RÜJ · Legal

RÜJ Privacy Policy

Effective date: 26 June 2026

This Privacy Policy explains how we handle personal data collected through iamruj.com (the "Site"), the marketing website for RÜJ natural mineral water. Please read it carefully. If you have any questions, contact us at hello@iamruj.com.

1. Who we are (the data controller)

The data controller responsible for your personal data is:

KULTR Unipessoal, Lda. ("KULTR", "RÜJ", "we", "us", "our")
Estrada Nacional 10, Edifício Jardim Parque, Lote A e B, Piso 0, Loja 1, 2615-129 Alverca do Ribatejo, Portugal.

Contact for all RÜJ matters, including all privacy and data-protection questions and requests: hello@iamruj.com.

KULTR Unipessoal, Lda. is a single-shareholder private limited company established in Portugal. RÜJ is a single-source natural mineral water from Portugal, distributed by invitation only.

2. Data Protection Officer

We are a small enterprise and are not required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR, and we have not appointed one. We are also not required to appoint a separate "encarregado" under Brazilian law given our size. Our single point of contact for all data-protection matters is hello@iamruj.com, which serves as our communication channel under both European and Brazilian law.

3. The personal data we collect

The only personal data we collect through the Site comes from the Request Access form. We collect:

• Full name (required).
• Email address (required).
• A free-text message ("Restaurant, context"), which is optional. Please do not include sensitive personal information in this field (for example information about health, religion, political views, racial or ethnic origin, or similar). We do not need it and ask you not to provide it.
• Your consent, given by ticking the consent checkbox, which must be ticked before the form can be submitted.

When you submit the form, our server also automatically records:

• Your IP address, used only to prevent spam and abuse (rate limiting) and included in an internal notification email to us.
• A timestamp of your submission.

The form also contains a hidden anti-spam field (a "honeypot") used only to detect automated bots. Any value captured there is used solely for that check and is immediately discarded.

We do not collect any other personal data through the Site. We do not buy, enrich, or import contact data from third parties. All personal data is collected directly from you.

4. Why we use your data and our legal bases

We use your personal data for the following purposes. For users in the European Union and Portugal, the relevant legal basis under the GDPR is shown for each purpose.

a) To review and respond to your Request Access submission, and to manage our invitation-only access list.
Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in receiving and responding to access requests, curating our invitation list, and keeping records of those requests. As an alternative basis, this also reflects steps taken at your request before any possible relationship (Article 6(1)(b) GDPR). The legitimate interest pursued is the operation of our invitation-only distribution.

b) To contact you about RÜJ access and to send you RÜJ communications by email through our mailing list.
Legal basis: your consent (Article 6(1)(a) GDPR), given through the consent checkbox on the form. You can withdraw this consent at any time (see Section 10).

c) To prevent spam, fraud, and abuse, and to keep the Site and our systems secure.
Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in network and information security, including the use of your IP address for anti-spam rate limiting. The legitimate interest pursued is the protection of our Site and our systems from misuse, as recognised in Recital 49 of the GDPR.

d) To keep records needed to demonstrate compliance and, where necessary, to establish, exercise, or defend legal claims.
Legal basis: our legitimate interests (Article 6(1)(f) GDPR) and, where applicable, compliance with a legal obligation (Article 6(1)(c) GDPR), for example to evidence the consent you gave.

Providing your name and email is necessary to process a Request Access submission. If you do not provide them, we cannot review or respond to your request. The message field is optional.

Note for users in the United States

The United States does not use a "legal basis" model. Instead, we give you notice of what we collect and why, and we honor your rights as described in Section 9. We process your access-request data because you chose to submit it to us in order to be considered for access, and we send marketing email only where you have given affirmative opt-in consent.

Note for users in Brazil

For individuals located in Brazil, the Brazilian General Data Protection Law (LGPD, Lei nº 13.709/2018) applies to this processing. The legal bases (hipóteses) we rely on are: consent (Art. 7, I) for sending marketing communications; and legitimate interest (Art. 7, IX), assessed against your rights and freedoms, for operating the access list and responding to your request. We may also rely on compliance with a legal obligation (Art. 7, II) and the exercise of rights in proceedings (Art. 7, VI) to the limited extent needed to keep records.

5. Cookies, tracking, and local storage

This Site is deliberately clean. We want to be clear and accurate about it:

• We set no advertising cookies and no analytics cookies.
• We use no Google Analytics and no analytics tools of any kind.
• We use no advertising or marketing pixels.
• We use no social-media trackers.
• We use no third-party tracking of any kind.

The Site stores one functional item in your browser's local storage, named "ruj-lang". It remembers the language you chose (English, Portuguese, Spanish, or Italian). It contains no personal data, it is strictly functional, and it is exempt from consent requirements under European ePrivacy rules (Portugal's Lei nº 41/2004).

