GDPR & Privacy Policy

1. Data Controller

Cup Source is the data controller responsible for your personal data. If you have any questions about this policy or our data practices, please contact us:

• Company: Cup Source
• Address: 123 Wholesale Way, Cup City, CC 10101
• Email: privacy@cupsourse.com
• Phone: +1 (555) 123-4567

2. Personal Data We Collect

We only collect data that is necessary for the purposes outlined in this policy. The types of data we may collect include:

Personal Information

• Name, title, and job role
• Email address and telephone number
• Shipping and billing addresses
• Company name and tax/VAT number
• Payment information (processed securely by third-party providers)

Technical & Usage Data

• IP address, browser type, and device information
• Pages visited, time spent, and click patterns
• Referring URLs and download history

3. Purposes & Legal Basis

We process your personal data for the following reasons, based on the corresponding legal grounds:

• Fulfilling Orders: To process your purchase, arrange delivery, and manage invoices.
  Legal Basis: Performance of a Contract.
• Customer Support: To respond to inquiries and resolve issues.
  Legal Basis: Legitimate Interest & Contract.
• Marketing: To send newsletters and promotional offers (only with your consent).
  Legal Basis: Consent.
• Analytics: To improve our website and understand user behavior.
  Legal Basis: Legitimate Interest.
• Legal Compliance: To meet tax, accounting, and regulatory requirements.
  Legal Basis: Legal Obligation.

4. Sharing Your Data

We do not sell your personal data. We may share your information only with trusted third-party service providers who assist us in operating our business, under strict data processing agreements:

• Logistics Partners: For shipping and delivery (e.g., courier services).
• Payment Processors: For secure transaction handling (e.g., Stripe, PayPal).
• Cloud Providers: For hosting and data storage security.
• Legal Authorities: If required by law or to protect our rights.

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with legal obligations:

• Order Data: Retained for 7 years for tax and accounting purposes.
• Marketing Data: Retained until you withdraw consent.
• Support Data: Retained for 2 years after the last interaction.

6. Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of your data.
• Right to Rectification: Correct inaccurate data.
• Right to Erasure: Request deletion of your data ("Right to be Forgotten").
• Right to Restrict Processing: Limit how we use your data.
• Right to Data Portability: Receive your data in a structured format.
• Right to Object: Object to processing based on legitimate interest or direct marketing.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at privacy@cupsourse.com. We will respond within 30 days.

7. Cookies

Our website uses cookies to enhance user experience, analyze traffic, and personalize content. You can manage your cookie preferences through your browser settings or via the cookie consent banner displayed on our site. Essential cookies are always active as they are required for the site to function.

8. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting a notice on our website or via email. The "Last Updated" date at the top of this page indicates when changes were made.