Skip to main content
Kapak Road
Legal

Privacy Policy

How we collect, use, and protect personal data across the markets we operate in — EU, UK, US, and Latin America.

Last updated: 9 July 2026

1. Who we are (Data Controller)

Kapak Road is a trade name of Schram Ventures, registered with the Dutch Chamber of Commerce (KvK) under number 42068173, with its registered office at Terschellingsestraat 10a, 3083 PL Rotterdam, The Netherlands.

For any privacy-related question, contact privacy@kapakroad.com.

2. Scope

This Policy applies to personal data we process through www.kapakroad.com, our forms, our email correspondence, and any related sourcing activities. It is written to meet, at minimum, the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR & Data Protection Act 2018, the California Consumer Privacy Act as amended by the CPRA, Brazil's LGPD, and Peru's Ley de Protección de Datos Personales (Law No. 29733).

3. What we collect

  • Identification & contact: name, company, role, country, email, phone/WhatsApp.
  • Sourcing context: buyer or supplier type, product interest, volumes, Incoterms, documentation needs.
  • Messages: anything you send us in a form field or by email.
  • Technical: IP address, browser, device type, referring page, UTM parameters, pages viewed.
  • Consent state: your cookie preferences and marketing opt-ins.

We do not collect special-category data (health, political, biometric). Please don't include it in messages.

4. Why we use it (purposes & legal bases)

  • Respond to your request — quote, sample, sourcing brief, partner interest. Legal basis: performance of a contract or pre-contractual steps (GDPR Art. 6(1)(b)).
  • Operate our sourcing platform — verify partners, coordinate lots, keep records. Legal basis: legitimate interests (Art. 6(1)(f)).
  • Send offer updates and sourcing alerts — only if you opt in. Legal basis: consent (Art. 6(1)(a)); withdrawable at any time.
  • Meet legal obligations — accounting, tax, EUDR due-diligence records, sanctions screening. Legal basis: legal obligation (Art. 6(1)(c)).
  • Improve the site — aggregated analytics if you allow analytics cookies. Legal basis: consent.

5. Who we share it with

We share personal data only with parties we need to operate the service:

  • Hosting & site infrastructure providers (EU / EEA).
  • Transactional email provider used to reply to your request.
  • Origin partners, only where necessary to progress your specific request (never for marketing).
  • Professional advisers (legal, accounting), banks, and authorities where required by law.

We never sell personal data, and we never share it for cross-context behavioural advertising.

6. International transfers

Where personal data leaves the EEA / UK (for example, when we correspond with partners in Peru, Indonesia, or Ethiopia), transfers rely on the European Commission's Standard Contractual Clauses, the UK IDTA, or an adequacy decision. We limit transfers to what is strictly needed to progress your request.

7. How long we keep it

  • Form submissions and correspondence: up to 36 months after the last interaction, unless a longer period is required by law.
  • Contractual and accounting records: 7 years (Dutch statutory retention).
  • EUDR due-diligence statements and evidence: 5 years (Regulation (EU) 2023/1115, Art. 12(3)).
  • Cookie consent records: 12 months or until you change them.

8. Your rights

Depending on where you live, you have the right to:

  • Access the personal data we hold about you.
  • Ask us to correct or delete it.
  • Restrict or object to processing, and withdraw consent at any time.
  • Receive your data in a portable format.
  • Not be subject to solely automated decisions (we do not use them).
  • California residents (CCPA/CPRA): right to know, delete, correct, limit use of sensitive data, and opt out of "sharing"/"selling" — we do neither. You may designate an authorised agent.
  • Brazil (LGPD): rights under Art. 18, including confirmation, access, correction, anonymisation, portability, and information about shared parties.
  • Peru (LPDP, Law 29733): ARCO rights — Access, Rectification, Cancellation, Opposition.

To exercise any right, email privacy@kapakroad.com. We reply within 30 days.

You also have the right to complain to a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.

9. Security

We use TLS in transit, access controls, and least-privilege for staff. No online service is 100% secure — please avoid sending confidential documents via email; ask us for a secure link instead.

10. Cookies

See our Cookie Policy for the categories we use and how to change your preferences.

11. Children

The site is intended for business users. We do not knowingly collect personal data from anyone under 16.

12. Changes

We may update this Policy. The "Last updated" date at the top always reflects the current version.