Your IP address, described in Section 3, is handled only for anti-spam and security, not for tracking or profiling.

6. Who has access to your data (recipients)

We do not sell your personal data, and we do not share it for cross-context behavioral or targeted advertising.

We use the following categories of recipients to operate the Site and our access list:

• Our hosting and email provider. Your personal data is stored in a self-hosted phpList (open-source mailing-list software) MySQL database that runs on our web hosting. Our hosting and outbound email infrastructure is provided by Bluehost (Newfold Digital), which is located in the United States. Bluehost acts as our processor (operator) and processes the data on our instructions.

When you submit the Request Access form, two emails are generated:

• An internal notification to hello@iamruj.com containing your name, email, message, IP address, and the time of submission.
• A branded confirmation email to you, sent from no-reply@iamruj.com.

We may also disclose personal data where required to comply with a legal obligation or a lawful request from a competent authority.

7. International data transfers

Because our hosting and email infrastructure is provided by Bluehost in the United States, your personal data is transferred to and stored in the United States. We rely on the following safeguards.

For transfers from the European Union and Portugal to the United States.
This transfer is governed by Chapter V of the GDPR. Our primary safeguard is the 2021 European Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two, controller-to-processor), incorporated into our data-processing agreement with our provider and supported by a transfer impact assessment and supplementary measures such as encryption in transit and at rest and access controls. Where, and only where, the specific receiving entity is actively self-certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023) for the relevant categories of data, that transfer may instead be covered by that framework's adequacy decision. You can request a copy of the relevant safeguards by writing to hello@iamruj.com.

For data of individuals located in Brazil.
The flow of your data from Brazil to us in Portugal benefits from the mutual adequacy recognition between Brazil and the European Union (ANPD Resolution CD/ANPD nº 32/2026, in force since 26 January 2026), so that leg needs no further mechanism. For the onward storage of your data on US infrastructure, we rely on the ANPD Standard Contractual Clauses (cláusulas-padrão contratuais) adopted by Resolution CD/ANPD nº 19/2024, incorporated into our agreement with our provider.

8. How long we keep your data (retention)

We keep personal data only for as long as necessary for the purposes described above, applying the principles of storage limitation and data minimization.

• Open or active access requests, and people on our list: we keep your name, email, and message while you remain a candidate for access or an active subscriber to our communications.
• Declined or inactive requests: if your request is declined or your entry becomes inactive, we delete or anonymize the related data within a defined window, normally no later than 12 to 24 months after the decision or last activity, unless you have asked to remain on our list.
• On unsubscribe or withdrawal of consent: we stop sending you communications promptly and delete your data, except that we may keep a minimal suppression record (such as a hashed email address) so that we can honor your opt-out.
• IP addresses: collected for anti-spam and security, kept only for a short period tied to that purpose and then deleted.
• Proof of consent and opt-out records: kept for as long as we rely on your consent and for a limited period afterward to demonstrate compliance and defend possible claims.

9. Your rights

You can exercise any of the rights below by writing to hello@iamruj.com. We will respond within the timeframes required by the law that applies to you. We will not discriminate against you for exercising your rights. We may need to verify your identity before acting on a request, and we may ask you for information necessary to confirm who you are.

9.1 Rights for users in the European Union and Portugal (GDPR)

You have the right to:

• Access your personal data and obtain a copy (Art. 15).
• Rectify inaccurate or incomplete data (Art. 16).
• Erase your data ("right to be forgotten"), for example after you withdraw consent (Art. 17).
• Restrict our processing of your data (Art. 18).
• Data portability, to receive the data you provided in a structured, commonly used, machine-readable format, where processing is based on consent and carried out by automated means (Art. 20).
• Object to processing based on our legitimate interests (Art. 21), and an absolute right to object to direct marketing at any time.
• Withdraw consent at any time, as easily as you gave it, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).

Where we rectify, erase, or restrict your data, we will notify recipients to whom the data was disclosed, where required and feasible (Art. 19).

9.2 Rights for users in the United States

Depending on your state of residence, you may have the right to:

• Know and access the categories and specific pieces of personal information we collect, the purposes, and the recipients.
• Delete your personal information, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale of your personal information and of sharing for cross-context behavioral or targeted advertising.
• Opt out of profiling that produces legal or similarly significant effects.
• Limit the use and disclosure of sensitive personal information.
• Portability, to receive your data in a usable format.
• Non-discrimination for exercising your rights.
• Appeal a decision we make on your request, where your state provides that right. If we deny your request, you may appeal by replying to our decision at hello@iamruj.com.
• Designate an authorized agent to submit a request on your behalf.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We run no advertising technology and no profiling. We do not collect sensitive personal information for any purpose beyond providing the service you requested. The rights to opt out of sale, sharing, targeted advertising, and profiling therefore do not apply in practice, but we state them so you have a complete picture. We will, where technically applicable, treat a Global Privacy Control (GPC) signal as a valid opt-out request even though we do not sell or share data.

