Privacy, clearly served.

Who is responsible?

JKB Boba Blends AB is the data controller for personal data processed through BOBA Milk Tea’s website and direct business communications.

What this website collects

TECHNICAL REQUEST DATA

When you visit the website, the hosting and security infrastructure may process technical data needed to deliver and protect the service. This can include IP address, request time, requested page, browser or device information, and security or error events.

OPTIONAL PRIVACY-FIRST WEB ANALYTICS

If you actively allow optional analytics, we load Cloudflare Web Analytics to understand overall visits, page views, referral sources, browser or device categories and website performance. The analytics script is blocked until you consent. Cloudflare states that its Web Analytics service collects the minimum information needed for these measurements, does not track individual visitors across customers’ websites, and does not use cookies, local storage or fingerprinting to create visitor profiles.

OPTIONAL DEVICE-LOCAL MYSTERY MEMORY

If you actively select “Remember the mystery on this device”, this website stores one record in your browser’s local storage under the name boba_mystery_progress_v1. It can contain the seals and drink clues you have found, whether you discovered the Quiet Promise, your current Hidden Tea House ingredient sequence, and the displayed date on which you completed the First Cup. It contains no name, email address, account identifier or advertising identifier and is not sent to BOBA or Cloudflare Analytics.

The record is given a 180-day expiry each time progress is saved. The website ignores and deletes an expired record when you next visit. It may disappear sooner if you clear browser data, use private browsing or change device or browser. If you do not select this option, the mystery still works but progress lasts only in the current page visit.

NECESSARY PRIVACY-CHOICE COOKIES

We use two necessary first-party cookies named boba_analytics_consent and boba_mystery_memory_consent. They store only whether you allowed or rejected each optional purpose, are kept for up to 180 days, and are not used for advertising or analytics. They are needed to remember and respect your selections. You can change them at any time through the Privacy choices button. The private review version of the site may also use strictly necessary hosting authentication or security cookies.

EMAILS YOU CHOOSE TO SEND

If you contact us by email, we process the contact details and information you provide so we can answer you and manage the matter. Please do not send sensitive personal information unless it is necessary.

NO ADVERTISING PROFILES

The current website has no customer account, order form, newsletter signup or advertising pixel. We do not use website analytics to build advertising profiles and we do not sell personal data.

Why we process it

• To display, operate, secure and troubleshoot the website.
• To understand aggregate website use and performance, but only after analytics consent.
• To remember optional mystery progress on your device, but only after your separate choice.
• To prevent misuse and protect the website and visitors.
• To answer enquiries and manage business communications.
• To establish, exercise or defend legal claims and meet legal obligations where necessary.

Optional analytics and optional mystery memory are controlled by separate consent choices. Necessary technical delivery and security processing is based on our legitimate interest in operating a secure informational business website, while the privacy-choice cookies are necessary to remember and respect your selections. Where processing is required by law, the legal basis is compliance with a legal obligation. If you ask us to take steps before entering an agreement, that processing may be necessary to respond to your request.

Your choices and automated decisions

You can select analytics and mystery memory independently. Neither option is preselected, and “Reject all optional” is available in the same view as “Save selected choices”. Rejecting either option does not block the website. You can withdraw a choice at any time by opening Privacy choices on any page. Turning off mystery memory deletes BOBA’s mystery-progress record from that browser; turning off analytics prevents it from loading on the next page load.

You are not required by law or contract to contact us by email; if you do not provide contact information, we simply cannot answer an enquiry sent that way. BOBA does not use this website to make decisions about visitors by automated means and does not carry out profiling for advertising.

Who may receive data?

Personal data may be handled by service providers that host, secure or maintain the website and email service. Cloudflare provides the privacy-focused website analytics described above. These providers act under applicable contractual and confidentiality obligations. Data may also be disclosed when required by law or to protect legal rights.

Some service-provider infrastructure may involve processing outside the EU/EEA. Where GDPR requires it, such processing must rely on an approved transfer mechanism and appropriate safeguards.

How long is it kept?

Technical data is kept only for the period needed for service delivery, security, abuse prevention and troubleshooting, according to the relevant hosting and security settings. Cloudflare Web Analytics information is currently available to us for up to six months; Cloudflare states that unsampled beacon data is retained for seven days before longer-term aggregation. Email correspondence is retained only as long as needed to handle the matter and meet applicable accounting, legal or claims-related requirements. Data that is no longer needed is deleted or anonymised.

Cookies, local storage and analytics controls

Before analytics consent, BOBA blocks the optional Cloudflare analytics script. Cloudflare Web Analytics itself does not use cookies, local storage or fingerprinting to collect usage metrics, but its browser script reads performance information and sends a measurement beacon. We therefore treat it as optional and ask first.

Before you choose, BOBA does not save mystery progress in local or session storage. The two privacy-choice cookies described above may be set to remember a rejection as well as an acceptance. Optional mystery storage starts only when you select it. If you later turn it off, the stored mystery record is removed. If we introduce marketing tools, embedded media or other non-essential technologies, we will update this information and request valid consent before they are used.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, data portability, or object to processing based on legitimate interests. You may also complain to the Swedish Authority for Privacy Protection (IMY). Contact us first at info@bobamilktea.eu. We normally respond to valid rights requests within one month.

Visit IMY to learn how to submit a complaint ↗