SUPERKAWA — GLOBAL PRIVACY POLICY

International — V0.5 Status: BASELINE STABLE Candidate for professional legal review — not yet publication-final

Based on:

• GLOBAL_PRIVACY_POLICY_V0.4.md
• frozen baseline commit 2607656abb74d91e3bc383d96bbb81d6bbce0579

This working revision carries forward only the provider-fact updates and wording-precision fixes reviewed this session; no substantive legal clause was altered beyond those provider-fact sections. GLOBAL_PRIVACY_POLICY_V0.4.md remains the frozen baseline and is not modified by this file.

Effective date: [TO VERIFY]

This Privacy Policy explains how SUPERKAWA SUPPLY LTD, a private limited company incorporated in England and Wales under company number 17145664, with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("SUPERKAWA", "we", "us" or "our"), processes Personal Data.

This Privacy Policy is intended initially for users and Merchants in:

• the United Kingdom;
• France;
• the European Economic Area;
• Canada excluding Québec;
• the United States.

Québec is outside the initial launch scope.

1. Scope of this Privacy Policy

SUPERKAWA operates a SaaS platform used by Merchants for functions including:

• point-of-sale and order management;
• menus and products;
• customer loyalty;
• Store-specific Wallet ledger functionality;
• customer reviews;
• staff administration;
• analytics;
• customer communications;
• support;
• AI-assisted features.

SUPERKAWA may process Personal Data in two different capacities depending on the activity:

• as an independent Controller for its own business purposes; or
• as a Processor / Service Provider acting on behalf of a Merchant.

This distinction is important because, for some data, the Merchant — not SUPERKAWA — determines the purpose of the Processing.

2. When SUPERKAWA acts as Controller

SUPERKAWA generally acts as an independent Controller where it determines the purposes and essential means of Processing.

This may include:

• administration of SUPERKAWA accounts;
• Merchant subscription management;
• SUPERKAWA SaaS billing;
• corporate communications;
• SUPERKAWA's own marketing;
• fraud prevention;
• security monitoring;
• service integrity;
• operational telemetry;
• certain support activities;
• legal and regulatory compliance;
• internal business administration;
• Merchant prospecting and sales activity.

Where SUPERKAWA acts as Controller, this Privacy Policy applies directly to that Processing.

3. When SUPERKAWA acts on behalf of a Merchant

For many customer-facing activities, the Merchant generally determines why Personal Data is processed.

This may include:

• customer orders;
• loyalty programmes;
• rewards;
• reviews;
• Store Wallet records;
• customer communications;
• customer-facing Merchant activity;
• staff use of customer information.

For such Processing, the Merchant generally acts as the Controller, and SUPERKAWA acts as its Processor / Service Provider.

If you are a customer of a Merchant and your request concerns data controlled by that Merchant, you may need to contact the Merchant directly.

SUPERKAWA will assist the Merchant where required under applicable data-protection law and its Data Processing Agreement.

4. Personal Data we may process

Depending on how the Services are used, we may process the following categories of Personal Data.

4.1 Identification and contact information

This may include:

• name;
• email address;
• telephone number;
• internal customer identifier;
• Merchant, Organisation or Store identifiers.

4.2 Account and authentication information

This may include:

• account status;
• role;
• username;
• authentication metadata;
• verification status;
• temporary OTP-related records;
• login timestamps;
• account-creation timestamps;
• deletion or deactivation status.

4.3 Merchant and business information

This may include:

• business name;
• Store details;
• business contact information;
• billing information;
• business registration information;
• VAT identifiers;
• SIREN/SIRET or similar business identifiers where applicable.

4.4 Order and transaction information

This may include:

• order details;
• products ordered;
• order amounts;
• timestamps;
• delivery or billing information associated with an order;
• transaction references;
• fiscal transaction records where applicable.

4.5 Loyalty and rewards information

This may include:

• loyalty balances;
• points history;
• redemptions;
• rewards activity.

4.6 Wallet ledger information

SUPERKAWA may process Store-specific Wallet ledger records, including:

• credits;
• debits;
• balances;
• transaction references;
• associated Store identifiers.

The SUPERKAWA Wallet is a software ledger.

SUPERKAWA does not receive, hold, safeguard, commingle or transmit customer funds represented by Wallet balances.

For cash recharges, the Merchant receives the cash directly.

SUPERKAWA does not require payment-card or bank-account information for a cash Wallet recharge.

4.7 Reviews and customer-generated content

This may include:

• ratings;
• comments;
• review timestamps;
• relevant Store or order references.

