Privacy Policy

We are committed to respecting the confidentiality of your data in accordance with applicable personal data protection legislation, including Law No. 133 of 08.07.2011 of the Republic of Moldova on the Protection of Personal Data and the principles of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), applied in accordance with applicable national legislation. This policy aims to provide you with clear and specific information about the personal data we collect from you, why we collect it, where it is stored, and how you can request its deletion, in the context of using the Koshu mobile application and/or the website www.koshu.app. We collect only what is necessary for the service to function — Section IV below sets out exactly what that means, and what we do not collect. The controller of your personal data is Societatea cu Răspundere Limitată Koshu (Koshu SRL), a legal entity registered in the Republic of Moldova with state identification number (IDNO) 1026023125026, having its registered office at str-la Mihail Frunze 27, s. Abaclia, r-nul Basarabeasca, MD-6711, Republic of Moldova.

This Privacy Policy is updated periodically. Whenever we make a change, we will inform you accordingly and will post the updated information on our website www.koshu.app and in the Koshu mobile application.

"Koshu" means the software platform (the mobile application and the website www.koshu.app) owned and operated by Koshu SRL, which allows Customers to place orders for the purchase of products delivered by Couriers. "Customer" means the individual or legal entity that purchases one or more Products by placing an order through the Koshu application or website. "Personal data" or "Data" means any information relating to an identified or identifiable natural person. "Courier" means the individual or legal entity that, under a contractual relationship with Koshu, provides purchasing and delivery services for Products to Customers. "Processing" means any operation or set of operations performed on Personal data, including without limitation the collection, recording, storage, alteration, use, disclosure, access, transfer, or destruction thereof. "User" means any person who accesses the Koshu platforms and registers an account. "Visitor" means any person who accesses the Koshu platforms without registering an account.

