At a glance
- You can browse and prepare a list without creating an account.
- Requesting a quote, subscribing to newsletters and allowing analytics are separate choices.
- The shared summary expires after 30 days; this does not automatically erase internal records.
Controller and scope
This policy describes processing related to K-Power’s website, optional accounts, quote requests and associated communications. A contact person’s information remains personal data even when they act for a business.
K-Power operates publicly at k-powerstore.com. Enquiries and complaints can be sent to [email protected]. Access messages and transactional communications are sent from [email protected]. The operator’s legal name, tax or registration identification, address and country of establishment still need to be completed; the trading name and these contacts do not replace that identification.
What data we use and where it comes from
Data comes from your input, your activity in these functions and communications with K-Power. We do not request sensitive data, identity documents, full card details or address-book access to submit a quote. Avoid unnecessary personal information in searches or product references.
| Situation | Information and purpose |
|---|---|
| Quote request | Name, company, business type, country, phone and email; optional comments. References, quantities and special-request details to assess and respond to the request. Historical requests may retain a city provided at the time. |
| Optional account | Email, name, hashed password, verification status, profile, draft and your own request history. Sessions, dates, IP address and browser information recorded by authentication to control access. |
| Contact and commercial handling | Name, email and message from the contact form, with the date and version of your authorization to respond. Also communications or evidence supplied for enquiries, orders or warranties. Do not include sensitive or payment data. A transaction may require additional billing or shipping information, explained when requested. |
| Optional newsletter | Email, language, country, business type, interest and consent or unsubscribe records; campaign delivery status. |
| Optional analytics | Usage events, language, currency, product reference, filtered search terms and a random session identifier. Quote contact details do not need to be included. |
| Operation and security | Preferences and technical data needed to serve the website, maintain sessions, prevent duplicates, limit abuse and diagnose errors. Infrastructure serving a connection receives network data, including IP addresses. |
Purposes and legal grounds
Depending on jurisdiction and purpose, the relevant ground may be consent, requested precontractual steps, contract performance, legal obligations or an assessed legitimate interest permitted by law. These are not interchangeable authorizations: the specific basis must be documented before operating in each market. Legitimate interest is not used to activate analytics or newsletters without your choice.
Without the required information, the quote form cannot be processed; you can still browse. Browsing or reading this policy does not by itself authorize marketing, analytics or other optional processing.
- Handling your request: saving the selection, identifying the contact, reviewing terms and following up through the channels provided. The form asks for express authorization for this purpose.
- Providing the requested account: authentication, access recovery and saving your profile and draft. Guest quotes do not require an account.
- Sending updates: only if you select the separate newsletter option. Declining it does not prevent a quote request.
- Analyzing usage: only if you enable analytics cookies. Declining them does not prevent browsing, quote requests or account access.
- Protecting the service and meeting obligations: preventing abuse, handling claims and retaining necessary evidence within the grounds and limits of applicable law.
- Answering contact enquiries: sending your name, email and message to the team to handle what you request. The form requires a specific privacy authorization; it does not subscribe you to promotional communications.
Who may access information
Operational access is limited to authorized K-Power personnel according to their function. Hosting, storage, email and technical support services may process information needed to provide the service, subject to the arrangements and safeguards that must be formalized with them.
A confirmed transaction may require minimum necessary data to be shared with carriers, payment operators or other recipients involved in delivery, or authorities under a valid obligation. Acceptance of this policy is not presented as blanket consent to any transfer.
The live platform uses Vercel to serve the website, Cloudflare for connectivity and abuse protection (including Turnstile), Supabase for the database and Amazon S3 for images and files. Resend transports transactional emails; Google Workspace receives communications in the team’s inboxes. These services may process data needed for their functions. We do not trade contact data or enable behavioral advertising networks.
The database and file storage are configured in the United States (us-west-2 region); other providers operate distributed infrastructure. This may involve processing outside your country. Contractual records, subprocessors, additional locations and applicable transfer safeguards require review; we do not claim that all data resides exclusively in one region.
| Service | Function and related data |
|---|---|
| Vercel and Cloudflare | Hosting, page delivery, connection data, security and abuse verification. |
| Vercel Web Analytics | Only if you accept analytics: aggregated public page visits, approximate country, device and browser. We exclude accounts, proposals, quote links and URL parameters; we do not send form data. |
| Supabase | Storage of accounts, requests, consent and operational records. |
| Amazon S3 | Public images and private operational files, with separate access controls. |
| Resend | Sender, recipient, content and status of transactional email. |
| Google Workspace | Receipt and handling of enquiries and email communications by the team. |
WhatsApp and external services
We first save the request in K-Power. When you choose to continue, a WhatsApp link opens with prepared text: reference, products or special references, quantities, country, summary link and estimates when enabled. You can review the message before sending. General contact may include text you edit.
Opening the link accesses an external service that may receive the text in the URL and connection data. If you send the message, K-Power also receives information you share through your WhatsApp account. WhatsApp’s own terms govern its processing; K-Power’s cookie preference does not control that service.
The generated message does not include private comments, special-request notes or the original search query. Also take care with information entered in the public reference field. The request stays saved if you choose not to open or send the message.
Shared summary and private proposal
Anyone with the complete summary link can view the selection for 30 days without signing in. It includes the reference, country, products, images, quantities and displayed price estimates, but not your name, company, email, phone or private comments. A hard-to-guess link is not private access.
After expiry, the same address shows the expired state and retains the reference without product details. Screenshots, forwarded messages and previews saved by others may persist beyond K-Power’s control. Share the link only with people who need it.