4.8 Technical and security information

This may include:

• IP addresses used for authentication or security;
• security-event metadata;
• device/browser information where technically available;
• logs;
• timestamps;
• authentication-attempt information;
• service-performance information.

4.9 Support information

If you contact support or use an enabled support feature, we may process the information you voluntarily provide.

The current SUPERKAWA AI support implementation does not maintain a persistent conversation history within SUPERKAWA.

4.10 Marketing and prospect information

Where SUPERKAWA conducts its own business-development or marketing activities, it may process information relating to current or prospective Merchants, including:

• business contact details;
• lead information;
• sales notes;
• business relationship information.

Where such information is obtained from a source other than the prospective Merchant directly — for example public business registries, professional networking platforms or referrals — SUPERKAWA will process it in accordance with Article 14 GDPR, including information about the source of that data where required.

5. Information we do not intentionally require

The standard SUPERKAWA Services do not intentionally require the submission of:

• health data;
• biometric data;
• genetic data;
• information revealing race or ethnic origin;
• political opinions;
• trade-union membership;
• religious or philosophical beliefs;
• sexual orientation or sex-life data;
• government authentication credentials;
• full payment-card credentials for Wallet cash recharges.

Users and Merchants should avoid submitting such information unless expressly requested through a feature that lawfully supports it.

6. How we use Personal Data

Depending on whether SUPERKAWA acts as Controller or Processor, Personal Data may be used to:

• provide and operate the Services;
• administer accounts;
• process Merchant subscriptions;
• support users;
• process customer orders;
• operate POS and KDS functionality;
• maintain loyalty and reward records;
• maintain Store Wallet ledger records;
• display reviews;
• provide Merchant analytics;
• manage customer communications;
• authenticate users;
• detect misuse or fraud;
• maintain security;
• troubleshoot and improve service performance;
• comply with legal obligations;
• establish, exercise or defend legal claims;
• manage SUPERKAWA's own business operations;
• communicate with prospective or existing Merchants.

7. Legal bases for Processing

Where UK GDPR or EU GDPR applies and SUPERKAWA acts as Controller, we may rely on legal bases including:

7.1 Performance of a contract

We may process Personal Data where necessary to:

• create or administer an account;
• provide subscribed Services;
• manage billing;
• respond to contractual requests.

7.2 Legitimate interests

We may process Personal Data where necessary for legitimate interests including:

• fraud prevention;
• security;
• service integrity;
• troubleshooting;
• product administration;
• business operations;
• B2B communications;
• improving service reliability.

We will consider the impact on individuals before relying on legitimate interests.

7.3 Legal obligations

We may process or retain Personal Data where necessary to comply with:

• tax law;
• accounting requirements;
• regulatory requirements;
• legal process;
• other applicable legal obligations.

7.4 Consent

Where required by law, we may rely on consent, including for:

• certain analytics or cookies;
• certain marketing communications;
• other optional Processing.

Where Processing is based on consent, you may withdraw consent subject to applicable law.

8. Merchant-controlled Processing

For Processing where the Merchant acts as Controller, the Merchant is responsible for determining:

• the lawful basis;
• appropriate transparency notices;
• retention periods;
• customer communications;
• responses to applicable privacy-rights requests.

SUPERKAWA processes such Personal Data according to the Merchant's lawful instructions and the applicable Data Processing Agreement.

9. Wallet and payment information

The Store Wallet is a Merchant-directed software ledger.

SUPERKAWA does not operate the Wallet as a customer bank account or general-purpose payment account.

SUPERKAWA does not receive, hold, safeguard, commingle or transfer customer funds corresponding to Wallet balances.

Where a customer pays cash to a Merchant for a Wallet credit:

• the Merchant receives the money directly;
• Merchant staff may record a corresponding Wallet credit;
• SUPERKAWA records the ledger entry technically.

SUPERKAWA uses Stripe separately for its own SaaS subscription billing to Merchants.

SUPERKAWA does not use Stripe to receive Wallet cash-recharge funds.

10. Artificial intelligence

SUPERKAWA may provide AI-assisted support or content-generation functionality.

Current technical controls are designed so that structured customer datasets such as:

• customer identity records;
• orders;
• Wallet datasets;
• loyalty datasets

are not automatically sent to the AI provider through the current AI support request schema.

However, free-text fields may contain Personal Data entered voluntarily by a user.

SUPERKAWA does not therefore guarantee that free-text prompts are always free of Personal Data.

The current SUPERKAWA code does not make training or fine-tuning calls using Merchant Customer Data.

The AI provider's own retention, model-improvement, logging or training practices depend on the contractual terms applicable to that provider.

