Privacy Notice

Publication date

2026-10-09

Effective date

2026-10-09

Version 2.11-PUSH-EN.
Publication and effective date: 9 October 2026.

1. Controllers and contact details

The controller of personal data is:

KICO GLOBAL EOOD
UIC 208250164 · VAT BG208250164
Republic of Bulgaria, Varna, Odessos District, 1 Bacho Kiro Blvd., Floor 8, Office VIII-3

Personal data questions and requests: privacy@owncup.eu.

In this Notice, “GDPR” means Regulation (EU) 2016/679 (General Data Protection Regulation).

For the limited processing activities relating to a particular café's programme, and for forming and conducting a push campaign initiated by that café, OwnCup and the relevant café are joint controllers. The café's name and contact details are available in its profile; the essence of the allocation of responsibilities is set out in section 9. For the subsequent operation of generating and sending an automatic Programme reminder under uniform platform rules, OwnCup acts as an independent controller. OwnCup remains the primary technical contact point, but the user is entitled to contact either party to the joint operation.

OwnCup has not appointed a data protection officer because, as at the date of this version, the obligation to make such an appointment has not been established. This does not restrict the right to contact the controller directly.

2. Scope

This Notice applies to the processing of data within the single OwnCup service across three distinct technical surfaces:

1. the OwnCup marketing website on which this Notice is published;
2. the app.owncup.eu web application;
3. the native OwnCup applications for iOS and Android.

It also applies to representatives and staff of participating cafés, persons who submit an enquiry or support request, and persons who report allegedly illegal content.

Cookies, browser storage and external web technologies used by the marketing website and app.owncup.eu are additionally and separately described in the Cookie, Local Storage and Web Technologies Policy. The native applications do not use browser cookies; their permissions, local storage and notification delivery services are described below.

3. What data are processed

3.1. Marketing website

Depending on the visitor’s actions, the following data are processed:

• the content and contact details that the visitor enters in a contact or enquiry form;
• the language and the page from which the enquiry was submitted;
• the IP address and limited technical request information needed to deliver the page, protect the form and prevent abuse;
• the browser record of the cookie choice: selected categories, interface and document version, language, storage and expiry dates, source of the choice and a random record identifier;
• following separate consent to analytics: online identifiers, browser and device information, pages visited and Google Analytics 4 interaction events.

The marketing website does not send a name, email address or OwnCup’s own Account identifier to Google Analytics. If analytics is technically disabled in a particular build, the user’s choice is stored, but analytics data are not collected and GA4 requests are not sent.

3.2. The app.owncup.eu web application

Depending on how the service is used, the following data are processed:

• the required email address, optional name or display name, internal identifier, verification status and Account status;
• Firebase Authentication tokens and the technical state of the session;
• IP address, language, browser type and version, operating system, and login, security and error events;
• confirmed scans, participating location, time, cups or stamps, rewards and redemptions;
• the displayed or generated name shown to authorised staff of the relevant café together with transactions in that café’s programme;
• a record of acceptance of the terms; where management of marketing categories is actually available in the web application, selection of a category also produces a record of the separate confirmation of legal entitlement to give consent;
• a technical Google Maps request, including IP address and browser information, only after the user opens the map or requests the nearby venues feature;
• precise location only after separate system permission is granted and the feature for which it is required is used.

The Flutter CanvasKit components needed to render the web interface are hosted on an OwnCup resource and do not require CanvasKit to be loaded from Google’s infrastructure.

3.3. Native iOS and Android applications

Depending on the platform and features selected, the following data are processed:

• the Account data and loyalty events listed in subsection 3.2;
• application and operating-system version, language, device model or class, and login, security and error events;
• push identifiers: an FCM registration token or APNs device token, and a Firebase Installation ID if it is actually created or transmitted by the configuration in use; platform, language and minimal technical metadata;
• the selection of each marketing-push category, withdrawal and suppression state; date and time, language, text version and technical source of the selection;
• confirmation of legal entitlement to give consent independently, displayed after a marketing category is selected;
• a send log: campaign identifier, pseudonymous Recipient reference, time, acceptance by the delivery service or technical error;
• the state of the local secure session and settings selected by the user;
• camera or location data only after system permission has been granted and the scanning, map or nearby venues feature is invoked.

