

If you use live chat on our website, including 3CX live chat, we may collect:

  • Your name, if provided
  • Your email address, if provided
  • Your chat messages
  • Information about your enquiry
  • Technical information about your browser or device

Chat conversations may be retained where reasonably necessary for customer support, security and service-quality purposes.

2.8 Payment Information

Online payments are generally processed through Stripe as part of the WooCommerce checkout process.

Square is used for in-person terminal and market payments.

Depending on the transaction, we may receive:

  • Payment amount and currency
  • Payment status
  • Transaction and payment reference numbers
  • Refund status
  • Payment date and time
  • Limited payment-method information made available by the provider, such as card type or final digits
  • Customer identity or contact information associated with the transaction

We do not receive or store full card numbers, card security codes or complete payment credentials.

Stripe and Square process payment information under their own terms and privacy responsibilities.

2.9 Website, Cookie and Analytics Information

When you visit our website, we or our service providers may collect:

  • IP address
  • Browser type
  • Device information
  • Operating system
  • Approximate location derived from technical information
  • Pages viewed
  • Website events and interactions
  • Referring website or marketing source
  • Search and campaign information
  • Purchases and conversions
  • Cookie and similar technology identifiers

Optional analytics and advertising technologies are used only where permitted by applicable law and your cookie choices.

Further information is available in our Cookie Policy and Cookie Preferences tool.

3. How We Use Personal Data

We may use personal data for the following purposes:

  • Processing and delivering orders
  • Managing payments and confirming payment status
  • Managing subscriptions
  • Handling cancellations, withdrawal requests, returns and refunds
  • Providing customer service and technical support
  • Handling faults, repairs and warranty matters
  • Responding to enquiries
  • Sending order, delivery and service communications
  • Maintaining customer and CRM records
  • Maintaining accounting, tax, stock, cost-of-goods and warranty records
  • Reconciling orders, payments, refunds, stock and business records
  • Confirming and recording marketing preferences
  • Analysing website, advertising, product and sales performance
  • Detecting missing, duplicated or inconsistent records
  • Investigating errors, disputes, chargebacks, fraud or security issues
  • Preparing internal reports, summaries and suggested corrections
  • Improving our website, products, customer service and business operations
  • Establishing, exercising or defending legal claims
  • Complying with consumer-protection, tax, accounting, product-safety, traceability and data-protection obligations
  • Sending marketing communications where you have consented
  • Operating and securing our website, connected systems and business services

We use personal data only for purposes that are compatible with the reason it was collected, unless another lawful basis permits or requires its use.

4. Legal Bases for Processing

We rely on one or more of the following legal bases, depending on the activity.

4.1 Contract

We process personal data where necessary to enter into or perform a contract with you, including:

  • Processing and delivering orders
  • Managing payments
  • Managing product subscriptions
  • Sending order and delivery communications
  • Handling cancellations, withdrawals, returns and refunds
  • Providing customer support relating to a purchase
  • Handling faults, repairs and warranty matters

4.2 Legal Obligations

We process personal data where necessary to comply with legal obligations, including:

  • Tax and accounting requirements
  • Consumer-protection obligations
  • Product-safety and traceability requirements
  • Warranty and conformity obligations
  • Responding to lawful requests from courts, regulators or public authorities
  • Complying with data-protection and other applicable laws

4.3 Legitimate Interests

We may process personal data where necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

These interests may include:

  • Providing efficient and consistent customer service
  • Maintaining accurate order, payment, refund, stock, warranty and business records
  • Reconciling information held across business systems
  • Detecting missing, duplicated or inconsistent records
  • Preventing fraud, misuse and security incidents
  • Protecting our website, systems, customers and business
  • Preparing internal reports and draft communications
  • Improving our products, services and website
  • Analysing sales and business performance
  • Using secure technology, cloud and productivity services
  • Establishing, exercising or defending legal claims

Where we rely on legitimate interests, we consider whether the processing is necessary, proportionate and reasonably expected in the circumstances.

4.4 Consent

We rely on consent where required, including for:

  • Sending newsletters and promotional communications
  • Using optional analytics, advertising or marketing cookies
  • Any other activity where consent is the appropriate legal basis

You may withdraw your consent at any time. Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

5. AI-Assisted Processing and the Puca Coffee Control Bridge

5.1 What the Control Bridge Is

Puca Coffee uses a private, controlled technology service called the Puca Coffee Control Bridge.

The bridge allows authorised use of ChatGPT to retrieve selected information from approved Puca Coffee systems when that information is relevant to a specific internal business task.

The bridge is not a separate business or Data Controller. It is a technical tool operated for Puca Coffee.