SUPERKAWA will not represent an AI provider as contractually "no training" unless that position has been verified for the actual service, account and agreement used.

Where an AI-assisted feature is designed to interact directly with a user (for example AI-assisted support), SUPERKAWA will ensure that the user is informed, clearly and without ambiguity, that they are interacting with an AI system, no later than the time of the first such interaction, in accordance with Article 50 of the EU AI Act and equivalent applicable law. This disclosure obligation applies regardless of whether the interaction takes place in a Merchant-facing or customer-facing context.

11. Analytics and cookies

SUPERKAWA may use analytics technologies on public marketing properties.

Where required, non-essential analytics will be subject to consent.

Non-essential cookies or similar technologies will not be set before the required consent has been obtained.

The current technical implementation includes Google Analytics 4 on the public marketing site subject to consent.

Authenticated application areas may use different technical telemetry and security logging.

A separate Cookie Policy will explain:

• cookies and similar technologies used;
• provider;
• purpose;
• duration;
• whether consent is required;
• how consent can be changed.

[TO VERIFY — FINAL COOKIE INVENTORY / CMP]

12. Who we share Personal Data with

We may share Personal Data with providers that support the operation of SUPERKAWA, such as:

• hosting providers;
• database providers;
• transactional email providers;
• billing providers;
• communications providers;
• media/storage providers;
• analytics providers;
• AI providers;
• professional advisers;
• public authorities where legally required.

Providers processing Personal Data on behalf of SUPERKAWA will be subject to appropriate contractual safeguards where required.

The final active provider list will be maintained in the SUPERKAWA Sub-processor List where applicable.

We will not describe a provider as active merely because an optional or legacy integration exists in our codebase.

13. Current provider inventory

The final publication list remains subject to operational verification.

Current technical work indicates that providers to assess include:

• MongoDB / Atlas — production cluster deployment region confirmed as AWS Paris (eu-west-3, EU) (a technical account-configuration fact, not a legal data-residency determination); Free tier; backups currently inactive;
• Render — Static frontend (Starter plan) and Python backend Web Service (Starter plan, region confirmed Frankfurt, EU);
• Resend;
• Stripe;
• Google Analytics 4;
• Mistral AI — Free plan; Mistral's platform-level "API training / use for model improvement" and "Labs" toggles are currently OFF for this account; Zero Data Retention is not active;
• Infobip if enabled;
• Cloudflare R2, used for object/media storage in the current production storage architecture — bucket configuration confirmed Western Europe (WEUR) (a technical account-configuration fact, not a legal data-residency determination); no custom domain attached; subject to final contractual and international-transfer verification;
• Expo/EAS where relevant.

Legacy or inactive integrations should not be treated as active providers without confirmation.

Mistral AI's account tier is confirmed (Free), and its platform-level training/opt-out toggles are confirmed OFF (training/model-improvement and Labs both OFF; Zero Data Retention not active) — under current platform settings, these API interactions are not used for training. This is a confirmed account setting, not a documented contractual no-training guarantee. Mistral AI remains partially TO VERIFY for the remaining contractual questions concerning:

• exact retention-terms wording under the current (non-zero-retention) settings;
• international transfers;
• deletion commitments;
• whether/how Mistral's standard, publicly identified DPA terms specifically apply to SUPERKAWA's account/contract.

14. International transfers

Personal Data may be processed in countries outside the country where you are located.

Where applicable law requires safeguards for international transfers, SUPERKAWA will use appropriate mechanisms, which may include:

• adequacy decisions;
• EU Standard Contractual Clauses;
• UK International Data Transfer Agreement;
• UK Addendum to EU SCCs;
• EU-US Data Privacy Framework where applicable and valid;
• UK-US Data Bridge where applicable and valid;
• other lawful mechanisms.

The EU-US Data Privacy Framework and UK-US Data Bridge are separate legal mechanisms and are monitored separately.

SUPERKAWA will maintain appropriate transfer documentation where required.

15. Data retention

Retention periods depend on:

• the category of Personal Data;
• why the data was collected;
• Merchant instructions where the Merchant acts as Controller;
• legal obligations;
• accounting or tax requirements;
• security needs;
• fraud-prevention needs;
• legal-claim requirements.

There is no single universal retention period for all Personal Data.

Where the Merchant acts as Controller, the Merchant is responsible for determining an appropriate retention period for its Customer Data.

SUPERKAWA may provide configurable retention settings.

16. Current Merchant retention functionality

SUPERKAWA has developed technical mechanisms supporting certain Merchant-directed retention operations.