OwnCup does not retain a continuous history of precise geolocation and does not use the device advertising identifier for behavioural advertising.

OwnCup does not collect push open, view or click-through events. Technical acceptance of a message by FCM or APNs does not mean that the Guest saw or opened the notification and is not used as evidence of opening or delivery to the Guest.

3.4. Business clients, support and moderation

For participating cafés, OwnCup processes their representatives' contact, registration, contractual, plan, payment and invoice data, as well as data about locations and published offers. A contractual-confirmation record includes the Business Account user's internal identifier, role, the Client on whose behalf the action was taken, date and time, language, source, versions of the documents accepted and confirmation of the asserted authority. When a support request or content report is submitted, OwnCup processes contact details, the content of the submission, evidence provided, decisions and correspondence.

A business user may upload photographs or videos for a café profile, offer or reward. The café is responsible for holding the rights to the materials and having a legal basis for depicting identifiable persons. Those materials are not sent to analytics as photographs or videos.

OwnCup does not ask users to submit special categories of personal data. If such information is objectively necessary for a particular submission, only the minimum necessary amount should be provided.

4. Required email address and data minimisation

An email is required for registration, Account verification, secure login, access recovery, service messages and performance of the Agreement. Without it, OwnCup cannot create or securely maintain an Account.

Optional data are clearly identified in the interface. Refusal to provide optional data does not restrict core functions for which those data are not required.

For confirmation of legal entitlement, OwnCup does not request a date of birth, age group or copy of an identity document.

5. Purposes and legal bases

6. Legitimate interests

Where OwnCup relies on legitimate interests, it pursues the protection of Accounts and the platform, prevention of fraud and technical abuse, error diagnosis, handling of submissions, management of the Client relationship, verification of its representatives' authority, documentation of contractual confirmation, demonstration of compliance and defence of legal claims.

OwnCup assesses the necessity and proportionality of the processing, the amount of data, the user’s reasonable expectations and the possible effect on their rights. The user may object to such processing; OwnCup will cease it unless it demonstrates overriding legitimate grounds or necessity for legal claims.

7. Marketing messages

OwnCup provides three independent categories that are off by default:

1. Café offers and promotions;
2. Offers from OwnCup;
3. OwnCup news and updates.

Selecting one category does not enable the others. In the interface, the Café offers and promotions category is explained as follows: “Campaigns by cafés whose programmes you participate in, and automatic OwnCup reminders about visits, progress and rewards in those programmes.”

A message is allocated by its purpose. A campaign by the relevant café and an automatic OwnCup reminder about that café's Programme belong to the Café offers and promotions category. An OwnCup offer that is unrelated to a particular café's Programme belongs to the Offers from OwnCup category.

The device's system permission for notifications, registration, acceptance of the Terms, participation in a Programme and the existence of a push identifier do not constitute consent to marketing. Service notifications are used only for the stated operational purposes.

After selecting at least one marketing category and before it is activated, the user separately confirms their legal entitlement to give consent independently using the wording in section 16. Without that confirmation the category is not activated, while the Account and core functions remain available.

The selection may be changed or withdrawn free of charge in the application settings. Withdrawal places the category in suppression state without undue delay and blocks new messages. A separate technical push-identifier binding for service messages may be retained only where there is an independent purpose and status.

Required service emails do not contain advertising and are sent while the Account is active, irrespective of the absence of the marketing feature.

8. Profiling and automated decisions

OwnCup does not make decisions based solely on automated processing that produce legal effects for the user or similarly significantly affect the user.