We collect only the data you provide to us directly or that is strictly necessary for the service to function — for example, when you create an account, place an order, or use the application. Below is a clear breakdown for each category of data: what it consists of, why we need it, where it is stored, and how you can request its deletion. IV.1. Identification and contact data Data: first and last name, phone number, e-mail address, delivery address. Purpose: creating and managing your account, receiving, validating, and delivering orders, and contacting you in relation to them. Where it is stored: exclusively in Koshu's own database. It is never transmitted to anyone. How you can delete it: you can delete your account at any time from Settings > Delete account in the app, from https://www.koshu.app/delete-account, or by sending an e-mail to support@koshu.app. Deletion is final, subject to the limited retention periods required by law, described in Section VI. IV.2. Order and account activity data Data: order history, the stores you have ordered from, order frequency, and any other information you provide directly while using Koshu. Purpose: processing and displaying current and past orders, and improving the service. Where it is stored: exclusively in Koshu's own database. How you can delete it: it is deleted together with your account, using the methods described above. IV.3. Real-time geolocation data — we do not collect or save it Data: your device's real-time location, used only to locally filter and display nearby stores and products. Purpose: determining the offering available near you. Where it is stored: locally. Location is processed locally, on your device, and is never transmitted to or stored live on Koshu's servers; however, if you choose to use your current location as your delivery address, only the last static reading — not the live location — is sent to Koshu's server. How you can delete it: not applicable — we never receive or store your device's real-time current location. You can disable location access at any time from your device settings. IV.4. Sign-in via Apple or Google Data: if you sign in via Apple or Google, we receive only the minimal information necessary for authentication (typically your name and e-mail address). Purpose: authentication only — for creating and accessing your account. We do not use this data for marketing, advertising, or profiling purposes, and we never transmit it to anyone. Where it is stored: in Koshu's own database, linked to your account. How you can delete it: it is deleted together with your account, using the methods described above. IV.5. Device and diagnostic data Data: device/operating system type and version, application usage and diagnostic data (e.g. error reports, time spent in various sections of the app). Purpose: maintaining application stability, fixing bugs, and understanding usage patterns in order to improve the service. Where it is stored: exclusively in Koshu's own systems. How you can delete it: it is deleted together with your account, or earlier upon request, by e-mail to support@koshu.app. IV.7. Cookies and tracking technologies on the website This section applies exclusively to the website www.koshu.app — the Koshu mobile application does not use any of these tools. When you visit our website, we and the third-party providers listed below use cookies and similar technologies to make the site work, to understand how it is used, and to measure the performance of our advertising. Strictly necessary cookies always run; the others run only if you give your consent via the cookie banner shown on your first visit. • Google Tag Manager (Google Ireland Limited). A technical tool that loads the other tools listed below onto the page, depending on your consent choices. It does not itself collect personal data, other than what is necessary for this purpose. Legal basis: strictly necessary for the functioning of the consent mechanism described in this section. • Google Analytics 4 (Google Ireland Limited). Collects data about how visitors use our website: pages viewed, session duration, device/browser type, and an approximate, city-level location derived from your IP address (the full IP address is not stored). Data collected: device/browser type, pages viewed, session duration, approximate location, referring site. Purpose: understanding traffic and usage of the site in order to improve it. Legal basis: your consent, given via the cookie banner. Retention period: up to 14 months from your last visit (Google Analytics' default retention period). • Meta Pixel (Meta Platforms Ireland Limited). Measures the effectiveness of our advertising on Facebook and Instagram by recording when you click the "Download on the App Store" or "Get it on Google Play" buttons on our website. Data collected: the fact that a download button was clicked and for which platform (iOS/Android), browser and device type, IP address. Used by Meta for ad measurement purposes, in accordance with Meta's own data policy. Purpose: measuring and improving the performance of our advertising campaigns. Legal basis: your consent, given via the cookie banner. Retention period: in accordance with Meta's own cookie retention periods (typically up to 2 years for identification cookies such as fbp/fr). International transfer: Google and Meta are established outside the Republic of Moldova and the European Economic Area, so the use of these tools involves transferring the data described above to those countries. Both companies rely on the EU Standard Contractual Clauses (or an equivalent recognized transfer mechanism) as a safeguard for this transfer. Managing your choices: on your first visit, you can accept all cookies, reject the non-essential ones, or choose exactly which categories (Analytics, Advertising) to allow, using the "Manage preferences" option in the cookie banner. You can change your choice at any time — clearing your browser's local storage for this site will show the banner again, or you can use your browser's own cookie settings. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and does not affect the separate marketing consent described in Section V(vi). IV.8. Data we do NOT collect • We do not collect or store payment card data or any other payment data. • We do not track or store your real-time location — it is used only locally, on your device. • We do not sell, rent, or share your data with anyone, except as described in Section IV.7 above, where — only with your consent — limited technical data is shared with Google and Meta strictly for website analytics and advertising measurement purposes. • If you are a Visitor of the Application, without an account, we do not store or process personal data in the context of that browsing activity.

V.1. The personal data of Users and/or Customers may be processed by Koshu for the following purposes: (i) Purpose: to carry out the contractual relationship, including receiving, validating, and delivering orders, informing the Customer about the status of their order, and organizing product returns. Legal basis: performance of the contract concluded between you and Koshu. Providing this data is necessary; refusal may make it impossible to carry out the contractual relationship. (ii) Purpose: to fulfil Koshu's legal obligations, including financial-accounting, tax, and archiving obligations. Legal basis: legal obligation. Providing this data is necessary. (iii) Purpose: to respond to your questions, requests, or complaints, through the communication channel of your choice. Legal basis: Koshu's legitimate interest in ensuring an efficient Customer Relations service. (iv) Purpose: to carry out analyses and statistics on how complaints are handled and to improve services. Legal basis: Koshu's legitimate interest in optimizing the complaint-resolution process. (v) Purpose: sending commercial messages, newsletters, and/or alerts about the services offered or benefits granted, sent by e-mail, SMS, push notifications, or other communication channels, with your consent. Legal basis: your consent, if you choose to give it. (vi) Purpose: creating profiles and carrying out analyses for marketing purposes, including personalizing communications and improving the experience offered in the Application and on the Site. Legal basis: your consent, if you choose to give it. This is distinct from our use of website cookies and advertising pixels (Google Analytics, Meta Pixel) described in Section IV.7, which is governed by the separate consent you give (or refuse) via the cookie banner on our website. (vii) Purpose: participation in surveys or market research studies regarding satisfaction with our products and services. Legal basis: your consent. Participation is voluntary. You may give your consent by checking the corresponding box when creating your account, or later from your account settings. You have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