At the current product stage:

• the retention pipeline is implemented and tested;
• it is not automatically invoked by a production cron, endpoint or startup hook;
• it is not a general purge of all historical customer information.

When activated in its current form, the mechanism may:

• anonymise relevant customer reviews;
• remove an internal activity index used for Merchant-scoped retention decisions.

It does not currently delete or modify through that Merchant-retention pipeline:

• the global customer account;
• orders;
• Wallet transactions or balances;
• loyalty/points records;
• fiscal records.

Accordingly, SUPERKAWA does not represent that all Personal Data is automatically erased after a specific period merely because a Merchant selects a retention setting.

17. Account deletion

SUPERKAWA may provide account-deletion or anonymisation functionality.

Deleting or anonymising an account does not necessarily remove every historical transaction record.

Certain data may remain where necessary or required for:

• accounting;
• taxation;
• transaction integrity;
• fraud prevention;
• security;
• audit;
• legal obligations;
• legal claims.

Where data is retained after account deletion, its use will be restricted to the relevant purpose where required.

SUPERKAWA must not describe retained transaction history as physically deleted if it remains in the underlying systems.

18. How long we keep information

Specific retention periods will be maintained through internal retention schedules and, where relevant, Merchant configuration.

Examples of categories that may have different retention requirements include:

• authentication/security logs;
• subscription billing records;
• tax and accounting records;
• customer orders;
• Wallet ledger entries;
• loyalty records;
• reviews;
• marketing records;
• consent records.

Category-by-category retention positions are tracked in legal/RETENTION_SCHEDULE_V0.1_WORKING.md. That schedule is a working revision, not publication-final: several jurisdiction-specific retention periods within it remain unresolved pending legal/payments-counsel input, and no automated purge, anonymisation or deletion is authorised or enabled by that document. This section will be finalised once that schedule reaches a publication-final status.

19. Security

SUPERKAWA uses technical and organisational measures designed to protect Personal Data.

Application-level controls currently verified include:

• bcrypt password/PIN hashing;
• email OTP authentication;
• OTP expiration and throttling;
• session/JWT expiration;
• account-status revalidation;
• tenant and Store access controls;
• role-based authorisation gates;
• restrictive CORS configuration;
• rate limiting;
• integrity controls on audit events;
• fiscal record integrity mechanisms;
• required application secrets without insecure production fallback.

Infrastructure-level controls are verified separately and may include, where confirmed:

• TLS;
• HSTS/CSP at hosting or CDN level;
• database access controls;
• encryption at rest;
• backups;
• disaster recovery;
• vulnerability scanning;
• incident-response procedures.

SUPERKAWA does not currently claim SOC 2 or ISO 27001 certification unless expressly stated otherwise.

20. Personal Data Breaches

Where SUPERKAWA acts as Processor and becomes aware of a Personal Data Breach affecting Merchant Customer Data, SUPERKAWA will notify the relevant Merchant without undue delay in accordance with the applicable DPA.

SUPERKAWA's current intended Processor-to-Merchant notification target is 24 hours where reasonably practicable.

This is an organisational/contractual target and is not currently enforced by an automated breach-notification system.

Where SUPERKAWA acts as Controller, SUPERKAWA will assess its own regulatory and individual notification obligations under Applicable Data Protection Law.

21. Your privacy rights

Depending on your location and applicable law, you may have rights including:

• access;
• correction;
• deletion;
• restriction;
• objection;
• portability;
• withdrawal of consent;
• rights relating to certain automated Processing;
• rights to complain to a data-protection authority.

These rights are not absolute and may be subject to legal exceptions.

Some requests may need to be handled manually because not every privacy right is currently available through a self-service feature.

22. Requests relating to Merchant-controlled data

If SUPERKAWA processes your Personal Data on behalf of a Merchant, the Merchant may be the appropriate Controller for your request.

SUPERKAWA may therefore:

• forward your request to the Merchant;
• ask you to contact the Merchant;
• assist the Merchant in responding.

SUPERKAWA will respond directly where it acts as Controller or where applicable law requires it to do so.

23. UK privacy rights

Individuals in the United Kingdom may have rights under:

• UK GDPR;
• Data Protection Act 2018;
• applicable provisions of the Data (Use and Access) Act 2025.

You may have the right to complain to the Information Commissioner's Office (ICO).

[TO VERIFY — ICO CONTACT/LINK IN FINAL PUBLISHED VERSION]

24. EEA and France privacy rights

Individuals in the EEA may have rights under the EU GDPR and applicable national legislation.

Individuals in France may also rely on the Loi Informatique et Libertés and may complain to the CNIL.

