Privacy Policy

1. Data Controller

The data controller responsible for personal data collected on kaveau.co is:

WL Group Management Consultancy L.L.C-FZ
Meydan Grandstand, 6th Floor, Dubai, United Arab Emirates
legal@w-l.group

See the Legal Notice on this site for full company identification details.

EU representative under GDPR Article 27: GRACE srl, Lamezia Terme (CZ), Italy. Contact: legal@w-l.group.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you may address all data protection matters to either the data controller or the EU representative.

2. What We Collect, Why, and on What Legal Basis

We collect personal data only when you actively interact with the site. We do not track passive visitors.

Contact form. When you submit the contact form on the /contact page, we receive your name, your email address, the business website or LinkedIn profile you provide, and the message you write describing what you are trying to fix or build. If you choose to answer the optional questions, we also receive the stage of your business, your geographic footprint, and how you would prefer to work with us. We use this information to evaluate whether there is a potential fit, reply to your inquiry, and, if relevant, schedule a call, send you a short written summary of what we heard and where we would start, and prepare a proposal.

• Legal basis: consent (Article 6(1)(a) GDPR) at the point of submission, and the pre-contractual steps you request (Article 6(1)(b) GDPR) when those steps concern a possible engagement with Kaveau.
• Retention: up to 24 months from your last interaction with us, then deletion. If we open an engagement, your contact data is retained for the duration of that engagement and for as long as required by applicable law thereafter.

Call booking via Calendly. When you book a call from the site, you do so directly on Calendly's platform. Calendly receives your name, email address, and the time slot you select. We receive the same information through Calendly to prepare for and attend the call. We do not receive any data from Calendly beyond what you enter during booking.

• Legal basis: pre-contractual steps at your request (Article 6(1)(b) GDPR).
• Retention: as described for the contact form above.

Analytics. Not active at the effective date of this policy. The site is prepared to use Plausible Analytics, a cookieless, privacy-first tool hosted within the European Union, but no analytics account is collecting data at the effective date of this policy. If and when analytics is activated, this policy will be updated before any data starts flowing. Plausible does not use cookies, does not fingerprint browsers, and does not track individual visitors across sessions or across other websites; the statistics it produces are fully aggregated and anonymous.

• Legal basis, if and when activated: legitimate interest (Article 6(1)(f) GDPR) in understanding how the site is used and where it can be improved.
• Retention: no individual-level data would ever be collected.

Newsletter. Not active at the effective date of this policy. If and when we launch a newsletter, it will run on Kit (United States) and this policy will be updated, including the safeguards for the transfer, before any address is collected.

What we do not do. We do not use advertising cookies, targeted advertising, or third-party tracking pixels. We do not sell, rent, or trade personal data with any party for commercial purposes. We do not build profiles of site visitors.

3. Cookies

A cookie is a small text file placed on your device by a website. kaveau.co does not use non-essential cookies. The site does not set advertising cookies, social media tracking cookies, or analytics cookies that identify individual users. The only cookies that may be present are those strictly necessary for the site to function, such as those required to maintain a session or process a form submission. Because no non-essential cookies are used, no cookie consent banner is displayed on this site. If we introduce any tool that requires non-essential cookies in the future, we will update this policy and implement a consent mechanism before setting any new cookies. For a detailed breakdown, see the Cookie Policy on this site.

4. Who We Share Your Data With

We use a small number of third-party service providers (processors) to operate this site. Each active processor operates under a data processing agreement and may only use your data for the specific service it provides to us.

• Calendly (United States): call scheduling. See their privacy policy at calendly.com/privacy.
• Lovable (see their privacy policy for company and hosting details): website hosting and delivery. See lovable.dev/privacy.

Future processors, which will be covered by a data processing agreement and added to this policy by an update if and when activated:

• Plausible (European Union): anonymous site analytics, not active at the effective date of this policy. See plausible.io/privacy.
• Kit (United States): newsletter delivery, if and when a newsletter is launched. See kit.com/privacy.

We do not share your data with any other party outside this list, except in the following limited circumstances: to comply with a legal obligation or court order; to protect the rights, property, or safety of Kaveau, our clients, or others; or in connection with a business transfer such as a merger or acquisition, where the acquiring party is bound to uphold the same privacy commitments.