A private commercial proposal is separate: it requires the recipient’s account, expires after seven days and can be revoked. It does not publish costs, margins or supplier information.
Retention periods and limits
Signing out, deleting cookies or declining analytics does not erase existing server records. Retention must be limited to the purpose and applicable obligations or claims; indefinite retention of all data is not assumed. Production deletion and backup cycles still need to be defined and verified.
Deleting a quote from your history removes it from your account view. It does not cancel an order, erase the team’s record or revoke previously shared links. To withdraw a request or exercise a deletion right, contact the team with its reference.
| Information | Retention or availability |
|---|---|
| Browser list | Recoverable for 30 days after its last update. You can clear it or delete site data. It does not store form identity; references and notes you enter are part of the list. |
| Account draft | No longer restored after 30 days of inactivity. Expiry does not by itself physically delete records. |
| Summary and proposal | Summary detail: 30 days. Private proposal: seven days or until revocation. These are access limits, not general deletion periods. |
| Analytics | Pseudonymous events are kept for 12 months; maintenance replaces them with totals aggregated by day, event and language, without session identifiers. |
| Newsletter | Until unsubscribe for sending. Minimum suppression records remain to respect that choice, together with applicable consent evidence. |
| Account, quotes and internal communications | Not automatically deleted when a summary expires. Contact-form messages are retained in the team’s inbox. Internal retention schedules and deletion cycles still need to be formalized. You can request information or deletion at [email protected], subject to applicable obligations and rights. |
Cookies and browser storage
Analytics starts disabled. You can decline, accept or change your choice here or in the footer. This controls new events; it does not automatically delete earlier ones. The choice applies to this browser.
Local-storage recovery periods are not physical deletion timers: cleanup may occur when a feature is used again. You can delete site data through your browser; this may sign you out and lose an unsent list. Classification and control of recently viewed items remain subject to review under applicable law.
| Name and function | Duration / control |
|---|---|
| kp-cookie-consent · remember your choice | Necessary cookie: one year after saving your preference. |
| kp-locale · selected language | Functional cookie: 30 days. |
| kp-list / kp-sent · list and last summary access | Local storage: recoverable for 30 days; clear through the list or browser. |
| kp-idempotency · prevent duplicate requests | Session storage: renewed for a new request or ends with the browser session. |
| kp-customer.* · secure customer access | Authentication cookies: session up to 30 days, renewable with activity under the configuration; you can sign out. |
| kp-recent · recently viewed products | Functional local storage, up to 12 references. Only views from the past 30 days are shown; clear through the browser. Currently saved when visiting product pages, independently of the analytics preference. |
| kp-session · measure usage with a random identifier | Session storage only with analytics accepted; removed when you decline analytics. |
| Vercel Web Analytics · visit statistics | No additional analytics cookies; temporary identification derived from the request, discarded by Vercel after 24 hours. It loads only with analytics accepted; withdrawing consent stops new events. |
| Cloudflare · verification and abuse protection | May use security cookies or technical signals when serving the website or verifying a form. Duration depends on the security control applied by the service. This does not enable K-Power’s own analytics. |
Newsletter and automated decisions
The newsletter has separate consent and an unsubscribe link. Unsubscribing prevents new campaigns but not necessarily operational communications needed for a request or account. A suppression list helps prevent accidental reactivation.
Campaigns may be organized by language, country, business type and declared interest. The implementation does not make automated decisions with legal effects about credit, final pricing or order acceptance: the team reviews commercial terms.
Your rights and how to exercise them
For a request, identify the right you wish to exercise, a reply channel and, if helpful, the related reference. Identity checks must be proportionate; do not send passwords or sensitive documents unnecessarily or without a secure channel. Representation may need to be established if you act for someone else.
Email your request to [email protected] with «Privacy» in the subject. The team may request proportionate information to locate the data and verify your identity. The requirements and deadlines of the applicable regime apply; formal controller identification and the internal procedure still need to be completed. The newsletter unsubscribe and cookie-preference controls described here remain available.
Rights and deadlines differ across Colombia, Chile, Peru, Ecuador, Bolivia, Venezuela, Mexico and Brazil. This policy does not declare automatic satisfaction of all their requirements. Review must consider Brazil’s LGPD, Mexico’s ARCO rights and the rules relevant to the operation and controller in other markets.
- Request information and access to your data, and correct or update it.
- Request deletion, cancellation, objection, restriction or portability where recognized by applicable law.
- Withdraw consent and request evidence of it where applicable. Withdrawal does not automatically invalidate earlier lawful processing or remove legal retention obligations.
- Complain to the competent authority without an internal process depriving you of that right.
Security and minors
The platform uses HTTPS, separate access controls, protected passwords, private-data restrictions and abuse controls. Access or recovery emails may be sent from [email protected]. Do not share passwords or access codes. No measure guarantees absolute security; an incident requires assessment and any notifications required by applicable law.
The service is intended for people with capacity to act in professional transactions, not minors. We do not intentionally request minors’ or sensitive data. If received, deletion or processing must be assessed under applicable law without requesting more information than necessary.
Updates and contact
New versions will be identified by date, and material changes communicated through appropriate means. A new purpose requiring consent will require a new choice; continued browsing does not replace it.
This revision describes the live platform and contact channels available on September 26, 2026. Full controller identification, validation of legal grounds and transfers, the retention schedule and legal review for the markets served remain pending. New authorizations record this version without replacing the date or version of earlier authorizations.