Privacy policy

The controller of your personal data is ⟨ legal name ⟩, trading as Kensjero, registered in ⟨ country of registration ⟩ under registration number ⟨ registration number ⟩, VAT ⟨ VAT number ⟩.

Registered office: ⟨ registered address ⟩.

For any question about this policy, or to exercise the rights set out below, write to ⟨ contact email ⟩.

We collect only what an order or an enquiry actually requires.

• Order data — your name, email address, delivery and billing address, telephone number where given, and the items ordered. Collected to perform the contract of sale. Without it we cannot accept or deliver an order.
• Payment data — handled entirely by our payment providers. We never see or store your full card number. We receive only the result of the transaction and the last digits of the card.
• Correspondence — anything you send us by email, kept so we can answer you and resolve any dispute about an order.
• Technical data — IP address and browser information, processed by our hosting and commerce providers to serve the site securely and prevent fraud. Our legitimate interest.

• Performance of a contract (Art. 6(1)(b) GDPR) — processing your order, taking payment, arranging delivery, handling returns.
• Legal obligation (Art. 6(1)(c)) — retaining invoices and transaction records for the statutory accounting period.
• Legitimate interests (Art. 6(1)(f)) — securing the site, preventing fraudulent orders, and defending legal claims.
• Consent (Art. 6(1)(a)) — marketing email, where you have opted in. You may withdraw consent at any time; every message carries an unsubscribe link, and withdrawing does not affect processing carried out before you withdrew.

We use a small number of processors, each bound by a data processing agreement and each permitted to use your data only on our instructions.

• Shopify — commerce platform. Holds the order record, the customer record and processes checkout.
• Payment providers — take and settle payment. They are independent controllers for anti-fraud and regulatory purposes.
• Carriers — receive the name, address and telephone number needed to deliver, and customs data where a shipment crosses a border.
• Hosting and email providers — serve this site and carry our correspondence with you.

We do not sell personal data, and we do not share it for anyone else's marketing.

Some providers process data outside the European Economic Area. Where they do, the transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses together with any supplementary measures required. You may request a copy of the safeguards applying to a particular transfer.

• Order and invoice records — for the statutory retention period applicable to accounting records in our country of registration, currently seven years in the Netherlands and Belgium.
• Correspondence not attached to an order — two years from our last exchange.
• Marketing consent and the record of it — until you withdraw consent, and for two years afterwards as evidence that consent was validly obtained.
• Technical logs — retained by our providers on their own short cycles, typically no more than ninety days.

Under the GDPR you may require us to:

• confirm whether we hold data about you, and give you a copy of it;
• correct anything inaccurate;
• erase your data, where we have no overriding legal obligation to keep it;
• restrict how we process it while a dispute about accuracy or legitimacy is resolved;
• provide it in a portable, machine-readable form, or send it to another controller;
• stop processing carried out on the basis of legitimate interests, where your circumstances outweigh them;
• stop sending you marketing, at any time and without giving a reason.

Write to ⟨ contact email ⟩ and we will respond within one month. We do not charge for this.

If you are unsatisfied with our response you may complain to ⟨ supervisory authority ⟩, or to the supervisory authority where you live.

This site sets only what it needs to function: a cookie holding your shopping bag so it survives a page reload, and cookies set by Shopify during checkout to keep your session secure. These are strictly necessary and do not require consent.

We do not currently run advertising or analytics cookies. If that changes, this page will be updated and you will be asked to consent before any non-essential cookie is set.

When this policy changes we update the date at the top. If a change materially affects your rights we will tell you directly, where we hold an address for you.