EU representative

SUPERKAWA is established outside the European Union and intends to offer Services to Merchants in the EEA.

An EU representative under Article 27 GDPR is presumed required for the current launch model unless qualified counsel confirms an exemption applies.

The representative's identity and contact information will be added before relevant EEA launch.

[TO VERIFY — EU REPRESENTATIVE DETAILS]

25. Data Protection Officer

The requirement to appoint an EU representative is separate from the requirement to appoint a Data Protection Officer.

SUPERKAWA is assessing whether a DPO is legally required under applicable law.

[TO VERIFY — DPO ASSESSMENT / DETAILS]

26. Canada excluding Québec

Where Canadian privacy law applies, you may have rights under:

• PIPEDA;
• applicable provincial private-sector privacy laws.

Québec is outside the initial launch scope.

A dedicated Canada Privacy Schedule may provide further details.

27. United States privacy rights

Depending on your state of residence and applicable thresholds, you may have rights under US state privacy laws, which may include rights to:

• know/access;
• correct;
• delete;
• obtain a portable copy;
• opt out of certain sale or sharing;
• opt out of certain targeted advertising;
• appeal certain privacy decisions.

SUPERKAWA does not sell Merchant Customer Data processed solely on behalf of Merchants.

SUPERKAWA does not share such Merchant Customer Data for cross-context behavioural advertising except where separately authorised and lawfully disclosed.

Additional state-specific disclosures may be provided through a US Privacy Schedule.

28. California

Where the California Consumer Privacy Act / California Privacy Rights Act applies, SUPERKAWA may act either as:

• a Business for Processing it determines itself; or
• a Service Provider for Merchant-directed Processing.

SUPERKAWA will provide applicable California disclosures and rights where required.

[TO COMPLETE — US STATE PRIVACY SCHEDULE]

29. Children

SUPERKAWA is primarily a business and commerce platform and is not designed as a children's service.

SUPERKAWA does not currently perform technical age verification at registration.

Merchants must comply with applicable age-related requirements for their own customer relationships.

[TO VERIFY — FINAL AGE POLICY / CUSTOMER ACCOUNT MINIMUM AGE]

30. Marketing communications

Where SUPERKAWA sends its own marketing communications, it will do so in accordance with applicable law.

For current Merchant-prospect communications, withdrawal of consent or objection may be handled by contacting SUPERKAWA directly where no self-service mechanism is available.

Service, security or transactional communications may still be sent where necessary.

31. Cookies and similar technologies

The public SUPERKAWA website may use cookies or similar technologies.

Non-essential technologies will not be set before the required consent has been obtained.

A separate Cookie Policy will provide further information.

[TO COMPLETE — COOKIE POLICY / CMP INVENTORY]

32. Automated decision-making

SUPERKAWA does not currently represent that its standard Services make solely automated decisions producing legal or similarly significant effects on individuals without meaningful human involvement.

If SUPERKAWA introduces such Processing, this Privacy Policy will be updated where required.

AI-assisted support functionality is not intended to make binding legal or similarly significant decisions about individuals.

Where an AI-assisted system directly interacts with a user, the transparency requirements described in Section 10 apply.

33. Government requests and legal disclosure

SUPERKAWA may disclose Personal Data where reasonably necessary to:

• comply with law;
• comply with binding court or regulatory orders;
• protect legal rights;
• investigate fraud or security threats;
• protect users, Merchants or the Services.

Where legally permitted, SUPERKAWA will seek to limit disclosure to what is required.

34. Business transfers

If SUPERKAWA is involved in a merger, acquisition, restructuring, financing or sale of assets, Personal Data may be transferred as part of that transaction subject to:

• applicable law;
• confidentiality;
• appropriate safeguards.

Where required, affected persons will receive appropriate notice.

35. Changes to this Privacy Policy

SUPERKAWA may update this Privacy Policy to reflect:

• changes to the Services;
• changes to law;
• changes to providers;
• changes to Processing activities.

Material changes will be communicated where required by applicable law.

The current version and effective date will be displayed when published.

36. Contact

Privacy questions or requests concerning Processing for which SUPERKAWA acts as Controller may be sent to:

SUPERKAWA SUPPLY LTD Company No. 17145664 71-75 Shelton Street Covent Garden London WC2H 9JQ United Kingdom

Email: contact@superkawa.co

The dedicated privacy contact is privacy@superkawa.co. This mailbox is a privacy contact point only; it does not designate a Data Protection Officer, which remains a separate, unresolved assessment under Section 25.

Where your Personal Data is controlled by a Merchant using SUPERKAWA, you may need to contact that Merchant directly.