Privacy Policy

1. Who is responsible?

For questions about personal data associated with this website, contact KINZA Coffee Roasters. Contact details are also available in the Legal Notice. Privacy contact: david@kinzaroasters.coffee. Contact address: Rue Delhasse 24, Spa, Belgium.

2. Information processed and why

• Enquiries: your email address, name if provided, message, company details and any quantities or destination you choose to supply. These are used to respond and discuss your request.
• Orders, if agreed separately: necessary customer, billing, delivery and correspondence information to perform the agreement and meet legal duties.
• Website access: hosting and security providers may process IP address, browser and device information, requested pages, timestamps and security events to deliver and protect the website.

The coffee search, filters and enquiry form run in your browser. Form fields are used to prepare a draft in your email application and are not sent to KINZA by the website. Your email provider processes the draft; KINZA receives the message only if you send it. There is no newsletter form, advertising pixel or analytics service added to the catalogue code.

3. Legal bases

Where you request steps towards a contract, or are a party to one, the relevant processing relies on Article 6(1)(b) GDPR. General correspondence, business-contact enquiries and proportionate website security rely on legitimate interests in responding to requests and running a secure business (Article 6(1)(f)), subject to your interests and rights. Required accounting or other statutory records rely on legal obligations (Article 6(1)(c)). Consent will be requested where required for any future optional tracking or marketing; sending an enquiry does not subscribe you to marketing.

4. Service providers and recipients

Information may be handled by the people responding to KINZA enquiries and by relevant hosting, email, IT, delivery, accounting or professional-service providers where needed for the stated purpose. Information may also be disclosed to authorities where legally required.

The current site is hosted using OpenAI Sites and Cloudflare infrastructure. While the site is private, ChatGPT sign-in is handled by the hosting platform. Site typography currently loads from Google Fonts, which causes your browser to contact Google to retrieve font resources. Your email application and provider process messages you choose to send.

5. International transfers

Some providers may process data outside the European Economic Area. Where such transfers occur, an applicable GDPR transfer mechanism is required, such as an adequacy decision or standard contractual clauses with any necessary supplementary measures.

6. Retention

Enquiry correspondence should be kept only as long as needed to handle the request and any justified follow-up or dispute. Contract and accounting records must follow applicable statutory retention requirements. Security logs should be retained only for the period justified by their security purpose. Information should then be deleted or anonymised unless a legal reason requires longer retention.

7. Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Where consent is used, you may withdraw it at any time without affecting earlier lawful processing.

Send requests to david@kinzaroasters.coffee. We may need proportionate information to verify your identity. GDPR requests are normally answered within one month; where a lawful extension is needed, you will be informed within that first month.

You may complain to the Belgian Data Protection Authority or the competent authority in the country of your habitual residence, workplace or the alleged infringement.

8. Your choices and policy updates

You do not have to send an enquiry to browse the catalogue. An email address and enough information to respond are necessary if you want a reply; withholding them may prevent us from handling your request. The catalogue code does not make automated decisions with legal or similarly significant effects or profile visitors for advertising. This policy will be revised when the site’s services or processing practices change.