5. How Long We Keep Your Data

• Contact form and call booking data: up to 24 months from last interaction, or for the duration of a client engagement.
• Analytics and newsletter: not active at the effective date of this policy. Retention terms will be added here if and when those tools are activated.

When a retention period expires, data is deleted or anonymised so that it can no longer be linked to an individual.

6. International Transfers

WL Group Management Consultancy L.L.C-FZ is incorporated in the United Arab Emirates, a third country outside the European Economic Area without an adequacy decision under Article 45 GDPR. Calendly is based in the United States, which also does not have a general adequacy decision as of the effective date of this policy.

Transfers of personal data to WL Group Management Consultancy L.L.C-FZ and to Calendly are protected by the European Commission's Standard Contractual Clauses set out in Implementing Decision (EU) 2021/914. These clauses impose binding obligations on both parties to protect your data to European standards. We have also implemented additional technical and organisational measures appropriate to the nature and volume of the data we process.

Lovable, which hosts and delivers this website, does not conclusively state its hosting location in its public privacy policy. That policy contemplates transfers to the United States protected by the same Standard Contractual Clauses; see their privacy policy for details.

Plausible is based in the European Union; if and when analytics is activated, no international transfer would take place for data processed by Plausible. If and when we launch a newsletter on Kit (United States), the safeguards for that transfer will be described in this policy before any address is collected.

7. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals, as described in Article 22 GDPR. All decisions relating to potential client engagements are made directly by the founders of Kaveau.

8. Your Rights

If GDPR applies to your data (you are in the EEA, the UK, or Switzerland, or our processing is directed at you there), you have the following rights. These rights are not absolute and are subject to the conditions and exceptions set out in applicable data protection law.

• Right of access: ask us to confirm whether we hold personal data about you and, if so, to provide you with a copy.
• Right to rectification: ask us to correct inaccurate data or to complete incomplete data.
• Right to erasure: ask us to delete your personal data. This applies in certain circumstances, such as where the data is no longer needed for the purpose it was collected, or where you withdraw consent.
• Right to restriction: ask us to limit the processing of your data in certain situations, for example while we verify a rectification request.
• Right to object: where we process your data on the basis of legitimate interest, object to that processing at any time. We will stop unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to data portability: where processing is based on consent or a contract and is carried out by automated means, ask us to provide your data in a structured, commonly used, machine-readable format.
• Right to withdraw consent: withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, write to legal@w-l.group. We may ask you to verify your identity before responding. We will respond within one calendar month, or inform you within that period if we need up to two additional months due to complexity.

We do not charge a fee for handling rights requests unless the request is clearly unreasonable.

9. Right to Lodge a Complaint

If you believe we have handled your personal data incorrectly, you have the right to lodge a complaint with a data protection supervisory authority. You may contact the authority in the country where you live, where you work, or where the alleged issue occurred. In Italy, the supervisory authority is the Garante per la protezione dei dati personali (garanteprivacy.it). A list of all EEA supervisory authorities is available at edpb.europa.eu.

We would appreciate the opportunity to address your concern directly before you contact a supervisory authority. Please write to us first at legal@w-l.group.

10. Security

We take reasonable technical and organisational steps to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction. Measures in place include encrypted connections (HTTPS) for all data in transit, restricted internal access to personal data, use of EU-hosted processors where possible, and a minimal data collection approach. We do not collect data we do not need.

We require our processors to maintain security standards appropriate to the data they handle on our behalf.

No method of transmission or storage is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where possible, within 72 hours. Where the breach is likely to result in a high risk to individuals, we will also notify the affected individuals directly.

11. Children

kaveau.co is a business-to-business website directed at business professionals. We do not knowingly collect personal data from individuals under the age of 16. If we become aware that a child under 16 has provided personal data to us, we will delete it promptly. If you believe this has happened, write to legal@w-l.group.

12. Changes to This Policy

We may update this policy to reflect changes in our practices, tools, or applicable law. The effective date at the top of the page shows the date of the most recent revision. If we make material changes, we will post a notice on the site at least 30 days before they take effect. Continued use of the site after the effective date of an update constitutes acceptance of the revised policy.

13. Contact

For any privacy matter:

• Data controller: WL Group Management Consultancy L.L.C-FZ, legal@w-l.group
• EU representative under Article 27 GDPR: GRACE srl, Lamezia Terme (CZ), Italy, legal@w-l.group