Privacy Policy

This Privacy Policy applies to Evonova Group Inc ("we", "us", "our"), operating the Espretto brand and the website at espretto.com. Our registered address is 501 Silverside Rd STE 105-1055, Wilmington, DE 19809, United States.

We are the data controller for personal data collected through this website. If you have any questions about this policy or our data practices, please contact us at [email protected].

We collect the following categories of personal data:

We do not collect any special categories of personal data (e.g. health, biometric, or financial account data) through this website.

We collect data through the following means:

• Direct interactions — when you fill in our café partnership enquiry form or franchise application form.
• Automated technologies — as you interact with our website, we may automatically collect technical and usage data via cookies and similar technologies.
• Third parties — analytics providers and email delivery services (see Section 7).

We use your personal data only where we have a lawful basis to do so under the UK GDPR and EU GDPR. The table below sets out our purposes and the corresponding legal bases:

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

If you are located in the UK or European Economic Area, you have the following rights regarding your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to request correction of inaccurate or incomplete data.
• Right to erasure — to request deletion of your personal data ("right to be forgotten"), subject to certain conditions.
• Right to restriction — to request that we restrict processing of your data in certain circumstances.
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
• Right to object — to object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK (ico.org.uk) or the relevant supervisory authority in your country of residence.

We share your data with the following categories of third-party service providers, who act as data processors on our behalf:

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

Our website uses cookies and similar tracking technologies to distinguish you from other users and to improve your experience. The cookies we use fall into the following categories:

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the website.

As Evonova Group Inc is incorporated in the United States, and some of our service providers are based outside the UK/EEA, your personal data may be transferred to and processed in countries that may not provide the same level of data protection as your home country. Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission or the UK ICO.

We have implemented appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. Access to your data is restricted to personnel who have a business need to know.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and you directly where required.

Our website is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately at [email protected].

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. We encourage you to review this policy periodically. Continued use of our website after changes are posted constitutes your acceptance of the updated policy.

For any questions, requests, or concerns relating to this Privacy Policy, please contact our data protection contact at: