Privacy Policy
Last Updated: 8 September 2025
Quick Summary
Welcome to M-Cultivo! We connect coffee producers with coffee buyers, facilitating relationships through our global auctions, flexible financing, and sourcing solutions. Your privacy is a priority for us. This policy explains how we handle your personal data.
What we collect: We collect data you provide (like your name and contact info), data we collect automatically from your device (like your IP address), and data from trusted third parties (like payment processors).
What we collect: We collect data you provide (like your name and contact info), data we collect automatically from your device (like your IP address), and data from trusted third parties (like payment processors).
Why we collect it: We use your data to run our marketplace, to operate auctions, process payments, prevent fraud, provide customer support, and improve our services.
What we don't do: We do not sell your personal data. We share it only with necessary service providers who help us run our business (e.g., hosting, payments, shipping, security).
Your rights: You have rights to access, correct, or delete your data, and to object to certain uses.
How to contact us: If you have questions or want to exercise your rights, you can email us at support@mcultivo.com.
Who We Are & Scope
M-Cultivo is an online marketplace that runs timed auctions, connecting coffee producers with buyers worldwide. This Privacy Policy applies to the services we provide through M-Cultivo.com and our related pages and apps (collectively, the “Services”).
This policy explains how we collect, use, and protect your personal data when you use our Services, including when you visit our website, create an account, participate in auctions, or make and receive payments.
For the purpose of data protection laws, M-Cultivo is a data controller, which means we are responsible for the personal data we process about you. In some cases, our partners, such as payment processors, may also act as independent controllers or processors
2. Personal Data We Collect
The personal data we collect depends on how you interact with M-Cultivo. We collect data directly from you, automatically as you use our Services, and from third parties.
A. Data You Provide Directly
Account & profile: Your name, display name, email, password, phone number, company name, website, social media url and country.
Buyer details: Your shipping and delivery address and any applicable VAT or tax identifiers.
Auction participation: We collect data on the bids you place.
Marketing preferences: Your choices for receiving our newsletter or other notifications.
B. Data We Collect Automatically
Device & usage data: We collect your IP address, device identifiers, browser type, operating system, and language..
Cookies & SDKs: We use cookies and similar technologies to remember your settings, keep you signed in, prevent fraud, and measure the performance of our site. For more details, see Section 6.
C. Data from Third Parties
Payments & payouts: We receive limited details from our payment processors, such as the status of a transaction and tokenized identifiers.
Public or shared content: We may collect information you make public on your profile or information that is shared with you by other users on our platform.
Why We Use Personal Data (Purposes) & Legal Bases
We process your personal data for the following reasons, each based on a specific legal ground:
To provide and operate our Services (Contract necessity), We use your data to create and manage your account, run auctions, display listings, and enable bidding and purchasing.
To process payments, payouts, and handle taxes (Contract necessity, Legal obligation), This includes processing invoices, handling chargebacks, and meeting our tax and accounting obligations.
To provide customer support and communicate with you (Contract necessity, Legitimate interests), We respond to your inquiries and send you important notices about your account or transactions (e.g., bid updates, purchase confirmations).
To personalize and improve our Services (Legitimate interests), We monitor our platform's performance, fix bugs, and use analytics to understand how you use our Services so we can make them better.
For marketing purposes (Consent or Legitimate interests), With your permission, we may send you newsletters or promotions. You can unsubscribe at any time.
To meet our legal obligations (Legal obligation), We use your data to comply with legal, regulatory, and audit requirements, such as tax laws, sanctions screening, and recordkeeping.
When we rely on your consent, you can withdraw it at any time. This will not affect any processing that has already taken place. When we rely on our legitimate interests, we always balance them against your rights and expectations.
Your Choices & Rights
Depending on where you live, you may have the following rights regarding your personal data:
Right to Access: You can request a copy of the personal data we hold about you.
Right to Correct: You can ask us to fix any data that is inaccurate or incomplete.
Right to Delete: You can request that we delete your personal data, subject to legal and contractual limitations.
Right to Restrict or Object: You can ask us to restrict or object to certain types of processing, including direct marketing.
Right to Portability: You can request to receive your data in a portable, readable format.
Right to Withdraw Consent: You can withdraw your consent for things like marketing.
Right to Human Review: You can request human review of certain automated decisions that significantly affect you.
How to exercise your rights: See Section 14 (Contact Us). We will respond within the legal timeframes (typically 30–45 days) and may ask you to verify your identity.
Data Retention
We keep your personal data only for as long as needed for the purposes outlined in this policy or as required by law.
Account data: We keep this for as long as possible. We then securely delete if there are essential reasons to do so.
Auction & transaction records: We keep these to meet tax, accounting, and anti-fraud requirements.
Identity/KYC data: As required by law or our fraud-prevention obligations. This data is then deleted or archived with restricted access.
Marketing preferences: We keep these until you opt out or your account is deleted.
We may also retain limited logs to ensure the security and integrity of our platform.
Cookies, Analytics & Similar Technologies
We use cookies, SDKs, and similar technologies to make our Services work better.
Essential: These are required for you to sign in, for security, and to prevent fraud.
Functional: These remember your preferences, such as your language or currency.
Performance/Analytics: These help us measure usage, improve features, and diagnose issues.
You can manage cookies through your browser settings. Be aware that disabling some cookies may impact certain features, such as staying signed in.
Security
We implement robust security measures to protect your personal data. These include:
Encryption for data in transit and at rest.
Access controls and permissions based on employee roles.
Secure networks and firewalls.
Vulnerability management and regular security reviews.
Incident response procedures and employee training.
While no system can be 100% secure, we work hard to protect your data. If a data breach occurs, we will notify you and regulators as required by law.
How We Share Personal Data
We do not sell your personal data. We only share it with the following parties when necessary to run our business and provide the Services:
Service providers: Companies that help us with hosting, content delivery, storage, analytics, communications, and support. They only act on our instructions.
Payments & payout partners: To process payments, refunds, and sanctions screening.
Logistics partners: To fulfill deliveries and provide tracking.
Professional advisors: Our auditors, banks, insurers, and lawyers.
Other users: When necessary to complete a transaction (e.g., providing a seller with a buyer’s delivery details).
Legal & Compliance: To comply with the law, enforce our terms, or protect our rights and safety.
Corporate transactions: In connection with mergers, acquisitions, or asset transfers. We will notify you if required by law.
International Data Transfers
We operate globally, and your personal data may be transferred to countries that may not have the same level of data protection as your home country. When this happens, we use lawful transfer mechanisms, such as Standard Contractual Clauses (SCCs) for users in the EEA/UK, to ensure your data remains protected.
Children’s Privacy
Our Services are intended for adults (18+). We do not knowingly collect personal data from children. If we learn that a child has provided us with personal data, we will delete it. Parents or guardians who believe a child has provided data should contact us (Section 13).
Automated Decision-Making & Profiling
We use limited automation to:
Detect and prevent fraud and abuse.
Recommend or rank listings.
Assess bidding risk to keep the auction environment fair.
You have the right to request human review of any automated decisions that significantly affect you.
Third-Party Sites & Services
Our Services may link to third-party websites. Their privacy practices are governed by their own policies, not by ours. We also collect data on how you use our site, such as pages you view, links you click, and the time you spend on pages
Analytics & advertising: We receive aggregated audience insights from our analytics and advertising partners. We do not receive your full payment details from them.
How to Contact Us & Exercise Your Rights
To make a privacy request (access, correction, deletion, or objection), or to ask questions about this policy:
Email our privacy team at support@mcultivo.com.
Write to our registered business address: M-Cultivo UK.
We will verify your identity before fulfilling certain requests and will respond within the applicable legal timeframes.
Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy and, where appropriate, by email or in-product notice. The “Effective date” at the top shows when this version took effect.