Your data, in plain words
What we collect when you shop, join the waitlist or write to us, why we need it, who sees it, and how to get it back or deleted.
Only what’s needed
We ask for what it takes to make and ship your piece. Nothing more.
Never sold
We don’t sell or rent your data, and we don’t use ad trackers.
Emails by choice
Drop emails only if you tick the box. One click stops them.
Yours to control
Ask for a copy, a fix or deletion at any time. We reply within a month.
§01 Who is responsible for your data
The controller of your personal data is Kagenoishi, a jewelry studio based in Warsaw, Poland. The controller decides why and how your data is used and is responsible for it under the EU General Data Protection Regulation (GDPR, known in Poland as RODO). We have not appointed a Data Protection Officer, because the law does not require it for a business of our size. For anything about your data, write to hello@kagenoishi.com.
§02 What data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Order data | Name, email, phone, delivery address, ordered pieces, ring size, notes, promo code, order amount | You, at checkout |
| Payment data | Payment method, status and transaction ID. We never see or store your full card details. | Stripe, our payment provider |
| Shipping data | Carrier, tracking number, customs declaration for orders outside the EU | Us and the carrier |
| Account data | Your email and a one-time sign-in link | You, when you sign in to My orders |
| Waitlist and newsletter | Email, optional phone, and the time of your consent | You, on our forms |
| Messages | What you write to us by email, the contact form or Instagram, and our replies | You |
| Technical data | IP address, browser type, data in your browser storage | Your device, automatically |
Giving us your data is voluntary, but without order data we cannot accept and deliver an order, and without an email we cannot add you to the waitlist.
§03 Why we use it and on what legal basis
| Purpose | Legal basis | How long we keep it |
|---|---|---|
| Taking, making and delivering your order, including order updates | Art. 6(1)(b), performing the contract | Until the order is completed, then as below |
| Invoices, accounting and tax records | Art. 6(1)(c), legal obligation | 5 years from the end of the year in which the tax became due |
| Returns, complaints, warranty and legal claims | Art. 6(1)(f), our legitimate interest | Until the claims expire under the Polish Civil Code |
| My orders account and sign-in | Art. 6(1)(b), performing the contract | Sign-in link: 15 minutes. Session: 30 days in your browser |
| Waitlist, early access and newsletter | Art. 6(1)(a), your consent | Until you withdraw consent or ask us to delete it |
| Answering your messages | Art. 6(1)(b) or (f) | Up to 2 years after our last conversation |
| Website security and abuse prevention | Art. 6(1)(f) | Short-lived records, up to 30 days |
| Giveaways on Instagram | Art. 6(1)(f) | Until the winner is announced and the prize is delivered |
§04 Who we share it with
We never sell your data. We share it only with providers that help us run the shop, under a data processing agreement:
- Cloudflare: hosting the website, our order database, file storage and form protection.
- Resend: sending emails, such as order updates, sign-in links and the waitlist.
Some recipients use your data as independent controllers, under their own privacy policies: Stripe to process your payment; carriers and postal operators to deliver your parcel; customs authorities for orders outside the EU; our accountant and public bodies when the law requires it; and Instagram (Meta) when you take part in a giveaway or message us there.
§05 Transfers outside the EEA
Some providers, including Cloudflare, Stripe, Resend and Meta, may process data outside the European Economic Area, for example in the United States. The transfer is then protected by an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework (Art. 45 GDPR), or by Standard Contractual Clauses (Art. 46 GDPR). You can ask us for a copy of these safeguards.
§06 Your rights
We reply within one month. If a request is complex, we may extend this by two more months and tell you why.
Access · Art. 15
Get a copy of your data and know how we use it.
Correction · Art. 16
Fix data that is wrong or incomplete.
Deletion · Art. 17
Ask us to delete your data, unless we must keep it by law.
Restriction · Art. 18
Ask us to pause using your data.
Portability · Art. 20
Get your data in a machine-readable file.
Objection · Art. 21
Object to use based on our legitimate interest.
Withdraw consent · Art. 7(3)
Stop waitlist and newsletter emails. This does not affect anything we did before you withdrew it.
Complaint · Art. 77
Complain to the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. If you live in another EU country, you can also contact the authority there.
To use a right, write to hello@kagenoishi.com from the email you used with us, and add your order number if you have one.
§07 Waitlist and newsletter emails
We send emails about the waitlist, early access and new drops only if you ticked the consent box and confirmed your address. The box is never ticked for you, and we keep a record of when you gave consent. Every email has a one-click unsubscribe link. Emails about an order you placed (confirmation, shipping, sign-in links) are part of the service and are not marketing.
§08 Cookies and browser storage
We use only what the site needs to work. We do not use advertising cookies or tracking pixels.
| Name | What it does | How long |
|---|---|---|
| kg-cart | Remembers the pieces in your cart | Until you clear it or place the order |
| kg-session | Keeps you signed in to My orders | 30 days, or until you sign out |
| kg-access | Remembers that you entered the drop password | Until the drop opens to everyone |
| kg-region, kg-size | Remember your shipping region and ring size | Until you clear your browser data |
Storage that is strictly necessary for a service you asked for does not need your consent. If we ever add analytics or marketing cookies, we will ask first and update this policy.
§09 How we protect your data
- The whole site uses encrypted connections (HTTPS).
- You sign in to My orders with a one-time link sent to your email, so nobody else can see your orders.
- Only Kagenoishi staff can open the order system.
- Customs documents are kept in private storage.
- Providers get only the data they need for their task.
§10 Other things to know
No automated decisions. We do not make decisions about you by automated means or profiling. Children. Our shop is meant for adults; if you are under 16, please ask a parent or guardian to order for you. Links. Instagram, carriers and Stripe have their own privacy policies.
§11 Changes to this policy
We may update this policy when our shop or the law changes. If a change is significant, we will tell you by email when we can.
Version 2.0 · draft for the new website, to be checked before launch.