PRIVACY AND DATA PROTECTION POLICY

Last updated: August 7, 2026

PRIVACY AND DATA PROTECTION POLICY

This Privacy Policy (hereinafter referred to as the "Policy") defines the procedure for the collection, processing, storage, and protection of personal and corporate data of retail buyers, international B2B counterparties, and visitors (hereinafter referred to as the "User", "Client") who use the official web resource of GS COFFEE (hereinafter referred to as the "Company"), accessible at gscoffee.cr.

The Company operates in strict compliance with applicable legislation: the Law of Costa Rica on the Protection of Individuals regarding the Processing of their Personal Data (Ley № 8968), international cross-border trade regulations, and GDPR principles (when processing data of retail and wholesale clients from European Union countries).

1. LEGAL STATUS OF THE DATA CONTROLLER

The web resource gscoffee.cr is administered by the Costa Rican export company Second February Limitada (official legal form: S.R.L. / Sociedad de Responsabilidad Limitada, registered under ID number: 3-102-962172). The Company acts as the leading Data Controller and guarantees the confidentiality of Client data in both the retail (B2C) and international export (B2B) segments.

2. CATEGORIES OF COLLECTED DATA AND PURPOSES OF PROCESSING

The collection of data is strictly limited to the purposes of ensuring retail sales, customer support, and fulfilling international export procedures, including cross-border logistics.

The Company processes the following categories of data:

• For retail buyers (B2C): first name, last name, shipping address for packages, email address, contact phone number, and history of retail orders for roasted coffee. The Company does not collect or store payment card data — all transactions are processed directly by certified international payment gateways (PCI DSS standard).
• For international counterparties (B2B): the official name of the legal entity, company registration number (Tax ID / VAT), address of the roasting facility/warehouses, name of the authorized manager or roasting technician, and data on planned volumes of raw material procurement (within the framework of legitimate commercial interest for planning pre-export contracts).
• Digital traceability data (QR services): when scanning the unique QR codes of export lots and retail packaging, the Platform may process anonymized technical data solely for the purposes of protecting the system against falsifications, conducting supply chain analytics, and recording the geography of micro-lot consumption.
• Automatically collected data: cookies and technical session identifiers (solely to ensure the correct operation of the Platform's multilingual interface, maintain the shopping cart, and protect the web resource against cyberattacks).

3. LEGAL BASIS FOR PROCESSING

The processing of Client data is carried out based on the following criteria:

1. Performance of obligations under retail sales and B2B contracts: dispatch of coffee bags by postal services to retail clients, formation of export commercial offers, invoices, phytosanitary certificates, and the organization of logistics corridors (FOB/CIF).
2. Legitimate interest of the Company: sending official laboratory cupping results according to the SCA scale, notifications about fresh crop harvests, information on the dispatch of green coffee test samples, or the status of retail delivery.
3. Consent of the User: upon registering an account on the Platform, placing an order through the shopping cart, subscribing to the newsletter, or filling out feedback forms.

4. CONFIDENTIALITY AND DATA SHARING WITH THIRD PARTIES

The Company guarantees that the collected data is never sold to third parties for marketing purposes. Data transfer is limited exclusively to authorized participants in the fulfillment process:

• International retail postal and courier services for delivering coffee packages "to the door."
• Accredited customs brokers, logistics operators, and transport companies for organizing the cross-border delivery of retail packages, wholesale B2B raw material lots, and the transportation of lots.
• Official state and regulatory institutions (including ICAFE — the Coffee Institute of Costa Rica, and PROCOMER — the Foreign Trade Corporation of Costa Rica) within the framework of mandatory licensing procedures, registration of export declarations, and the clearance of phytosanitary and customs documentation.

5. DATA RETENTION PERIOD

Data of retail clients is stored for the duration of their account's activity or for the periods prescribed by consumer protection legislation. Corporate and contact data of buyers and B2B counterparties is stored throughout the entire period of active commercial interaction, as well as for the periods established by international tax and customs legislation for the retention of B2B documentation (from 5 to 10 years).

6. DATA SECURITY AND PROTECTION

The Company implements advanced security measures:

• Encryption of communication channels (SSL/TLS protocols) when exchanging data via digital QR passports and placing retail orders.
• Restriction of access to the databases of counterparties and retail buyers — access is granted only to authorized personnel of the Company.
• A policy of strict non-disclosure (NDA) regarding contract prices, recipes, and individual roast profiles (Roast Profile Response) of our B2B partners.

7. RIGHTS OF USERS

Every retail buyer, international B2B client, and visitor to the platform has the right to:

• Request confirmation of the fact that their data is being processed and obtain a copy thereof.
• Request the correction of inaccurate or outdated data (delivery addresses, company credentials).
• Withdraw consent for processing or request the complete erasure of data from the Company's databases (provided this does not prevent the fulfillment of current customs, tax, or warranty obligations under open orders).

To exercise their rights, the Client may submit an official request to the following address: sales@gscoffee.cr.

8. CHANGES TO THE POLICY

The Company reserves the right to modify the terms of this Policy in the event of the modernization of cross-border trade rules, changes in consumer protection laws, or updates to the website's functionality. The current version is always published on this page.