We aim to respond to verifiable requests within the period required by your state law, typically within 45 days, with an extension where permitted.

California Notice at Collection

For California residents, at or before the point of collection we inform you of the following:

• Categories of personal information we collect: identifiers (your name, email address, and IP address) and the content of any optional message you choose to send.
• Purposes: to review and respond to your access request, to contact you about RÜJ where you have consented, and for security and anti-spam.
• Sale or sharing: we do not sell your personal information and do not share it for cross-context behavioral advertising.
• Sensitive personal information: we do not collect sensitive personal information for any purpose beyond providing the requested service.
• Retention: as described in Section 8.

This Notice at Collection is provided through this Privacy Policy, which is linked at the Request Access form.

9.3 Rights for users in Brazil (LGPD, Art. 18)

You have the right to:

• Confirmation that we process your data (Art. 18, I).
• Access your data (Art. 18, II).
• Correction of incomplete, inaccurate, or out-of-date data (Art. 18, III).
• Anonymization, blocking, or elimination of unnecessary, excessive, or unlawfully processed data (Art. 18, IV).
• Portability of your data to another provider, on express request and as regulated by the ANPD (Art. 18, V).
• Elimination of personal data processed with your consent, subject to the legal retention exceptions in Art. 16 (Art. 18, VI).
• Information about the entities with which we have shared your data (Art. 18, VII).
• Information about the possibility of refusing consent and the consequences of refusal (Art. 18, VIII).
• Withdraw consent at any time (Art. 18, IX, and Art. 8 §5).
• Petition the ANPD and consumer-protection bodies (Art. 18 §1 and §2).

If a decision affecting you were ever taken solely by automated processing, you would have the right to request a review (Art. 20). We do not take such decisions (see Section 12).

As a small enterprise, we may have doubled deadlines to respond to requests under Brazilian rules, but we will always act on your request.

10. Marketing email and how to unsubscribe

We send RÜJ communications by email only to people who gave consent through the Request Access form. The consent checkbox is separate from, and not pre-ticked into, the act of submitting your access request.

Every marketing email we send:

• Clearly identifies us as the sender (KULTR Unipessoal, Lda. / RÜJ) and does not disguise the sender's identity.
• Includes our valid postal contact address.
• Contains a working, free, easy unsubscribe mechanism.

You can unsubscribe at any time by using the unsubscribe link in any email, or by writing to hello@iamruj.com. We honor opt-outs promptly. For United States recipients, we honor opt-out requests within 10 business days, as required by the CAN-SPAM Act, and we do not use deceptive headers or subject lines.

Withdrawing consent

Withdrawing consent is as easy as giving it. Use the unsubscribe link, or email hello@iamruj.com. Withdrawing consent does not affect the lawfulness of any processing we carried out before you withdrew it.

11. How we protect your data (security)

We apply appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or disclosure. These measures include access controls and encryption in transit and at rest, and we require our processor to maintain appropriate safeguards. No method of transmission or storage is completely secure, but we work to protect your data in line with the risk.

12. No automated decision-making

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. Decisions about access requests are made by people.

13. Children

The Site and RÜJ are intended for adults and hospitality professionals. The Site is not directed to children, and we do not knowingly collect personal data from children under 13 (or the higher age set by applicable local law). If you believe a child has provided us with personal data, please contact hello@iamruj.com and we will delete it.

14. Complaints and how to reach a regulator

We would like the chance to resolve any concern first, so please contact us at hello@iamruj.com. You also have the right to complain to a supervisory authority.

European Union and Portugal.
You may lodge a complaint with the Portuguese supervisory authority:
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal
Telephone: (+351) 213 928 400
Email: geral@cnpd.pt
Website: https://www.cnpd.pt
You may also complain to the supervisory authority in your country of habitual residence or place of work, and you have the right to an effective judicial remedy.

United States.
California residents may contact the California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General (oag.ca.gov/privacy/ccpa). Residents of other states may contact their State Attorney General. Complaints about commercial email or about children's privacy may be made to the Federal Trade Commission (reportfraud.ftc.gov).

Brazil.
You may petition the Autoridade Nacional de Proteção de Dados (ANPD), an independent regulatory agency, through its electronic channel on the gov.br portal (gov.br/anpd).

15. Changes to this Policy

We may update this Privacy Policy from time to time. The version in force is the one published on the Site with the effective date shown at the top. If we make material changes, we will update the effective date and, where appropriate, take additional steps to inform you. Please review this Policy periodically.

Effective date: 26 June 2026.

16. Contact

For any question or request about this Policy or your personal data, contact:
hello@iamruj.com
KULTR Unipessoal, Lda., Estrada Nacional 10, Edifício Jardim Parque, Lote A e B, Piso 0, Loja 1, 2615-129 Alverca do Ribatejo, Portugal.