Last updated: 23 September 2026
This policy explains what personal data the KôldBrue team collects through this website, why, and what your rights are.
The KôldBrue team. Email: info@kolddrinks.com.
When you join the waitlist (on the page or through the scratch card), we store your email address, your language, the date and time you signed up and confirmed, which form you used, whether you claimed the 2-can offer, and the consent text you were shown.
We use this to send you a confirmation email, to tell you when KôldBrue launches, to send occasional pre-launch news, and to honour the 2-can offer. You are only added once you click the link in the confirmation email (double opt-in); we keep that confirmation as proof of your consent.
Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every email or by writing to us — we then delete your email address.
If you use the retailer form, we store your venue name, your name, email address, city, venue type and message, to reply to you and talk about stocking KôldBrue.
Legal basis: steps prior to a possible contract and our legitimate interest in answering business enquiries (Art. 6(1)(b) and (f) GDPR).
When a form is sent, we keep a one-way scrambled (hashed) version of your IP address for a few minutes to limit repeated submissions by bots. We never store the IP address itself. Our hosting provider also keeps short-lived technical server logs.
Legal basis: our legitimate interest in keeping the site secure (Art. 6(1)(f) GDPR).
We use Vercel Web Analytics to count page views. It uses no cookies and does not follow you across other websites.
We set no cookies. Your browser's local storage keeps two small notes that never leave your device: your language choice and whether you have already closed the scratch card, so we don't show it again.
We work with these providers, who process data only on our instructions: Vercel Inc. (website hosting and analytics), Supabase Inc. (database, stored on servers in Ireland, EU) and Resend (sending emails).
Some of them are based in the USA. Transfers are covered by the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses. We never sell or rent your data.
Waitlist: until you unsubscribe, and at the latest 12 months after launch. Sign-ups that are never confirmed are deleted after 30 days.
Retailer enquiries: up to 24 months after our last contact. Hashed IP counters: deleted automatically as soon as they expire.
You have the right to access, correct, delete, restrict or export your data, to object to its use, and to withdraw consent at any time. Email info@kolddrinks.com and we will reply within one month.
You can also complain to a data protection authority — in Spain the AEPD (aepd.es), in Germany the authority of your federal state.
This site is not aimed at children. We do not knowingly collect data from anyone under 16.
If we change how we handle data, we update this page and the date at the top.