Legal
Privacy Policy
What we collect, why we collect it, and how to get it back or get rid of it.
Who we are
Kinship is the data controller for the personal data described on this page. You can reach our data protection contact at privacy@kinship.example or by post at our registered office.
TO CONFIRM: registered company name, company number, registered office address and the real privacy contact address. These are legally required on this page and cannot be drafted.
What we collect
- Account details — your name, email address, and password, stored hashed.
- Order details — what you bought, where it went, and the last four digits of the card. We never see or store the full card number; that stays with our payment processor.
- Delivery details — the addresses and phone number you give us, which we pass to the carrier.
- Contact history — emails and messages you send us, and our replies.
- Technical data — IP address, browser, device and pages viewed, collected only if you accept analytics cookies.
Why we hold it, and on what basis
| Purpose | Lawful basis | Kept for |
|---|---|---|
| Fulfilling your order | Performance of a contract | 7 years (tax law) |
| Handling a return or a query | Performance of a contract | 7 years |
| Fraud and authentication checks | Legitimate interests | 7 years |
| Marketing email | Consent | Until you unsubscribe |
| Analytics and site improvement | Consent | 26 months |
Where we rely on legitimate interests, the interest is running a resale business that does not sell counterfeit goods or ship them to a stolen card. We have balanced that against your rights and can share the assessment on request.
Who else sees it
Processors acting on our instructions only, and never for their own purposes: our payment processor, our carriers, our email provider and our hosting provider. We do not sell personal data, and we do not share it with other retailers or with data brokers.
TO CONFIRM: the named sub-processors, once the client has chosen a payment provider, carrier and email platform. Each must be listed by name here, with the country it processes in.
Where it goes
We are based in the United Kingdom and prefer processors inside the UK or the EEA. Where data does travel further — a US email platform, for example — the transfer runs on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
Your rights
You can ask us to:
- Show you what we hold about you, in a portable format.
- Correct anything that is wrong.
- Delete what we are not legally required to keep.
- Stop using it for marketing, at any time, in one click.
- Restrict or object to a particular use.
Write to the address at the top of this page and we will respond within one month. If you are not satisfied with how we handle it, you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
Necessary cookies keep your bag and your region between pages and cannot be turned off — without them the site does not work. Everything else is off until you say otherwise, and you can change your mind whenever you like from the cookie settings link in the footer.