What we collect, where it goes, and how long we keep it.

Who we are

BORICH Thai Coffee is operated by Borich Thai Coffee, a Thai limited company registered in Thailand. We are responsible for the information described on this page.

For anything on this page — including a request to see, correct or delete what we hold — email hello@borichthaicoffee.com.

What we collect, and why

It all comes from you, typed into the sample request form. We do not buy lists and we do not collect information about you from anywhere else.

Café or business name

To know which café is asking.

Your name

So a reply is addressed to a person.

Email

The only way we answer you.

City and state

To work out what we can offer where you are.

Country optional

Only if you are outside Australia.

Website or social link optional

Optional, and only so we can look at your café.

Anything you’d like us to know optional

Optional, and only what you choose to write.

Those are the fields we ask for. We do not ask for a phone number, a street address, or anything about your equipment or volumes. Leaving an optional field blank changes nothing except how much we know before replying; leaving a required one blank means we cannot answer you.

The free-text box is there for notes about your café. Please don’t put sensitive personal information in it — health details, government identifiers, payment details. We don’t need any of it, and an email inbox is the wrong place for it.

Separately, every visit to any website carries technical information with it: your IP address, your browser and which pages you asked for. That reaches our host in order to serve you the page, and is covered below.

How we use it

To read your request, reply to it, and talk with you about supplying your café — including sending a sample kit if that is what you have asked for. We handle it because you asked us to get in touch, and because answering a wholesale enquiry is an ordinary part of running this business.

Asking for samples is not signing up to anything. There is no newsletter, no mailing list and no automatic marketing. Sending a request does not give us permission to market to you, and we do not treat it as if it did. If we ever start a mailing list it will be something you opt into deliberately, and it will not be built from these requests. We do not sell your information, and we do not use it for advertising.

Who handles it, and where

Our inbox is read by two people, both in Thailand. Three service providers sit between the form and that inbox, and each of them is handling your request on our behalf under their own data-processing terms:

Cloudflare

Hosts this website and runs the request form.

Handles Technical details of every request, and your form while it is in transit.

Where Handled at whichever of Cloudflare’s data centres is nearest the visitor.

Keeps it Operational logs for up to 7 days, then deleted automatically.

Resend

Sends your request to our inbox as an email.

Handles The contents of your request, as the body of that email.

Where Stored in the United States.

Keeps it 30 days, plus backups held for 7 days.

Google Workspace

Hosts the BORICH email inbox.

Handles The request you send and the email conversation that follows it.

Where Google operates global infrastructure, and information may be processed or stored outside Thailand.

Keeps it As long as BORICH keeps the email under the rules below, subject to Google’s own service and recovery systems.

So your request is handled outside the country you are in. It is sent through a provider that stores it in the United States; our email is hosted by Google, which runs infrastructure around the world; and the inbox itself is read in Thailand. We cannot promise your request stays in one country, because it does not.

Beyond those providers, we share your information only when it is actually needed: if you order coffee and it has to be shipped, the logistics or fulfilment provider handling that shipment will get what they need to deliver it. That happens when there is a real shipment, not by default, and not for an enquiry. We do not otherwise pass your information to anyone, and we will not sell it.

How long we keep it

If your enquiry does not lead to supply, we keep it for up to 12 months after the last meaningful message between us, and then delete it — unless there is a legal or otherwise legitimate reason to keep it longer. Twelve months is long enough for a café to taste, think about it, and come back a season later; it is short enough that our inbox does not quietly become a database of cafés that never replied.

If your café becomes a customer, your details become part of that business relationship, and we keep what we need for as long as we need it — to run the account, and for accounting, tax, contractual, dispute and compliance purposes. Some of those records we are obliged to keep for years, and we will not delete them on request while that obligation stands. We will always tell you if that is the reason.

Deleting from an inbox is not instant everywhere. Our sending provider holds its own copy for 30 days and backups for 7, and our email host has its own recovery window, so a deleted message finishes disappearing on those schedules rather than the moment we press delete.

Your choices

Whoever you are and wherever you are, you can email us at hello@borichthaicoffee.com and ask us to:

• tell you what we hold about you;
• correct something that is wrong;
• delete it;
• stop using it in a particular way, or object to how we are using it.

We will take any genuine request seriously and aim to reply within 30 days, sooner where we can, and within whatever time the law that applies to your request requires. We may need to check you are who you say you are before we hand anything over, and we may have to keep records we are obliged to keep — we will say so plainly rather than quietly ignore that part of the request.

Depending on where you live, local law may give you further rights than the four above. Tell us what you want and we will do what applies. If you are unhappy with how we have handled it, please tell us first so we can try to put it right; you are also free to raise it with the data protection or privacy authority where you live.

Keeping it safe

Your request travels to us over an encrypted connection, and onward between our providers over theirs. The website has no database, no file storage and no customer-management system attached to it, so apart from the short-term provider copies described above, the email in our inbox is the record — and only the people described above can open it.

Our own server logs record whether a request succeeded and which fields were filled in. They never contain what you typed. We never ask for payment details through this site.

No system is perfect, and we are not going to pretend otherwise. What we can say is that we hold as little as we can, in as few places as we can, for as short a time as we can.

Cookies and website technologies

This site sets no cookies of its own and stores nothing in your browser. There is no analytics, no advertising, no tracking pixels, no social or video embeds, no chat widget and no session recording. Even the fonts are served from our own domain rather than someone else’s, so reading these pages does not announce you to a third party.

Cloudflare, which hosts the site, may set a short-lived cookie whose only job is to tell automated abuse from real visitors. It is not used to identify you, profile you, or follow you to other sites.

That is why there is no cookie banner here. There is nothing to consent to and nothing to switch off, and a banner asking you to agree to nothing would be theatre.

Changes to this page

This page describes how BORICH works today. When that changes — a new provider, a different inbox, a shipping partner who starts receiving addresses — we update this page rather than leave it describing something else. If a change materially affects what happens to information you have already sent us, we will tell the people affected rather than rely on you re-reading this.

Last updated 19 October 2026.