Privacy Policy

1. Who is responsible for your data

The data controller is Gabriel Soares, operating under the KofeTech brand from Portugal. Contact: hello@kofetech.com.

Because we are established in the European Union, the General Data Protection Regulation (GDPR) applies. When we process data of people located in Brazil, we also follow Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018).

For any privacy question, including as the contact channel for the data protection officer (encarregado) under the LGPD, email hello@kofetech.com.

2. What data we process

We only process data that you send us or that is generated technically when you visit the site:

• Contact form: your name, email address and the message you write, plus the language of the page you were on. The form includes a hidden anti-spam field that people are not meant to fill in.
• Bot protection: Cloudflare Turnstile analyzes technical signals from your browser and device (for example, IP address and browser characteristics) to tell people apart from bots.
• Technical access data: when serving the site, our hosting provider processes your IP address, date and time, the page requested and browser information, to deliver pages and protect the service.
• Visit statistics: aggregated figures (page views, country, device type, referrer), collected without cookies and without tracking you across sites.
• Scheduling: if you book a call through our Google Calendar appointment page, we receive the details you enter there (usually your name, email and chosen time).

3. Why we use your data and on what legal basis

Each use has a specific purpose and a legal basis (GDPR Article 6 and LGPD Article 7):

• Replying to your message, sending the automatic acknowledgment email and preparing a possible proposal: steps taken at your request before entering into a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V) and, where there is no intention to contract yet, our legitimate interest in replying to people who write to us (GDPR Art. 6(1)(f); LGPD Art. 7, IX).
• Protecting the site and the form against spam, abuse and attacks: legitimate interest in keeping the service secure.
• Delivering pages and keeping technical server logs: legitimate interest in running the site reliably and securely.
• Measuring site usage in aggregate to improve it: legitimate interest, using a cookieless method that does not identify you.
• Complying with legal obligations, if any (for example, responding to a request from an authority): legal obligation.

4. Who we share data with

We do not sell or rent personal data, and we do not share it for targeted advertising. We use the following providers, which process data only as needed to provide their service:

• Vercel Inc. (USA): website hosting and cookieless visit statistics.
• Resend (USA): delivery of the emails generated by the form, both to our inbox and the acknowledgment sent to you.
• Cloudflare, Inc. (USA): anti-bot verification on the form (Turnstile).
• Google (Google Ireland Limited / Google LLC): the Google Calendar appointment page and, where applicable, the mailbox where we receive messages. Data you enter on the appointment page is handled by Google under its own terms and privacy policy, and shared with us as the meeting organizer.

5. International transfers

Some of these providers are based in the United States or may process data outside the European Economic Area and Brazil.

In those cases, the transfer relies on the safeguards provided by law: the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the provider concerned is certified, or otherwise Standard Contractual Clauses approved by the European Commission and included in those providers' data processing agreements. For data subjects in Brazil, transfers follow the grounds in LGPD Article 33, including contractual clauses.

You can ask us for more information about these safeguards at hello@kofetech.com.

6. How long we keep data

The site does not store form submissions in its own database: they arrive by email in our inbox.

• Contact messages and the related email exchange: up to 24 months after the last contact if no project goes ahead. You can ask us to delete them sooner.
• If we start a project: the data is then handled under the contract and kept for the duration of the relationship and afterwards for as long as applicable law requires (for example, tax and accounting obligations).
• Technical server logs and Turnstile data: short periods set by Vercel and Cloudflare for security and operational purposes.
• Visit statistics: only in aggregated form, which does not identify you.

7. Your rights

Under the GDPR and the LGPD, you may at any time:

• confirm whether we process your data and access it;
• ask us to correct incomplete, inaccurate or outdated data;
• ask for your data to be erased, anonymized or blocked;
• ask us to restrict processing;
• object to processing based on our legitimate interest;
• receive your data in a structured format or ask for it to be ported;
• get information about the parties we share data with;
• withdraw consent where processing is based on it, without affecting what was done before.

8. How to exercise your rights and complain

Send your request to hello@kofetech.com. We may ask for additional information only to confirm your identity. We will reply within the legal deadline: as a rule, within one month under the GDPR, and within the deadlines set by the LGPD where it applies. Exercising your rights is free of charge.

If you believe your data has not been handled properly, you have the right to lodge a complaint with a supervisory authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD, cnpd.pt). In Brazil, it is the Autoridade Nacional de Proteção de Dados (ANPD, gov.br/anpd). We would appreciate the chance to resolve the issue with you directly first.

Visitors in the United States: we do not sell personal information or share it for cross-context behavioral advertising. You can request access to or deletion of your data at the same email address.

9. Cookies

The public site does not use advertising, profiling or analytics cookies, which is why we do not show a cookie banner. Visit statistics are collected without cookies.

The admin area (/admin), used only by KofeTech staff to manage content, uses a strictly necessary session cookie to keep them signed in. Site visitors do not receive this cookie.

Cloudflare Turnstile may process technical data needed for the anti-bot check when you use the form. External pages such as Google Calendar, Instagram, LinkedIn or GitHub apply their own cookie policies.

10. Links to other sites

The site may contain links to Instagram, LinkedIn, GitHub and our Google Calendar appointment page. When you follow those links, you leave our site and each service's own privacy policy applies.

11. Children

The site is intended for businesses and professionals and is not directed at children. We do not knowingly collect data from minors. If you become aware that a minor has sent us data, let us know and we will delete it.

12. Security

We use encrypted connections (HTTPS), anti-bot protection on the form, restricted access to our mailboxes and admin area, and providers with recognized security measures. No system is completely free of risk, but we handle your data with care and, if a relevant incident occurs, we will meet the notification obligations set by law.

13. Changes to this policy

We may update this policy when we change how the site works or when the law requires it. The date of the latest update is shown at the top of the page. If a change is significant, we will highlight it on the site.