Privacy Policy

KITSU COFFEE S.A.S. ("Kitsu Coffee", "we") sells green coffee from Colombia to businesses. This Privacy Policy explains how we handle personal information on our website, kitsucoffee.com, and in our client portal (kitsucoffee.com/portal): what we collect and why, how long we keep it, who processes it for us, where it goes, how we protect it and how you can use your rights. We collect only the personal information we need for each purpose.

1. Why we process personal information

We use personal information only for these purposes:

• Website: to answer the inquiries and sample requests you send through our contact forms, and to protect the forms against spam.
• Website: to show approximate prices in Korean won and to count visits to the website without identifying visitors.
• Client portal: to review applications and confirm that the applicant is a business.
• Client portal: to prepare quotes; to handle orders, payment, shipping and customs; to keep invoices and export documents; and to answer your messages.
• Client portal: to keep a record of the consents you give and to keep the portal secure.
• News and offers by email: only if you agree to receive them.

We do not use personal information for any other purpose. If a purpose changes, we will tell you and, where the law requires it, ask for your consent again.

2. What we collect and how long we keep it

How long we keep your account data (your choice). When you apply, and at any time in "Your information", you choose how long we keep your portal account data (profile, application and messages): until you ask us to delete it (preselected), or 1 year or 3 years after your last sign-in. When that period ends, we delete or anonymise these data. Whatever you choose, orders, invoices, payments and export documents are kept for the periods required by law, and your consent to news by email lasts until you withdraw it. If you withdraw an application while it is under review, it is deleted at once.

If you sign in with Google or Kakao but do not apply. The sign-in creates an entry in our sign-in service. If you choose "Cancel and leave" on the application page, it is deleted at once; otherwise it is deleted automatically after 7 days.

Required and optional information. You may refuse to give the required information, but then we cannot review your application or answer your message. You can leave out the optional information without any effect on the service.

3. Sharing with third parties

We do not sell personal information and we do not give it to third parties, except:

• to the carrier, freight forwarder or customs broker of your order: company name, contact name, delivery address and phone number, only to deliver the order;
• to banks or payment services: only the information needed to process your payment;
• when you agree to it, when a law or a competent authority requires it, or when it is urgently needed to protect someone's life, body or property and you cannot be asked in time.

Any statistics we make contain no personal information.

4. Service providers that process personal information for us

Each provider processes personal information only for the task above, under its agreement with us. The products page also asks an exchange-rate service (open.er-api.com, run by ExchangeRate-API) for the US dollar to Korean won rate; it receives only the technical data of your browser's request (such as the IP address), never what you type.

Sign-in with Google or Kakao. If you choose to sign in with Google (Google LLC, USA) or with Kakao (Kakao Corp., Republic of Korea), you sign in on their page and they send us the information listed in section 2. They are not our service providers: they handle your Google or Kakao account under their own privacy policies, and they learn that you sign in to Kitsu Coffee. We send them no personal information. What they send us is kept by Supabase (Tokyo, Japan), like the rest of your account.

5. Transfer of personal information abroad

Kitsu Coffee is in Colombia and the providers above are in other countries, so your personal information is processed in Colombia (Kitsu Coffee), Japan (the portal database, in Tokyo) and the United States (the other providers).

• Legal basis: for the client portal, your separate consent to the international transfer, which you give when you apply; for the website contact forms, the transfer is needed to receive and answer the message you send us.
• Personal information transferred: the information in section 2, for each moment (contact form, sign-in with Google or Kakao, application, quote, order). What Google or Kakao send us when you sign in is stored before you apply, only so that you can apply; if you do not apply, it is deleted as explained in section 2.
• Countries, time and method: the countries above; when you send a form, apply or use the portal, over encrypted connections (HTTPS).
• Recipients and how to contact them: the providers in section 4, through their privacy policies: supabase.com/privacy, vercel.com/legal/privacy-notice, resend.com/legal/privacy-policy, formspree.io/legal/privacy-policy and policies.google.com/privacy.
• Purpose and period: as in sections 1, 2 and 4.
• How to refuse, and the effect: you can refuse by not sending the form or not applying, and stop it later by deleting your account. Without the transfer we cannot answer the form or provide the portal.

