Skip to content
Wholesale inquiry

Privacy policy

Last updated: 10 October 2026

This policy explains which personal data Caturra Coffee processes through caturracafe.com, its wholesale website, why, for how long, and what rights you have.

Who is responsible

Caturra Coffee is the controller under the EU General Data Protection Regulation (GDPR) and the Brazilian General Data Protection Law (LGPD). Contact: sales@caturracafe.com. We have not appointed a data protection officer; this address is our channel for all data protection requests.

Visiting the website

The website runs on Hostinger shared web hosting, with Hostinger’s own content delivery network (CDN) in front of it. When your browser requests a page or file, or sends the form, these servers necessarily receive your IP address and the usual request data: date and time, requested address, referring page, browser user agent, response status and amount of data. Hostinger may record these data in server logs.

These data serve to deliver the website and keep it secure, for example against attacks. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR; art. 7, IX LGPD). Our own code writes no logs and runs no analytics. Hostinger keeps these logs under its own retention rules, which it does not publish.

Wholesale inquiries and email

What we receive

When you send the wholesale inquiry form, we receive:

  • your company, country, name and email address
  • if you fill them in, your type of business, origins of interest and message
  • the lot button you used, if any, the page language and the page address
  • the date and time of sending

The form travels over HTTPS to a script on our hosting. The script sends it as one email to sales@caturracafe.com through Hostinger’s mail server and sets your address as the reply address. It keeps no copy of your inquiry and adds no IP address or browser data to the email. We send no confirmation email; a thank-you message appears on the page.

Against spam, the form contains an invisible field that people leave empty, and it requires a minimum time between loading the page and sending. This time is measured in your browser, sent with the form, checked by the script and not stored. To limit spam, the script also records the time of each email it sends, with no other data, so that it sends at most a few emails per minute and per day.

If you write to us directly, we receive your email address and your message.

Why we use these data

We use these data only to answer your inquiry and for the business correspondence that follows. If you ask for an offer for yourself, the legal basis is taking steps at your request before a contract (Art. 6(1)(b) GDPR; art. 7, V LGPD). If you write on behalf of a company, it is our legitimate interest in answering business inquiries (Art. 6(1)(f) GDPR; art. 7, IX LGPD). The required checkbox in the form only confirms that you have read this policy. It is not consent, and we do not rely on consent.

Which details are required

The form needs your company, country, name and email address, and the confirmation box, to send your inquiry. No law or contract obliges you to provide them. If you prefer not to use the form, you can write to sales@caturracafe.com instead.

How long we keep them

Inquiry emails and our replies are kept in the sales@caturracafe.com mailbox, which Hostinger hosts. If no business follows, we delete your inquiry and our replies 12 months after our last message. If business follows, we keep the correspondence while the business relationship lasts, and after that only as long as commercial or tax law requires. That retention is based on our legal obligation (Art. 6(1)(c) GDPR; art. 7, II LGPD).

When we exchange emails with you, Hostinger’s mail service also keeps delivery logs (time, sender, recipient and delivery status), which we can view for 30 days.

Your right to object to processing based on legitimate interests

Where we rely on our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time, on grounds relating to your particular situation (Art. 21 GDPR). This concerns the server logs described above and inquiries sent on behalf of a company. We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, write to sales@caturracafe.com.

Who receives your data

Inquiry emails are read by the Caturra Coffee team. Marco Rico, Founder, CEO & Sales Manager, answers wholesale inquiries.

Hostinger provides our web hosting, CDN and email and processes data on our behalf as a processor under its Data Processing Addendum. Hostinger lists its sub-processors in that addendum.

To answer your inquiry, we share your data with no one else, unless the law requires it. We do not sell your data and have no advertising partners.

International transfers

Hostinger operates data centres and CDN servers in several countries inside and outside the European Union and the European Economic Area (EU/EEA), so your data may be processed outside your country of origin. For countries without an adequacy decision of the European Commission, Hostinger uses the EU standard contractual clauses in its Data Processing Addendum; write to us for a copy. Our team may also read and answer inquiries from countries outside the EU/EEA.

Cookies, tracking and external services

Our website sets no cookies of its own, stores nothing in your browser and contains no analytics or tracking tools, advertising, social media plugins, maps, videos embedded from other platforms, third-party captcha or Google Fonts. Fonts, scripts, images and videos come from our own hosting; your browser contacts no third-party domain. Details, and one exception caused by Hostinger’s attack protection, are in our cookie policy.

Security

The website and the form use HTTPS, which encrypts data between your browser and our hosting.

Your rights

Under the GDPR, you can ask for access (Art. 15), correction (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and, where processing is automated and based on a contract or pre-contractual steps, data portability (Art. 20). You can also object, as described above (Art. 21).

Under the LGPD (art. 18), you can ask for:

  • confirmation that we process your data
  • access to your data
  • correction of incomplete, inaccurate or outdated data
  • anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data
  • portability of your data
  • information on whom we share your data with

You can also oppose processing that does not comply with the LGPD.

Write to sales@caturracafe.com; it is free of charge. We answer without undue delay and within one month. Under the LGPD, we confirm processing or give access in simplified form immediately, or in a complete statement within 15 days. We may ask you to confirm your identity first.

You can also complain to a supervisory authority, in particular in the EU/EEA country where you live or work or where the alleged infringement took place (Art. 77 GDPR); the European Data Protection Board lists them. Under the LGPD (art. 18, §1), you can petition the Brazilian National Data Protection Authority, ANPD.

Automated decisions

We make no automated decisions and do no profiling.

Children

This website is meant for businesses, not for children.

Changes to this policy

We update this policy when our website or processing changes; the date above shows the current version. Before we use your data for any other purpose, we will tell you.