Depending on the task, the connected systems may include:

  • WooCommerce orders, products, customers and refunds
  • WordPress customer profiles
  • Jetpack CRM
  • WP Swings subscription records
  • WordPress and Brevo marketing-consent evidence
  • Stripe payment and refund information
  • Square in-person payment and refund information
  • Google Sheets business records
  • The Puca Coffee Daybook
  • The Stock Register
  • The Sales_COGS_Log
  • The Machine_Warranty_Register
  • Google Analytics 4
  • Google Search Console
  • Google Ads
  • Google Merchant Center

The private bridge is hosted using Google Cloud services and is made available through authenticated and restricted access.

5.2 What Read-Only Access Means

The Control Bridge is designed to be read-only.

This means it may retrieve, display, transmit, filter, compare, summarise and analyse selected information, but it cannot directly change the underlying business records in the connected systems.

Reading, retrieving, consulting, comparing and analysing personal data are still forms of personal-data processing under GDPR. Read-only access does not mean that no personal data is processed.

The read-only restriction means that the bridge cannot directly create, edit, delete or post information in the connected Puca Coffee systems.

5.3 Personal Data That May Be Involved

Depending on the task, information accessed through the bridge may include:

  • Customer names and contact details
  • Customer and WordPress account identifiers
  • Order numbers and order history
  • Products purchased
  • Delivery and billing information
  • Refund, cancellation and return information
  • Subscription status and renewal information
  • Payment status, amounts and transaction references
  • Customer-support communications and CRM information
  • Machine model, serial number and warranty information
  • Marketing subscription and consent evidence
  • Internal accounting references linked to an order or transaction
  • Stock, cost-of-goods and warranty records linked to an order
  • Website, advertising and conversion information
  • Device, campaign, traffic-source and technical analytics information
  • Records of discrepancies, missing entries or reconciliation results

Full payment-card credentials are not made available to the bridge.

We do not intentionally use the bridge to process special-category or highly sensitive personal data.

5.4 Purposes of AI-Assisted Processing

The bridge and ChatGPT may be used for internal activities such as:

  • Reconciling orders, payments and refunds
  • Researching customer-support enquiries
  • Preparing draft customer-support communications
  • Reviewing subscriptions and CRM records
  • Checking stock, cost-of-goods and warranty information
  • Reviewing website, sales and advertising performance
  • Comparing information held in different systems
  • Detecting missing, duplicated or inconsistent records
  • Preparing summaries, reports and suggested corrections
  • Investigating operational errors
  • Supporting human decision-making and record review

AI-assisted processing is not used for unrelated purposes.

5.5 Data Minimisation

We aim to limit information accessed through the bridge to what is reasonably necessary for the particular task.

Our approach includes:

  • Using aggregated information where individual customer details are not needed
  • Using filtered or date-limited searches
  • Retrieving direct customer details only where needed for a specific order, support, subscription, refund, warranty or reconciliation matter
  • Avoiding unnecessary special-category or sensitive information
  • Limiting access to approved systems and approved tools
  • Avoiding the inclusion of passwords, API keys, access tokens and other confidential credentials in ChatGPT conversations
  • Reviewing outputs before they are used

The bridge does not provide unrestricted access to all Puca Coffee data.

5.6 Human Review and Control

ChatGPT may identify possible discrepancies, prepare summaries, suggest corrections or prepare draft wording.

These outputs are treated as working assistance and are reviewed by an authorised person before any action is taken.

The Control Bridge and ChatGPT do not automatically:

  • Send customer emails or marketing communications
  • Issue refunds
  • Capture or charge payments
  • Cancel, change, fulfil or create customer orders
  • Change customer subscriptions
  • Change customer or CRM records
  • Change marketing-consent records
  • Change product or stock records
  • Change cost-of-goods records
  • Change warranty records
  • Post accounting or Daybook entries
  • Submit tax, regulatory or compliance returns
  • Make binding decisions affecting a customer

Any such action must be separately reviewed and carried out by an authorised person using the appropriate source system.

5.7 Official Business Records

ChatGPT conversations, reports and suggestions are not treated as the official accounting, stock, cost-of-goods or warranty record.

The relevant Puca Coffee Google Sheets records remain the official working records for these purposes, including:

  • Puca Coffee Daybook
  • Stock Register
  • Sales_COGS_Log
  • Machine_Warranty_Register

A suggested correction produced through ChatGPT does not change an official record. Any approved correction must be entered separately by an authorised person.

5.8 OpenAI and Model Training

Puca Coffee uses ChatGPT services provided by OpenAI.

At account level, the “Improve the model for everyone” setting is kept switched off.

