Privacy Policy

Koki Club LLP · Effective 24 August 2026 · Version 1.1

This policy explains what personal data we collect when you join our waitlist, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it. We have tried to write it in plain English rather than legal boilerplate. If anything here is unclear, write to us and we will explain it.

1. Who we are

This website, koki.club, is operated by Koki Club LLP, a limited liability partnership registered in India. Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described here — which means we decide what is collected and why, and we are accountable for it.

2. What this policy covers

It covers the waitlist form on this website and the emails we send you as a result of it. We are a pre-launch business: today this site sells nothing, takes no payments, and has no accounts to log into. When our store opens we will publish separate terms covering orders, shipping, returns and payments, and we will update this policy before that happens.

3. What we collect

Only what you type into the form, plus a small amount of technical data.

We do not ask for, and do not want, your financial information, government identifiers, health information, or any other sensitive category of data. Please do not send it to us.

4. Why we collect it, and on what basis

We process this data on the basis of your consent, which you give by filling in the form and pressing the button. Under the DPDP Act that consent must be free, specific, informed and unambiguous, and you can take it back at any time (see section 8). For visitors in the UK and the European Economic Area, consent is also our lawful basis under Article 6(1)(a) of the GDPR.

We use your data for these purposes and no others:

• To tell you when the store opens, and to send you the founding-member offer.
• To send you occasional updates before launch — a small number of emails, not a stream.
• To send one WhatsApp message on the morning we open, only if you ticked that box.
• To understand what our waitlist wants, so we make and stock the right things.
• To measure which of our advertisements and pages actually work.

We do not sell your personal data, and we do not rent or trade it. The one exception to keeping it to ourselves is the advertising matching described in section 5: Meta receives a hashed version of your email address and mobile number so we can measure our own ads and reach people like you. Nobody else receives your details for their own marketing.

5. Who we share it with

Only with service providers who process data on our instructions, under contract, to run this website. With the exception of Meta below, they are not permitted to use your data for their own purposes.

We may also disclose data if we are legally required to — by a court order, or a lawful demand from a government authority. If that ever happens we will tell you, unless we are forbidden from doing so.

6. Where your data is stored

The waitlist database is hosted in India, in Google Cloud's Mumbai region. Some of our providers — in particular our email and advertising providers — operate servers outside India, including in the United States and the European Union, so your data may be processed there. We only use providers who offer contractual protections for international transfers, including the European Commission's Standard Contractual Clauses where they apply.

7. How long we keep it

For as long as you want to hear from us, and no longer than we can justify.

• If you withdraw consent, unsubscribe, or ask us to delete your data, we erase your record.
• If you have not opened or clicked any of our emails for 24 months, we delete your record without you having to ask.
• If we abandon the launch entirely, we delete the whole waitlist within 90 days of that decision.

We may keep a minimal record of the fact that you unsubscribed — your email address on a suppression list — purely so we do not accidentally contact you again. That is in your interest, and we keep nothing else alongside it.

8. Your rights

Under the DPDP Act, as a Data Principal you have the following rights. Write to our contact in section 11 to use any of them. We do not charge for this.

• To know what we hold. A summary of the personal data we process about you, and who we have shared it with.
• To correct it. If anything we hold is wrong, incomplete or out of date.
• To erase it. We will delete your data unless a law requires us to keep it.
• To withdraw your consent at any time, as easily as you gave it — see below. Doing so does not make our earlier processing unlawful.
• To nominate someone to exercise these rights on your behalf if you die or become incapacitated.
• To complain — to us first, and then to the Data Protection Board of India.

If you are in the UK or the European Economic Area

You additionally have the rights granted by the UK GDPR and EU GDPR: access, rectification, erasure, restriction of processing, data portability, and objection to processing. You also have the right to lodge a complaint with your national supervisory authority — in the UK, the Information Commissioner's Office.

Withdrawing consent

Every email we send carries an unsubscribe link, and one click is enough — you do not need to email anyone or explain yourself. To stop WhatsApp messages, reply STOP to the message and we will stop. To have your record deleted outright rather than just silenced, email us and say so.

9. Cookies, analytics and advertising

This site uses Google Analytics to count visitors and understand which pages are read, and the Meta pixel to measure whether our advertising works and to match visitors to Meta accounts for advertising. Both set cookies in your browser. Neither is necessary for the site to function — they exist so we can spend our advertising budget sensibly rather than blindly.

You can block or delete these cookies in your browser settings without breaking anything on this site. Google offers a browser add-on to opt out of Google Analytics entirely.

The fonts on this site are served by Google Fonts, which receives your IP address in order to deliver them.

10. Children

This website is intended for adults. Under the DPDP Act a child is anyone under 18, and we do not knowingly collect personal data from children, do not track or profile them, and do not direct advertising at them. If you believe a child has given us their data, tell us and we will delete it promptly.

11. Security

The site is served entirely over HTTPS. The waitlist database is not publicly readable and is reachable only by the small number of people who need it. We collect as little as we can get away with, which is the most effective security measure available to anyone.

No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the DPDP Act requires.

12. Grievance redressal

If you have a question, a request, or a complaint about how we handle your data, contact our designated officer. She is a real person and she reads it herself.

13. Changes to this policy

We will update this page when what we do changes — most obviously when our store opens and we begin taking orders. The effective date at the top always tells you which version you are reading. If we make a change that materially affects your rights, we will email everyone on the waitlist rather than quietly editing this page.

14. Contact

For anything at all: hello@koki.club. For data protection specifically: joohee@koki.club.

Koki Club LLP · This policy is published in compliance with the Digital Personal Data Protection Act, 2023, and Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.