Skip to content

Legal

Privacy Policy

Last updated: December 3, 2025

Last updated: September 2025

This Privacy Policy explains how TEN The Matcha (“TEN,” “we,” “our,” or “us”) processes personal data. TEN is committed to ensuring that personal data is collected and processed in accordance with applicable privacy and data protection legislation, including the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).

(1) Controller Details

Entity: TEN The Matcha
Registered office: Tirana, Albania
Email: info@tenthematcha.com

TEN is the controller in respect of the personal data collected through its websites, applications, and physical sales locations.

(2) Scope

This Privacy Policy applies to:

  • The website located at https://tenthematcha.com and any additional websites or applications operated by TEN that refer to this Policy.
  • Data processed when you visit our physical stores, tasting spots, pop-ups, or interact with our services online or offline.

(3) Categories of Personal Data

TEN may process the following categories of personal data:

  • Identification data (first and last name, date of birth, gender).
  • Contact details (address, phone number, email address, delivery details).
  • Transaction and financial data (order history, payment information, invoices).
  • Demographic and customer profile data (preferences, purchase behavior).
  • Technical data (IP address, device identifiers, browser information, cookies — see Section 10).
  • Communication data (messages, support requests, social media interactions).

(4) Purposes of Processing

Personal data is collected and processed for specific and legitimate purposes, including:

  • Processing and delivering orders made through our website or stores.
  • Managing customer profiles and loyalty programs.
  • Processing payments and invoices.
  • Providing customer support and communications.
  • Marketing and promotional activities (newsletters, offers), subject to consent where required.
  • Improving our products, services, website functionality, and customer experience.
  • Ensuring fraud prevention, security, and enforcement of TEN policies.
  • Conducting analytics for product and business improvement.

(5) Legal Basis

Processing is based on one or more of the following legal grounds under Article 6 GDPR:

  • Performance of contract (Article 6(1)(b)) — order fulfillment and service provision.
  • Consent (Article 6(1)(a)) — marketing, newsletters, cookies, or optional features.
  • Legal obligation (Article 6(1)(c)) — accounting, taxation, and regulatory compliance.
  • Legitimate interests (Article 6(1)(f)) — customer service improvements, product development, fraud prevention, business analytics.

(6) Retention

  • Transactional and financial data: retained for 5 years in accordance with Albanian tax requirements.
  • Customer communication: up to 1 year after last interaction.
  • Marketing data: kept until consent is withdrawn.
  • Technical/log data: retained only as long as necessary for security, analytics, and system operation.

(7) Sharing of Data

TEN does not sell personal data. Data may be shared only with:

  • Service providers / processors (IT, marketing, payment processors, logistics partners).
  • Public authorities when legally required.
  • Business partners involved in order fulfillment or operational support.
  • Where personal data is transferred outside the EEA, TEN applies adequate safeguards under Chapter V GDPR (such as Standard Contractual Clauses).

(8) Data Subject Rights

Under GDPR, you have the right to:

  • Access your personal data.
  • Correct inaccurate or incomplete data.
  • Request deletion (“right to be forgotten”).
  • Restrict processing in certain situations.
  • Obtain a copy of your data (“data portability”).
  • Object to processing, including marketing communications.
  • Withdraw consent at any time.
  • Not be subject to automated decision-making with significant effects.

Requests can be submitted to info@tenthematcha.com, and we will respond within one month.

(9) Children’s Data

TEN does not knowingly collect personal data from individuals under the age of 16. If we learn that we have inadvertently collected such data, we will delete it promptly.

(10) Cookies

TEN uses cookies and similar technologies for:

  • Website functionality.
  • Analytics (Google Analytics, platform statistics).
  • Marketing and personalization (if consented).

Users can manage their cookie preferences via the cookie banner or their browser settings.

(11) Security

TEN implements appropriate technical and organisational measures to protect personal data from unauthorised access, alteration, disclosure, or loss. However, data transmitted via the internet cannot be guaranteed to be 100% secure.

(12) Updates

We may update this Privacy Policy occasionally. Any significant changes will be posted on our website. Continued use of our website or services indicates acceptance of the updated policy.

(13) Complaints

If you believe your personal data is being processed improperly, you may lodge a complaint with:

Information and Data Protection Commissioner (IDP / Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale) in Albania
https://www.idp.al