1. Introduction

Cafecito Spanish ("cafecitospanish.com", "the Site", "we", "us", "our") is operated by Web Ventures Ltd (New Zealand). We are committed to protecting your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and your rights under the New Zealand Privacy Act 2020.

This policy applies to everything on the Site, including the pages and lesson notes, the newsletter and free guide, the contact form, and any paid guides we introduce in future.

2. Information We Collect

2.1 Newsletter Sign-Ups

When you subscribe to our newsletter, we collect:

• Your email address
• Your subscription status (whether you have confirmed, and whether you are still subscribed)
• The date and IP address at which you confirmed your subscription by clicking the link in the confirmation email, retained as proof of consent under the Unsolicited Electronic Messages Act 2007

Our newsletter forms ask for your email address only.

2.2 The Free Guide

Our free guide is delivered by a link shown after you confirm your subscription, and in your welcome email. We do not ask for any information beyond the email address you use to subscribe.

2.3 Enquiries and the Contact Form

If you send us a message through the contact form, we collect your name (if you provide one), your email address, and the content of your message, so that we can reply.

2.4 Automatically Collected Information

When you visit the Site, we automatically collect:

• IP address (used for security, rate limiting and approximate geolocation)
• Browser type and version
• Pages visited and time spent
• The website that referred you

We use Google Analytics 4 (GA4) to understand how the Site is used. Google Analytics may set cookies on your browser. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

2.5 Cookies

We use cookies for:

• Security (for example, protecting our forms)
• Analytics (understanding how the Site is used, through Google Analytics)
• Rate limiting (preventing abuse)

You can control cookie settings through your browser. Disabling cookies may affect some features. We do not display advertising on the Site.

3. How We Use Your Information

We use the information we collect to:

• Send you the newsletter, the free guide and other emails you have consented to
• Reply to enquiries you send us through the contact form
• Operate, maintain and improve the Site and its lessons and guides
• Understand how the Site is used, in aggregate
• Prevent abuse, spam and scraping, and keep the Site secure
• Comply with our legal obligations

4. Who We Share Your Information With

We do not sell your personal information. We share data with the following third parties only as needed to run the Site:

• Amazon Web Services (AWS) — we host the Site, our database and our outbound email on AWS infrastructure in the Sydney (ap-southeast-2) region. Outbound email, including the newsletter, is sent through Amazon Simple Email Service (SES).
• Google Analytics 4 — aggregated usage analytics. See Google's privacy policy.
• Affiliate partners (such as italki) — when you follow an affiliate link, the partner receives the click through their own tracking, subject to their privacy policy. We do not pass your email address or other personal details to affiliate partners. See our affiliate disclosure.
• External checkout providers (such as Gumroad or Lemon Squeezy) — only if and when we introduce paid guides, and only for that purchase, which they handle as the seller or merchant of record.

We may also disclose information where required by law, to enforce our Terms of Use, or to protect the rights, safety or property of Web Ventures Ltd, our users or the public.

5. Marketing Emails — Your Choices

You will only receive marketing email from us if you subscribed through one of our forms and confirmed your subscription. Every marketing email we send includes:

• A clear identification of Cafecito Spanish as the sender
• A one-click unsubscribe link

Emails you receive in direct response to something you did — such as the confirmation email or a reply to your enquiry — are not marketing email and are sent only when there is a reason to.

6. Data Retention

• Newsletter subscribers: your email address and subscription record are kept while you are subscribed. If you unsubscribe, we keep your email address on a suppression list so we do not accidentally email you again. You may ask us to delete your subscriber record entirely.
• Enquiries: messages sent through the contact form are kept so we can respond and keep a record of correspondence.
• Consent records: the date and IP address of your subscription confirmation are kept as proof of consent for as long as you are subscribed.
• Server logs: application and access logs are kept for a limited period set by our hosting infrastructure and then discarded.

If you would like a copy of, or the deletion of, the personal information we hold about you, please contact us through the contact form.

7. Data Security

We use reasonable technical and organisational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS) for all pages and form submissions
• Rate limiting and bot protection
• Regular security updates to our software
• Restricted internal access to personal data

However, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

8. Your Rights Under the Privacy Act 2020

Under the New Zealand Privacy Act 2020 you have the right to:

• Access the personal information we hold about you
• Correct any inaccurate personal information we hold about you
• Request deletion of your newsletter subscription or other personal data
• Withdraw consent for marketing email at any time, by clicking the unsubscribe link in any email or by contacting us
• Complain to the New Zealand Office of the Privacy Commissioner

To exercise any of these rights, please contact us through the contact form on the Site. We will respond within 20 working days, as required by the Privacy Act.

9. Visitors from Australia, the EU and the UK

We welcome learners from around the world. Where the privacy law of your country applies to you — for example the Australian Privacy Principles, or the GDPR in the EU and the UK — we honour equivalent rights to access, correct, delete and object to the use of your personal information, and you may make such a request through the contact form. Where we rely on a lawful basis for sending you marketing email, that basis is your consent, which you can withdraw at any time.

10. Children's Privacy

The Site's content is general-audience and suitable for learners of all ages. Our email newsletter, however, requires subscribers to be at least 13 years of age, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us so we can delete it.

11. International Data Transfers

Your data may be processed in countries outside New Zealand, including:

• Australia — where our servers, database and outbound email infrastructure (Amazon SES) are hosted (AWS Sydney)
• United States — where some of our service providers, including Google, are based

These transfers are necessary to provide our services. We require our service providers to maintain appropriate data-protection safeguards.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated policy will be posted on the Site with a new effective date. Continued use of the Site or continued newsletter subscription after changes take effect constitutes acceptance of the updated policy.

13. Contact

If you have questions about this Privacy Policy or how we handle your data, please contact us through the contact form on the Site.

You may also contact the New Zealand Office of the Privacy Commissioner at privacy.org.nz if you have concerns about how we handle your information.