Concept site: KAIRO Energy B.V. is fictional, and the company details are placeholders (addresses and emails use the reserved .example domain). On a real site, every page is filled with the real business details and reviewed by a lawyer in the business's country.
Privacy Policy
Last updated: 17 October 2026
This policy explains what personal data KAIRO Energy B.V. collects, why, how long we keep it and what you can ask us to do with it. We wrote it to be read, not to be skimmed past.
1. Who we are
KAIRO Energy B.V., Voorbeeldstraat 1, 1000 AA Amsterdam, Netherlands ("we") is the controller of the personal data described here. Questions: privacy@kairo.example.
2. What we collect and why
We only collect what we need for the purposes below. We don't buy data about you and we don't sell or rent it to anyone.
| What | Data | Why | Legal basis (GDPR) |
|---|---|---|---|
| Order | name, email, delivery address, items | to sell and deliver your order | contract |
| Age confirmation | a yes/no confirmation that you are 16 or older (we do not store your date of birth) | we only sell caffeinated drinks to people aged 16+ | legitimate interest |
| Subscription | pack, flavour, renewal date, cancellation requests | to deliver, bill and cancel your subscription | contract |
| Payment | handled only by our payment provider; we never see your full card number | to take payment | contract |
| Newsletter | email address, only if you subscribed | to send drops and new flavours | consent |
| Privacy requests | name, email, request type, your message | to answer and document your request | legal obligation |
| Accounting | invoices | to keep records the law requires | legal obligation (kept 7 years in the Netherlands) |
Do you have to give it? You need to give us your contact and delivery details to buy; without them we can't take or deliver your order. Everything else is optional. We don't make decisions about you based solely on automated processing.
3. Who we share it with
Service providers that help us run the business, under written contracts that let them use the data only for our instructions: web hosting, our payment and subscription billing provider, the fulfilment warehouse, shipping carriers and email delivery. We may also share data when the law requires it, or to protect our rights in a dispute.
Payment providers and carriers also use some data for their own legal obligations (for example fraud prevention and customs), as independent controllers under their own privacy notices.
4. International transfers
Some providers may process data outside the EU/EEA or the UK. When they do, we use the European Commission's Standard Contractual Clauses (and the UK addendum) or an adequacy decision, such as the EU-US Data Privacy Framework for certified US companies.
5. How long we keep it
Order, guarantee and warranty records: for the legal guarantee and warranty period plus 3 years for possible claims. Invoices: as long as tax law requires (see the table). Newsletter: until you unsubscribe. Privacy requests: 3 years. Server logs: 30 days. Then we delete or anonymise it.
6. Your rights
Wherever you live, you can ask us to:
- See the data we hold about you and get a copy (access, portability).
- Correct it if it's wrong.
- Delete it ("right to be forgotten"), unless we must keep it by law.
- Stop or limit how we use it, or object to it.
- Withdraw consent at any time, for example by unsubscribing from emails with the link in every email.
We reply within one month (GDPR), or 45 days for California requests. It's free. If you're not happy with our answer, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or the authority of your own country.
California residents (CCPA/CPRA): we don't sell or "share" personal information for cross-context advertising, and we don't use sensitive personal information to infer characteristics. You can make the same requests as above, and we won't treat you differently for using your rights. We honour the Global Privacy Control signal.
Israel: requests under the Protection of Privacy Law are handled the same way.
7. Children
This site is not for children under 16 and we don't knowingly collect their data. If you think a child gave us data, write to us and we will delete it.
8. Security
Encryption in transit (HTTPS), access only for staff who need it, and payment details handled only by a certified (PCI DSS) payment provider. If a breach puts your data at risk, we will tell you and the authority as the law requires.
9. Cookies
See our Cookie Policy. You can change your choice any time with Cookie settings.
10. Changes
If we change this policy in a way that matters, we'll say so on the site and, if you're a customer, by email, before the change applies.
11. Make a privacy request
Use this form, or write to privacy@kairo.example. We'll confirm it's you before we act, using the email address on your account or order.