Automated rules may detect duplicate transactions, anomalous activity, technical errors or possible fraud and temporarily refer an event for review. The user may contact support@owncup.eu, have the matter considered by a staff member, state their position and contest the outcome.

For the café offers and promotions category, OwnCup may use the verified city of the Location, application language, participation in the relevant programme, period since the last confirmed visit, number of visits remaining before a reward and reward status. These rules do not produce legal or similarly significant effects for the Guest.

The café does not select a specific Guest and does not receive the criteria used. Current geolocation, age, or an open, view or click from a previous push is not used to form the audience.

9. What the café sees and the parties' roles

Through the secure loyalty-programme interface, an authorised staff member of the relevant café sees the Guest’s displayed or generated name, the time, offer or transaction type, associated reward, confirmation status and history of such transactions in that café’s Programme for no more than the preceding 12 months. Access ends earlier if the Guest’s participation or the relevant Programme ends. The restriction applies to past identifiable history: the current state of confirmed progress and a reward already obtained, as required for an active Programme, may be displayed separately without restoring old transactions. Even a generated name, together with the history or current state, is personal data.

For a push campaign, the café does not receive the Recipients' personal and technical data listed in section 10.2 of the Business Client Terms of Service. In the loyalty-programme interface, the café does not receive an email address, telephone number, internal user identifier, push identifier, Firebase Installation ID, data about participation at other cafés or an export of the Guest list. Aggregated analytics do not allow the café to define breakdowns or segments that identify an individual.

OwnCup is an independent controller in respect of the Account, authentication, obtaining and logging category selections, push registrations, suppression, security, uniform platform rules, anti-fraud measures, manual corrections, aggregated analytics, support, fulfilment of data subject rights and its own legal obligations.

For participation in a particular café’s Programme, OwnCup and that café are joint controllers under Article 26 GDPR. The café determines the purpose and rules of the Programme, the reward and the decision upon termination; OwnCup determines the technical fields, storage, security, rectification and deletion. OwnCup publishes the information and is the primary technical contact at privacy@owncup.eu; the café manages its staff access and uses the data only for its Programme.

For the limited operation of forming and conducting a push campaign initiated by the café, OwnCup and the café are joint controllers. The café determines the commercial purpose, Material, Locations and period. OwnCup determines the technical means, applies the Guest's selection and uniform rules for determining the Recipients, frequency and sending time. OwnCup keeps the selection record and suppression and performs the technical send.

An automatic OwnCup reminder about visits, progress or a reward in the café's Programme is not a café-initiated campaign. The café does not enable the reminder for a particular Guest and does not select the trigger, Recipient, Material, period or sending time. For the subsequent operation of generating and sending such a reminder, OwnCup acts as an independent controller. The preceding loyalty operation from which the event arose remains a joint operation of OwnCup and the café.

For both joint operations, OwnCup coordinates responses to requests and incident assessment. The café forwards a request received to OwnCup within three working days, stating the original date and time of receipt, and reports a suspected incident within 24 hours after discovery. The period for responding to the Guest runs from the date on which either party receives the request and does not restart upon internal forwarding. The Guest may contact either party irrespective of the allocation. The full allocation of responsibilities is set out in section 10.5 of the Business Client Terms of Service.

The café is responsible as an independent controller for the content, prices, terms and performance of its offer, data that it independently retains or uses outside the designated OwnCup interface, and uploaded café-profile materials.

10. Technologies, recipients and providers

10.1. Marketing website

The marketing website owncup.eu is hosted on Vercel infrastructure. For page delivery, operation of the global CDN, TLS, protection against abuse and technical diagnostics, Vercel receives the IP address, request date and time, requested path, headers and limited technical request information. The strictly necessary choice record is stored locally in the browser. Google Analytics 4 may be activated only after consent and only if analytics is enabled in the published build. Fonts are hosted on an OwnCup resource and do not initiate a connection to Google Fonts.

