PRIVACY POLICY

1. PURPOSE OF THIS POLICY

This policy explains which personal data is processed when you browse www.kaneoriginal.com and use the Contact and Become a Partner forms, for what purposes, and whom you can contact to exercise your rights.

The website presents the Kane Original hibiscus drink. It offers no user accounts, online purchases or payments. The processing described below concerns browsing, enquiries received and their follow-up.

We process personal data in accordance with the Swiss Federal Act on Data Protection of 25 September 2020 (FADP; SR 235.1) and its implementing provisions, insofar as they apply.

2. DATA CONTROLLER

The data controller is:

Don Lamino Group (DLG) Sàrl
UID: CHE-270.508.210
Commercial register reference: CH-660.0.169.026-2
Chemin De-Maisonneuve 12 b
1219 Châtelaine, Geneva, Switzerland
Email: info@kaneoriginal.com.

You can use this address to ask questions about your data or request to exercise a right. No registration on the website is necessary to contact us.

3. DATA CONCERNED AND ITS SOURCE

Personal data is information relating to an identified or identifiable individual. For professional enquiries, the contact person’s details constitute personal data even when the enquiry is made on behalf of a company.

We receive data primarily when you complete a form or email us. Other data is processed when you connect to the servers needed to display and secure the website.

The website has no field intended to collect a payment card number, customer account password or identity document for making a purchase.

Please limit your messages to information necessary for your enquiry. Avoid sending sensitive information, including medical information, or information about other people that is not useful to the conversation.

4. CONTACT FORM

We process the information you enter in the form, including your name, email address, the subject of your enquiry and the content of your message. A telephone number or other information is processed if you choose to provide it.

We use this information to identify your enquiry, reply to you, provide the details you request and follow up on the conversation. It may also help us understand and resolve an issue relating to the website or drink.

Required fields are identified in the form. Other fields are optional. If you do not provide the contact details needed for a reply, we may be unable to deal with your enquiry effectively.

5. BECOME A PARTNER FORM

We process the contact person’s details and information provided about their establishment, business, location and project. This may include anticipated quantities and supply requirements if you specify them.

We use this information to assess your enquiry, present the drink and reseller packs, prepare a proposal, arrange a discussion and follow up on the business conversations you have initiated.

Providing this data does not oblige you to place an order. Estimated quantities and stated intentions remain matters for discussion until a business agreement has been concluded.

If a business relationship is subsequently established, we may request additional data needed to manage it. We provide any further information required if processing goes beyond what is described in this policy.

6. WEBSITE CONNECTION AND TECHNICAL DATA

Displaying the website requires exchanges with the servers that host and protect it. These exchanges include processing the IP address needed to send responses to your device.

Cloudflare processes the technical data needed to connect to and protect the website, including IP addresses, routing information and connection configuration. DLG does not implement additional application-level logging of visits. The provider’s processing is described in its privacy policy.

Technical data is used to keep the website functioning, diagnose errors, detect abusive requests and maintain the security of forms and infrastructure.

Technical security logging is distinct from individual tracking for advertising or audience measurement. Cookies and other mechanisms on visitors’ devices are described in the cookie policy.

7. PURPOSES AND PROCESSING PRINCIPLES

We limit processing to the information necessary to respond to enquiries, prepare the requested business discussions, maintain the website and fulfil our legal obligations.

Data is not used in a way incompatible with the stated purposes. You can tell us if information is inaccurate or needs updating.

We do not sell the data we receive. Submitting a form does not constitute a newsletter subscription or agreement to receive advertising campaigns.

The website configuration does not include advertising tracking or audience measurement tools based on tracking individual visitors. We do not build behavioural profiles from their browsing.

We do not make automated individual decisions that have legal effects on you or significantly affect you in the context of the processing described here.

If separate processing requires consent, it is requested for its specific purpose. Reading this policy does not constitute general consent to all processing.

8. AUTHORISED PERSONS AND SERVICE PROVIDERS

Within DLG, access to data is limited to people who need it to handle enquiries, conduct discussions and administer the relevant services.

Service providers may act as processors for hosting, form transmission, email, maintenance, security or backups. We establish arrangements for these services so that processing follows our instructions and applicable requirements.

The providers actually used are:

A. Hosting, infrastructure and website protection
Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States.
Service: Cloudflare Pages and content delivery network, serving website files and securing connections.
The network is international; processing is not limited to Switzerland. The countries and parties involved are presented in Cloudflare’s sub-processor list.

B. Contact and partnership enquiries
Messages received are managed by Don Lamino Group (DLG) Sàrl in its Infomaniak business email service. The website does not have a database intended to retain the content of these messages.

Form transmission and protection. Resend (Plus Five Five, Inc.) processes sender and recipient addresses and the message content to deliver it to the Infomaniak inbox. Its technical records follow the service’s retention policy. See Resend’s privacy policy and data processing addendum. Google reCAPTCHA checks submissions for abuse; connection and browser data are sent to Google for that purpose. These services may involve processing outside Switzerland, including in the United States. See Google’s privacy policy. Cloudflare D1 stores rotating request counters salted and hashed with a secret in the European Union, without names, email addresses or message content. They expire after 20 minutes and are removed during subsequent submissions; technical copies follow the provider’s backup cycle.

