Privacy Policy

Last updated: 28 October 2026

1. Controller

Osman Gedik – Rasa Kopi
Jochbergweg 10, 85748 Garching b. München, Germany
Email: support@rasakopi.coffee · Phone: +49 1567 8493185

We have not appointed a data protection officer, as there is no legal obligation to do so.

2. Overview

This website provides information about the RASA KOPI franchise concept. We process personal data when you visit the website, apply as a franchise candidate via the form, book a call, or – only with your consent – allow statistics and marketing cookies.

Personal data is any information relating to an identified or identifiable natural person.

You are not legally or contractually required to provide your data. However, without the mandatory fields in the application form and the booking form, we cannot process your application or your appointment. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

We only store your data for as long as is necessary for the respective purpose or as required by statutory retention periods. The specific periods are given in each section.

3. Hosting and server log files

The website runs on a server of DigitalOcean, LLC, 101 6th Ave, New York, NY 10011, USA. The server is located in a data centre in Frankfurt am Main, Germany. When you visit the site, technically necessary data is processed: IP address, date and time, page requested, referrer, browser and operating system. This data is used to run the website securely and reliably and is deleted after 14 days at the latest, unless it is needed to investigate a security incident.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). We have a data processing agreement with DigitalOcean. Where data may reach the USA, this is based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

Fonts are loaded locally from our own server. There is no connection to Google Fonts or other font providers. No content delivery network (CDN) is used.

For security reasons, this website uses TLS encryption (shown by "https://" in the address bar). Data you send via the form cannot be read by third parties in transit.

4. Cookie consent

Statistics and marketing services (section 7) are only loaded after you click "Accept" in the cookie banner. Your choice is stored in your browser's local storage (entry "rasa_consent"). This is technically necessary to respect your decision (Section 25(2) TDDDG).

You can withdraw or change your consent at any time via the "Cookie settings" link in the footer. When you withdraw consent, the statistics and marketing cookies are deleted.

Legal basis for the services in section 7: your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

5. Franchise application form

When you fill in the application form, we process: name, email, phone number, country, city, postcode, how you heard about us, preferred start date, preferred location, available capital, who will run the café, if your country is not listed: which country, whether you already live there and your interest in a master franchise, and your message or prior experience.

The data is sent directly to our customer relationship system Zoho CRM and stored there (section 6). We use it to review your application, contact you and prepare a possible franchise relationship.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request).

Retention: if no franchise agreement is concluded, we delete your data no later than 12 months after the last contact, unless you have agreed to longer storage. If an agreement is concluded, statutory retention periods apply (up to 10 years under German tax and commercial law).

Fields marked * are required to process your application.

6. Zoho CRM and Zoho Bookings

To manage applications (Zoho CRM), we use services of Zoho Corporation, 4141 Hacienda Drive, Pleasanton, CA 94588, USA. Our Zoho account is hosted in the US data centre.

To book calls with us (app.reclaim.ai), we use the scheduling service Reclaim.ai (Reclaim.ai, Inc., USA, a Dropbox company). When you book a call, Reclaim processes your name, e-mail address, the time you choose and your answers on the booking page, and enters the appointment with a Google Meet link into our Google calendar. Legal basis: Art. 6(1)(b) GDPR (steps before a possible contract). More information: reclaim.ai/privacy.

When you book a call, Zoho Bookings processes your name, email, phone number and the selected time slot. You receive automatic confirmation and reminder emails.

Legal basis: Art. 6(1)(b) GDPR (scheduling, pre-contractual steps). We have a data processing agreement with Zoho. The transfer to the USA is based on the EU Standard Contractual Clauses and, where Zoho is certified, the EU-US Data Privacy Framework.

More information: https://www.zoho.com/privacy.html

7. Statistics and marketing (only with consent)

7.1 Google Tag Manager

We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to manage the services listed below. Tag Manager is only loaded after your consent and does not create profiles itself, but may transmit technical data such as your IP address to Google.

7.2 Google Analytics 4

We use Google Analytics 4 to analyse how the website is used (e.g. pages viewed, time on site, where visitors come from, device type, approximate location). Cookies such as _ga and _ga_* are set. Google Analytics 4 does not store full IP addresses. Data is deleted after 14 months.

7.3 Google Ads conversion tracking and remarketing

We use Google Ads to measure our ads and to show relevant ads to visitors of our website. Cookies such as _gcl_au are set, and we measure whether a visitor, for example, submits an application after clicking an ad.

7.4 Meta Pixel (Facebook / Instagram)

We use the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland, to measure the effect of our ads on Facebook and Instagram and to show suitable ads to website visitors there. Cookies such as _fbp are set. We are jointly responsible with Meta for collecting and transmitting this data (Art. 26 GDPR); the agreement is available at https://www.facebook.com/legal/controller_addendum.

7.5 Metricool

We use Metricool (Metricool Software S.L., Spain) to analyse website visits in connection with our social media activities.

For all services in section 7: the legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via "Cookie settings". Google and Meta may transfer data to the USA; this is based on the EU-US Data Privacy Framework, under which both companies are certified.

8. YouTube video

A video from YouTube (Google Ireland Limited) is embedded in privacy-enhanced mode (youtube-nocookie.com). A connection to YouTube is only made when you start the video. Your IP address and device information, among other data, are then sent to YouTube. Legal basis: Art. 6(1)(a) GDPR (your consent by starting the video).

9. Contact by email or phone

If you contact us by email or phone, we process your details to handle your request. Legal basis: Art. 6(1)(b) or (f) GDPR. The data is deleted once it is no longer needed and no retention obligations apply.

10. Recipients

Your data is only received by the service providers named in this policy and by the Rasa Kopi staff handling franchise enquiries. It is only passed on to other third parties if we are legally required to do so.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent with effect for the future (Art. 7(3)). To exercise your rights, an email to support@rasakopi.coffee is sufficient.

Right to object (Art. 21 GDPR): where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you may object at any time, with effect for the future, on grounds relating to your particular situation. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint (Art. 77 GDPR): you may lodge a complaint with a data protection supervisory authority, e.g. the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

12. Changes

We update this privacy policy when the website or the services we use change. The version published here applies.