10.2. The app.owncup.eu web application

10.3. Native applications

The principal ongoing providers and recipients are listed in the Service Providers and Data Recipients Register. Providers that process data on OwnCup’s behalf are bound by contractual obligations of confidentiality, security and processing only on documented instructions.

Before connecting new external analytics, advertising or a mobile SDK, OwnCup updates the relevant disclosure and, where consent is required, requests it before activating the technology.

11. Hosting and international transfers

Under the current configuration, the main application and API are hosted on Google Cloud Run in the europe-west1 region (Belgium), the primary MongoDB Atlas database and backups are located in the EU/EEA, Google Cloud Storage is in the EU multi-region, and OwnCup’s email infrastructure is located in Estonia.

Some providers use global infrastructure, provide support from third countries or process certain technical data outside the EEA. This may apply, in particular, to Vercel, Google/Firebase, Apple and MongoDB.

For transfers outside the EEA, OwnCup uses, depending on the recipient, a European Commission adequacy decision, the EU–U.S. Data Privacy Framework for a currently certified recipient and covered data, or the European Commission’s Standard Contractual Clauses with the necessary supplementary measures.

For transfers to Vercel Inc. in the United States, OwnCup relies on the EU–U.S. Data Privacy Framework for covered data while Vercel maintains a valid certification; where that mechanism does not apply, OwnCup uses the European Commission's Standard Contractual Clauses incorporated into the applicable DPA and the necessary supplementary measures.

A copy of the applicable safeguards or information about them may be requested at privacy@owncup.eu. Commercial and security-related information may lawfully be redacted.

12. Retention periods

13. Account deletion

An Account may be deleted through the OwnCup interface or by sending a request to privacy@owncup.eu. Following confirmation:

1. access to the Account is terminated;
2. tokens and active sessions are revoked;
3. the email, optional name, login identifiers, active push registrations, associated Firebase Installation IDs within the scope controlled by OwnCup, and one-time codes are deleted or irreversibly de-identified;
4. related user files are deleted or de-identified;
5. necessary deletions are reapplied if the data have been restored from a backup.

The interface states:

Your Account is no longer available. The deletion process has begun.

Limited records may be retained where necessary by law, for security, prevention of abuse or defence of legal claims. They are isolated, are not used for marketing and are deleted or de-identified once the basis ceases to apply.

14. Rights

Depending on the circumstances, the user is entitled to obtain information and access to data, rectify them, request erasure or restriction, receive the data provided by the user in a portable format, object to processing based on legitimate interests, withdraw consent, request applicable human intervention, lodge a complaint with a supervisory authority and apply to a court.

A request is sent to privacy@owncup.eu. OwnCup may reasonably verify identity and responds within the period established by law, generally within one month.

15. Supervisory authority

The user has the right to contact the supervisory authority at the place of their habitual residence, place of work or place of the alleged infringement.

The lead contact in Bulgaria is:

Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
kzld@cpdp.bg · cpdp.bg

16. Minors

After selecting at least one marketing category and before it is activated, the user confirms by means of a separate checkbox that is off by default:

I confirm that I am legally entitled to give this consent independently under the law applicable to me.

OwnCup does not request a date of birth, age group or copy of an identity document for this confirmation. OwnCup records only the fact of confirmation, the version of the text displayed, the date and time, the language and the technical source.

The confirmation is the user's statement that they are legally entitled to give the specific consent independently, but is not documentary age verification. If the user is not legally entitled to give consent independently, the marketing category is not activated. The current model does not permit activation on the basis of permission from a parent or holder of parental responsibility. An age rating or target audience in the App Store or Google Play does not verify the age of a particular user.

17. Security

OwnCup applies measures proportionate to the risk, including access controls, encryption in transit, secrets management, security logging, backup and response procedures. No method of transmission or storage guarantees absolute security.

18. Changes to the Notice

OwnCup updates the Notice when the service, purposes, providers or legislation changes. Advance notice of a material change is given where required by law. New consent is requested where the change is not covered by the previous legal basis.