VI.1. As a general principle, Koshu will process Personal data for the entire duration of the contractual relationship, after which the personal data will be stored for the applicable periods, established in accordance with applicable legal provisions and Koshu's data storage and archiving policy. Where processing is based on your consent, if you withdraw your consent and no other legal basis for processing exists, Koshu will cease processing your Personal data. With regard to the processing of data related to your complaints, complaint records are stored for the legal limitation period of 3 years from the date of the last response to that complaint. After the storage period ends, Koshu may anonymize the data and continue processing it for statistical purposes. VI.2. If you wish to close/delete your account, you can do so from Settings > Delete account in the app, from https://www.koshu.app/delete-account, or by sending an e-mail to support@koshu.app. Koshu will display a confirmation message before proceeding. Upon confirmation, the request will be treated as also including the withdrawal of consent for processing data for marketing purposes. Koshu will communicate how the request has been resolved within no more than one month of its registration.

Personal data is accessed primarily by Koshu's authorized employees or collaborators, who are subject to confidentiality obligations. Beyond that, Personal data is disclosed only to: (i) Couriers, and strictly limited to the delivery address and phone number — the minimum necessary to complete the delivery. Couriers do not receive your name, e-mail address, order history, or any other data; (ii) Technical service providers who host and maintain Koshu's own systems (for example, hosting/IT infrastructure providers), who act exclusively on Koshu's instructions and solely to keep the platform running; (iii) Public authorities and judicial bodies, but only in response to a lawful request or to fulfil a legal obligation; (iv) Google Ireland Limited and Meta Platforms Ireland Limited, strictly limited to the website analytics and advertising measurement data described in Section IV.7, and only if you have given your consent via the cookie banner on our website. We do not sell, rent, or share your Personal data with anyone, except as set out in point (iv) above and only with your consent.

The Koshu service is available exclusively to persons who have reached the age of 18. We do not knowingly collect or process personal data of persons under 18. If such processing nevertheless occurs without our knowledge, we will stop it and delete the relevant data as soon as we become aware that the user has not reached the stated age.

We constantly assess our security measures to ensure that Personal data is processed safely. Koshu has an internal framework of policies and procedures in place to keep your data safe, to ensure its confidentiality, integrity, and availability, and to ensure it is processed only in accordance with applicable legal provisions. Koshu employees are required to maintain confidentiality and may not disclose personal data they access in the course of their professional activity. Employees are trained periodically in data processing and protection. This policy is reviewed regularly.

X.1. Right of access to Personal data You have the right to obtain confirmation as to whether we process your Data, as well as information about the specifics of that processing. You can request a copy of your data by contacting our team at support@koshu.app. X.2. Right to rectification You have the right to have your data corrected if it is inaccurate or incomplete. You can log in to the Application or Site to update your data, or contact our team. X.3. Right to data portability In certain circumstances, you have the right to ask us to provide you with the data you have given us, in a structured, commonly used, and machine-readable format. X.4. Right to withdraw your consent If you no longer wish to receive marketing messages or other consent-based communications, you can withdraw your consent at any time: • From the Application or Site, in the account Settings section; • By contacting our Customer Relations team; • By sending an e-mail to support@koshu.app; • By using the unsubscribe link in the marketing e-mails you receive. X.5. Right to object In certain circumstances, you have the right to object to the processing of your Personal data, in particular for direct marketing purposes. In such cases, we will immediately stop processing your data for that purpose. X.6. Right to restriction In certain circumstances, you have the right to ask us to restrict the processing of your Personal data. X.7. Right to erasure You have the right to ask us to delete the Personal data we hold about you, or to delete your own account at any time, from Settings > Delete account in the Application, or from https://www.koshu.app/delete-account. To exercise any of the rights mentioned above, you can contact us at: E-mail: support@koshu.app Attn: Koshu Team – Data Protection You also have the right to lodge a complaint with the National Center for Personal Data Protection of the Republic of Moldova (www.datepersonale.md).