6. Your rights and how to use them

You can ask to see your personal information, to correct it, to delete it, to stop or limit its processing, and to withdraw any consent. In the client portal you can do much of this yourself in "Your information" (your details, how long we keep your data, news by email and the list of your consents). For anything else, write to Kitsucoffee@outlook.com from the email address we know, or use "Messages" in the portal.

• You may act through a representative with a written power of attorney. We check that each request comes from you or from your representative.
• Requests are free. We reply within the time limits set by the applicable law.
• While a correction or deletion you asked for is pending, we do not use or share the personal information concerned.
• We refuse or limit a request only where a law allows it, and we tell you why.
• To delete your account and your data, see the page "Delete your account" (kitsucoffee.com/delete-account).

7. How we protect personal information

• Administrative: only the people who need personal information for their work can access it.
• Technical: in the portal, the database lets each client see only their own information; administration requires a password sign-in; all connections are encrypted (HTTPS); passwords are kept by the sign-in service in a form that cannot be reversed, and we never see them; consents and changes to the status of accounts are recorded.
• Physical: the portal data is kept in access-controlled data centres (Supabase, on Amazon Web Services, in Tokyo).

If there is a data breach. When we learn of a breach of personal information, we inform the people affected and the competent authorities without undue delay and within the time limits set by the applicable law: what information, when and how it happened, what you can do to limit the harm, what we are doing and whom to contact.

8. How we delete personal information

When a keeping period ends or a purpose is fulfilled, we delete the personal information without undue delay. Electronic files are deleted so that they cannot be recovered; paper documents, if any, are shredded. Our privacy officer checks what is to be deleted. Personal information that a law requires us to keep (orders, invoices, payments and export documents, under commercial, tax and customs law) is kept with limited access and used only for that legal reason until the period ends.

9. Children

Our website and our portal are for businesses. Applications for a portal account must be made by adults acting for a business. We do not knowingly collect personal information of children under 14; if we learn that we hold any, we delete it.

10. Cookies and information stored in your browser

We do not use advertising or tracking cookies, and our own pages do not set cookies. Your browser keeps some settings for our pages:

• Website: your language, the latest exchange rate, your list of coffees on the products page and whether you have seen the note about it, and whether the chat button has already been shown to you.
• Client portal: your sign-in session (needed to stay signed in), your language and, for up to 30 minutes, the boxes you ticked while applying.

Google reCAPTCHA, on the contact forms and on the portal registration page, may set Google cookies and collect information about your device to tell people from automated programs; Google's privacy policy applies. Vercel Web Analytics, on the public website, uses no cookies. If you sign in with Google or Kakao, their sign-in pages set their own cookies; their privacy policies apply.

How to refuse. You can block or delete cookies and site data in your browser settings: Chrome (Settings → Privacy and security → Third-party cookies, and Site settings), Edge (Settings → Cookies and site permissions), Safari (Settings → Privacy), Firefox (Settings → Privacy & Security). If you block site data, the website still works but forgets your settings, and you cannot sign in to the portal.

11. Privacy officer and where to complain

KITSU COFFEE S.A.S., Colombia (NIT 902.113.014-0), Bogotá, Colombia.

Privacy officer: Nicolás Bonilla Moreno, legal representative. Phone: +82 10-5906-5760. Email: Kitsucoffee@outlook.com. Questions, requests about your personal information and complaints go to these contacts; we answer without undue delay.

If you are not satisfied with our answer, you can also contact:

• Korea: Personal Information Dispute Mediation Committee, 1833-6972, www.kopico.go.kr (we take part in its mediation); Personal Information Infringement Report Center, 118, privacy.kisa.or.kr; Korean National Police Agency, 182, ecrm.police.go.kr; Personal Information Protection Commission, www.pipc.go.kr.
• Colombia: Superintendencia de Industria y Comercio, www.sic.gov.co.
• Japan: Personal Information Protection Commission, www.ppc.go.jp.

12. Effective date and changes

This Privacy Policy is in force from its publication on this page. When we change it, we publish the new version here before it takes effect, we say what changed, and we tell portal clients in the portal or by email.

What changed in this version (2026-10-v2): sign-in with Google and with Kakao (sections 2, 4, 5 and 10). The previous version (2026-10-v1) replaced the website privacy policy of 1 October 2026, which covered only the contact forms, and added the client portal. Earlier versions are sent on request.