Under OpenAI’s current data-control information, conversations may remain visible in the authorised ChatGPT account history, but conversations are not used to train or improve ChatGPT while this setting is switched off.

This setting is an important data-governance safeguard, but it does not mean that no processing takes place.

Information provided to ChatGPT is still processed as necessary to:

  • Provide and operate the service
  • Generate responses
  • Maintain the account and conversation history
  • Protect the security and integrity of the service
  • Prevent fraud, misuse or abuse
  • Provide technical support
  • Comply with legal obligations

OpenAI’s own terms, privacy policy and retention practices also apply to its processing.

5.9 AI-Assisted Content and Product Visuals

Puca Coffee may use artificial intelligence tools to assist with image editing, product visualisation, design, written content and marketing materials. Content produced with AI assistance is subject to human review before publication.

AI may be used for standard photographic editing, including background removal, lighting correction, sharpening, resizing, removal of minor imperfections and the creation of clearly promotional or artistic visual settings. Where these changes do not materially alter the product or misrepresent its characteristics, they may not be separately labelled.

Where an image, audio recording or video has been artificially generated or materially altered using AI and could reasonably be mistaken for authentic or factual content, Puca Coffee will provide an appropriate disclosure with or close to the relevant content, where required by applicable law.

AI-assisted product visuals are intended to represent the relevant product accurately. Customers should also refer to the product description, specifications, available colours and other information provided on the relevant product page.

6. Email Communications

Emails sent to or from Puca Coffee may be processed through our website, email-delivery services, Google email services, WordPress services and hosting or email-routing providers.

We may use email to:

  • Respond to enquiries
  • Send order, payment and delivery information
  • Acknowledge withdrawal, return and warranty requests
  • Provide customer support and troubleshooting
  • Communicate about refunds, repairs or replacements
  • Manage subscriptions
  • Maintain appropriate customer-service, business and legal records

Technology and AI services may help research an enquiry or prepare a draft response.

A draft prepared with AI assistance is reviewed by an authorised person. The Control Bridge does not automatically send the email.

7. Data Sharing and Service Providers

We may share or make personal data available to trusted service providers where reasonably necessary to operate our business, fulfil orders, provide customer support, process payments, maintain records, analyse performance, comply with legal obligations or protect our legitimate interests.

Relevant providers may include:

  • OpenAI Ireland Limited and related OpenAI service providers, for ChatGPT
  • Google Cloud Platform, used to host and secure the private Control Bridge
  • Google Workspace and Google Sheets
  • Google Analytics
  • Google Search Console
  • Google Ads
  • Google Merchant Center
  • WordPress and WooCommerce service providers
  • Jetpack CRM
  • WP Swings subscription services
  • Stripe
  • Square
  • Brevo
  • 3CX
  • Website hosting, security, backup and technical-support providers
  • Email-delivery and communication providers
  • Courier, postal and delivery companies
  • Accountants, legal advisers, insurers and other professional advisers
  • Government bodies, courts, regulators or law-enforcement authorities where required or permitted by law

We share only the information reasonably necessary for the relevant purpose.

We do not sell or rent personal data.

We do not provide customer personal data to advertisers for their own independent marketing purposes unless you have separately consented or the disclosure is otherwise permitted by law.

Controller and Processor Roles

Puca Italian Essence Ltd, trading as Puca Coffee, is the Data Controller for the Puca Coffee business purposes described in this policy.

Some providers process personal data on our behalf and under our instructions. These providers may act as Data Processors.

Other providers may act as independent Data Controllers for some activities under their own legal responsibilities and privacy policies. This may apply, for example, to payment providers, advertising platforms and OpenAI in relation to its own account management, service provision, security, fraud prevention, legal compliance and service operations.

A provider may act as a processor for one activity and as a separate controller for another activity.

Where a provider acts as our processor, we seek to use appropriate contractual, confidentiality, security and data-protection arrangements.

8. International Data Transfers

Some providers may process or store personal data outside Ireland or outside the European Economic Area.

This may include providers of:

  • Payment services
  • Website hosting
  • Cloud infrastructure
  • Email and customer communications
  • Customer-support systems
  • Analytics and advertising services
  • Productivity and AI services

Where personal data is transferred outside the European Economic Area, we seek to ensure that a lawful transfer mechanism and appropriate safeguards are used.

Depending on the provider and destination, these may include:

  • A European Commission adequacy decision
  • European Commission-approved Standard Contractual Clauses
  • Supplementary technical and organisational measures
  • Another transfer mechanism permitted by applicable data-protection law

Some information processed through OpenAI or its trusted service providers may be processed in the United States or other countries. OpenAI states that it uses recognised transfer mechanisms, including adequacy decisions and Standard Contractual Clauses, where applicable.

