Privacy policy
Last updated: 14 September 2026
1. Controller
The data controller is Vea Group S.p.A., registered office Via Monte Grappa 7, 24121 Bergamo (BG), Italy, P.IVA IT01784890160, codice fiscale 01784890160, REA BG-236532; operational address Via Industriale 1, 24040 Chignolo d'Isola (BG); tel. +39 035 4949555.
Privacy contact: info@veagroup.com
2. Scope
This policy covers heylo.coffee and its language versions.
3. What we collect, why, and on which legal basis
3.1 Quote and contact form
Name, work email, phone, company or venue, country, business type, machine of interest, cups per day, number of venues, timeframe, distributor status, message, the page you sent it from and its campaign parameters, and your consent choices. We use them to answer your request and prepare a quote.
Legal basis: Art. 6(1)(b) GDPR, steps prior to a contract taken at your request, and Art. 6(1)(f) GDPR, our legitimate interest in following up a business enquiry.
3.2 Sharing with an authorised local partner
Only with your consent, given through the partner-sharing checkbox, we pass your request to an authorised distributor in your country so they can contact you. Legal basis: Art. 6(1)(a) GDPR. We name the category of recipient, authorised distributors in your country, not individual partners.
3.3 Marketing communications after a request
Only if you tick the optional marketing checkbox, we send you Heylo and VEA Group news by email. Legal basis: Art. 6(1)(a) GDPR. You can withdraw at any time.
3.4 Newsletter
Your email address and your consent, to send you the Heylo newsletter until you unsubscribe. Legal basis: Art. 6(1)(a) GDPR. Subscription uses double opt-in and every email carries an unsubscribe link. The newsletter is processed by Mailchimp.
3.5 Analytics
Google Analytics 4 usage data, only after you accept analytics cookies. Legal basis: Art. 6(1)(a) GDPR. IP addresses are anonymised and no advertising features are enabled.
3.6 Security and abuse prevention
Your IP address is used to rate-limit the form, a hidden field detects automated submissions, and our hosting provider keeps server logs. Legal basis: Art. 6(1)(f) GDPR.
3.7 Legal obligations
Where the law requires it, we process data to meet a legal obligation. Legal basis: Art. 6(1)(c) GDPR.
4. Who receives the data
Authorised local partners receive your details only with your consent, so they can contact you. Inside VEA Group, your request reaches the sales and marketing teams and the group CRM.
| Processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Resend | Transactional email (confirmation to you, notification to our team) | US | EU-U.S. Data Privacy Framework; Standard Contractual Clauses where it does not apply |
| Apollo.io | CRM contact database (name, email, company, country, list label) | US | EU-U.S. Data Privacy Framework; Standard Contractual Clauses where it does not apply |
| Google Analytics 4 (Google Ireland Ltd) | Consented analytics only | Ireland | EU-U.S. Data Privacy Framework; Standard Contractual Clauses where it does not apply |
| Mailchimp (Intuit Inc.) | Newsletter | US | EU-U.S. Data Privacy Framework; Standard Contractual Clauses where it does not apply |
| Vercel Inc. | Hosting and CDN, server logs | US | EU-U.S. Data Privacy Framework; Standard Contractual Clauses where it does not apply |
| Supabase (VEA-owned project, Frankfurt / EU region) | Database storing form submissions | EU (Frankfurt) | No transfer outside the EEA |
| Authorised local distributors | Independent recipients receiving your request only with your consent, in your country | Your country | Your consent |
5. Transfers outside the EEA
Some processors are based outside the European Economic Area. Transfers rely on the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses.
6. How long we keep it
Quote and contact data: 24 months from your last contact, then deleted or anonymised unless a contract or legal obligation requires longer. Newsletter data: until you unsubscribe. Analytics data: per the retention set in Google Analytics (14 months recommended) and the GA cookie lifetimes. Consent cookie: 6 months.
Server logs: Vercel keeps runtime logs for one day on the Pro plan in use.
7. Cookies and consent
Only necessary cookies are set by default. Analytics runs after you accept it. Change or withdraw your choice at any time from 'Cookie settings' in the footer.
No other cookies are set by this site; Mailchimp sets cookies only on its own pages.
| Cookie | Provider | Type | Duration | Purpose |
|---|---|---|---|---|
| heylo_consent | heylo.coffee (first-party) | Necessary | 6 months | Stores your choice |
| _ga | Google Analytics | Analytics | 2 years (default) | Set only after consent |
| _ga_K34BFZH54S | Google Analytics | Analytics | 2 years (default) | Set only after consent |
8. Your rights
You can ask for access, rectification, erasure, restriction and portability, object to processing (Arts. 15–21 GDPR), and withdraw consent at any time (Art. 7(3)). No automated decision-making takes place (Art. 22). You can lodge a complaint with the Garante per la protezione dei dati personali or the authority of your EU country.
To exercise your rights, write to the privacy contact in section 1 or to the registered office.
9. Security
Data travels over encrypted connections. Access is limited to authorised staff, and every processor is bound by a data-processing agreement.
10. Minors
This is a business site. We do not knowingly collect data from anyone under 16.
11. Changes to this policy
We update this page when our processing changes. The date above tells you the current version.
12. Governing text
This policy is drawn up in English. In case of discrepancy between the English text and a translation, the English text prevails.
13. How to contact us
Write to info@veagroup.com or to the registered office above.