Privacy Policy

Who is responsible

kucacao.com is published by Kukuwu Beverages C.I. SAS (“Kukuwu Beverages”, “we”). We are the controller of the personal data described on this page.

• Privacy contact: [email protected]

Analytics

Google Analytics 4 (Google) runs only if you choose “Accept” in the cookie banner. Before you choose, and if you choose “Reject”, it is not loaded and nothing is sent to Google. When it runs, it sets the cookies _ga and _ga_<ID> and receives information about your visit, such as the pages you view, the site that referred you, your device and browser type, your approximate location and how quickly pages load and respond for you. We use it to understand which content is useful and how well the site performs, not for advertising. The site uses Google Consent Mode v2: every Google consent setting starts as “denied”, and accepting grants analytics storage only, never advertising cookies, ad user data or ad personalisation.

Vercel Web Analytics (Vercel, our hosting provider) counts page views without cookies and without storing anything on your device. We only see aggregated figures.

Legal basis: your consent for Google Analytics, which you can withdraw at any time; our legitimate interest in measuring how the site is used for Vercel Web Analytics. Google Analytics keeps event-level data for 2 months.

Newsletter and venue inquiries

When you subscribe to the newsletter, we collect your email address and, where the form asks for it, your name. When you send a venue inquiry from the “Where to Find” page, we collect your name, email address, venue type, location and message, and the site language you used.

This information is stored in our database, hosted by Supabase. Emails about your request are sent through Resend, our email delivery provider. We use it only to send what you asked for and to reply to you.

The newsletter uses double opt-in: we email you a link, and you are subscribed only once you confirm. The links in our emails carry a private code, of which we store only a hashed form, and Google Analytics never loads on the pages they open. We keep a record of each sign-up request, confirmation and unsubscribe, with its date and time, language, the form used and the version of the consent text shown, as proof of your choice. Sign-ups that are never confirmed are deleted, with their links and records, by a daily job 30 days after the last request to sign up. Newsletter emails include an unsubscribe link, and replies go to [email protected].

Venue inquiries are emailed to our team when you send them, and a daily job deletes them from the database at the end of the retention period below.

Legal basis: your consent (newsletter) and steps you asked us to take (inquiries). You can unsubscribe or ask us to delete your data at any time by writing to [email protected]. How long we keep it: sign-ups that are never confirmed, 30 days after the last request to sign up; a subscription, until you unsubscribe, after which we keep only your email address and the dates you signed up, confirmed and unsubscribed, so that we do not email you again, and delete the links we sent you 30 days later; the records of your sign-up, confirmation and unsubscribe, 3 years after you unsubscribe; venue inquiries, 24 months.

Cookies and browser storage

Apart from the Google Analytics cookies above, which are only set with your consent, the site keeps a few preferences in your browser's local storage. They stay on your device and are not sent to us:

• analyticsConsent: your answer to the cookie banner, with the date you answered and a version number
• userLanguageChoice: the language you chose, or that you declined the language suggestion

You can change your analytics choice at any time with the “Cookie settings” button below or in the page footer.

Service providers and international transfers

To deliver the site, our hosting provider and Cloudflare, which sits in front of the site, process your IP address and request details, as every website does. Images are delivered through our hosting provider's image service, so your browser loads them from this site rather than from the host that stores them; only an image that a blog post embeds directly from another website is loaded from that website, which receives your IP address with the request. The blog's list of posts is loaded by your browser directly from our database provider, Supabase, which receives your IP address with that request. These providers process personal data on our behalf: Vercel (hosting, image delivery and Web Analytics), Cloudflare (network proxy in front of the site), Supabase (database), Resend (email delivery) and Google (Google Analytics, only with your consent).

Some of them may process data outside your country, including in the United States. For these transfers we rely on Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.

Your rights

Depending on where you live, including under the EU and UK GDPR, you may have the right to access, correct or delete your personal data, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time without affecting processing that took place before.

To exercise these rights, write to [email protected]. You can also lodge a complaint with your local data protection authority.

Changes to this policy

We will update this page when what we collect or how we use it changes, and change the date at the top.