C. Business email
Provider: Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias, Geneva, Switzerland.
Role: receiving, retaining and sending messages.
Email and its backups are hosted in Switzerland and managed by DLG. Further information: Infomaniak’s privacy policy.

D. Maintenance and backups
DLG manages its inbox and access to messages. Cloudflare provides website hosting and protection; Infomaniak provides the technical email services. Website file backups are separate from messages received in the business inbox.

Information may also be disclosed to an authority where required by law, or to authorised parties where necessary to establish, exercise or defend a right. These disclosures remain limited to their purpose and to the necessary data.

9. PROCESSING AND ACCESS FROM ABROAD

The countries involved in storage and provider access are listed in section 8. Remote access by a provider based abroad must also be taken into account.

For disclosures abroad, we comply with the conditions in Articles 16 and 17 FADP. Depending on the country and circumstances, protection may result from recognition of an adequate level of protection by the Federal Council, appropriate safeguards or a legally applicable exception.

Email is hosted in Switzerland by Infomaniak. Using Cloudflare involves processing in the United States and the countries of its network and sub-processors. Safeguards for transfers are described in Cloudflare’s data processing addendum, including recognised transfer mechanisms and standard contractual clauses adapted for Switzerland where necessary.

10. RETENTION PERIODS

We retain data for a period proportionate to its usefulness and the purpose for which it was collected.

For contact enquiries, retention covers handling the enquiry and useful follow-up. For partnership enquiries, it covers the discussions initiated and the period during which a reply or follow-up can reasonably be expected.

Enquiries are retained while they are being processed and for as long as follow-up remains necessary. An enquiry is closed when a response has been provided and no useful action or discussion remains ongoing. Messages are then deleted or anonymised when they are no longer needed for follow-up, a contractual relationship, the defence of rights or a legal obligation. These criteria apply to ordinary enquiries and partnership discussions.

DLG does not set an additional retention period for visit logs it does not collect itself. Retention of technical data processed by Cloudflare depends on operational needs, security and applicable obligations, under the criteria in its privacy policy.

Where a statutory retention obligation applies or certain information must be preserved for existing or reasonably foreseeable litigation, only the necessary data is retained for the justified period. The retention period for an accounting document does not automatically extend to all contact messages.

Deleting a message from the active inbox does not instantly delete every technical copy. Email backups follow the renewal cycle of the Infomaniak service used and are not used for routine operations. Recovery options depend on the plan and are described in the provider’s documentation. DLG takes deletion requests into account when restoring a backup.

At the end of the applicable periods, data is deleted or appropriately anonymised.

11. DATA SECURITY

We implement technical and organisational measures appropriate to the nature of the data and the risks of processing. These include access permissions, transmission security, protection of the accounts used by the team and administration of technical services.

Authorised people and providers access data only in the course of their duties. The security of communications also depends on the tools used by the sender; forms and emails must not be used to transmit secrets or sensitive documents that are unnecessary for the enquiry.

In the event of a data security breach, we assess the measures needed and make the notifications and disclosures required by law when the relevant conditions are met.

12. COOKIES AND EXTERNAL LINKS

The cookie policy specifies whether the website uses essential cookies or operates without cookies, and the consequences of blocking them.

If you follow a link to an external website, processing by its operator is governed by its own privacy policy. This includes the link to Alive Studio’s website.

13. YOUR RIGHTS

Subject to the conditions and limits of the FADP, you can:

• ask whether personal data concerning you is processed and obtain the information required by law;
• have inaccurate data corrected;
• request deletion of data or prohibition of processing in the cases provided by law;
• express your objection to processing;
• request delivery or transfer of data you have provided where the statutory conditions for portability are met;
• withdraw, with future effect, consent on which processing is based.

The exercise of these rights may be subject to statutory restrictions, including where retention obligations or overriding rights prevent it. We assess each request according to its scope and applicable rules.

14. EXERCISING YOUR RIGHTS AND SUPERVISORY AUTHORITY

You can email info@kaneoriginal.com or send your request to the data controller’s postal address stated in section 2.

Describe the right you wish to exercise and provide information that helps us locate the relevant data. We may request additional information strictly necessary to verify your identity and avoid disclosure to an unauthorised person.

Access requests are generally handled free of charge within 30 days. If an extension, restriction or contribution to costs is legally justified, we inform you in accordance with applicable rules.

You can report a possible data protection violation to the Federal Data Protection and Information Commissioner (FDPIC), whose contact details and information are available at www.edoeb.admin.ch. Statutory legal remedies remain available.

15. CHANGES TO THIS POLICY

This policy is updated when processing, providers or website features change. The version date identifies the current text.

An update does not, in itself, constitute consent to new processing. Where the law requires specific information or a prior choice, we provide it before the relevant processing begins.