You may contact us at [email protected] for further information about transfers relevant to your personal data.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, accounting, customer-service, security and dispute-resolution requirements.

Typical retention criteria include:

  • Order, sales, payment, invoice and accounting records are normally retained for six years from the end of the relevant accounting period, or longer where required by law, an investigation or an unresolved matter.
  • Withdrawal, return and refund records are generally retained with the related order and accounting records.
  • Customer-support and general enquiry records are normally retained for up to 24 months after the matter is closed, unless a longer period is needed for an order, warranty, dispute or legal claim.
  • Warranty records may be retained for the warranty period and for an additional period where reasonably necessary to handle claims, legal obligations or disputes.
  • CRM information is retained while there is an active customer or business relationship and afterwards where reasonably necessary for support, record-keeping, legal claims or compliance.
  • Marketing information is retained until you unsubscribe or withdraw consent. A limited suppression record may be retained afterwards to ensure that your opt-out continues to be respected.
  • Consent evidence may be retained for as long as reasonably necessary to demonstrate that consent was obtained and managed correctly.
  • Website and analytics information is retained according to our cookie settings, provider settings and legitimate business requirements.
  • Live-chat records are retained for as long as reasonably necessary for customer support, service quality, security or dispute resolution.
  • AI-assisted working conversations may remain in the authorised ChatGPT account history until they are manually deleted. Puca Coffee retains them only where reasonably necessary for the relevant business purpose, continuity, support, security, audit, dispute, legal or compliance requirements.
  • Where information from an AI-assisted conversation becomes part of an order, accounting, support, warranty or legal record, the retention period for that record applies.

We may retain information for longer where required by law, where a claim or dispute is ongoing, or where necessary to prevent fraud or protect our legal rights.

10. Human Review and Automated Decision-Making

Puca Coffee does not use the Control Bridge or ChatGPT to make decisions based solely on automated processing that produce legal effects or similarly significant effects for customers.

AI-generated summaries, discrepancy alerts, reports, draft communications and suggested corrections are reviewed by a person.

A person remains responsible for deciding whether any customer communication, refund, payment, order change, subscription change, record correction, accounting entry or compliance action should take place.

Website analytics and advertising services may generate statistics, audience information or performance reports. These reports do not authorise the Control Bridge to make binding customer decisions.

11. Security

We use reasonable technical and organisational measures to protect personal data.

These measures may include:

  • Secure HTTPS and encrypted connections
  • Secure website and cloud hosting
  • Authentication and access controls
  • Restricted access to authorised accounts and personnel
  • Approved, read-only bridge tools
  • Limited access scopes
  • Separation of credentials and business information
  • Password-protected systems
  • Secure payment providers
  • Data minimisation
  • Human review of AI-assisted outputs
  • Account-level OpenAI model-training controls
  • Security monitoring, backups and technical safeguards provided by our service providers

The Control Bridge does not expose unrestricted terminal access or arbitrary access to Puca Coffee systems.

Credentials, passwords, API keys, access tokens and similar secrets are not intended to be included in customer-facing records, ChatGPT prompts or generated reports.

No internet, cloud or email system can be guaranteed to be completely secure. We take reasonable precautions and review our controls as our systems and business operations develop.

12. Your Rights Under GDPR

Subject to applicable law, you may have the right to:

  • Request access to your personal data
  • Request correction of inaccurate or incomplete information
  • Request deletion of personal data
  • Request restriction of processing
  • Object to processing based on legitimate interests
  • Withdraw consent at any time
  • Request data portability
  • Obtain information about how your data is processed
  • Lodge a complaint with the Irish Data Protection Commission

These rights are not absolute and may be subject to legal exceptions.

We may need to verify your identity before responding to a request.

Requests may be sent to:

[email protected]

You also have the right to lodge a complaint with the Irish Data Protection Commission if you believe that your personal data has not been handled correctly.

13. Children

Our products and services are not directed towards children under the age of 16.

We do not knowingly collect personal data from children through our website. If you believe that a child has provided personal information to us, please contact us so that we can investigate and take appropriate action.

14. Changes to This Privacy Policy

We may update this Privacy Policy when our business activities, technology, service providers or legal obligations change.

The updated version will be published on this page with a revised Last Updated date.

Where a change materially affects how we use personal data, we will provide additional notice where required by law.

For questions about this Privacy Policy or how Puca Coffee handles personal data, please contact:

Puca Italian Essence Ltd, trading as Puca Coffee
2 Kellystown Road
Ticknock
Sandyford
D18 X0H9
Dublin
Ireland

Email: [email protected]