Privacy Policy

1. Data controller

The controller of your personal data is:

2. Types of data collected

We collect and process the following categories of personal data:

2.1 Data you provide

• Account data: Name, email address, password (encrypted), phone number
• Order data: Shipping address, billing address, payment information
• Communication data: Messages sent through our contact form, customer service requests
• Review data: Product reviews and ratings you submit

2.2 Data collected automatically

• Technical data: IP address, browser type and version, device type, operating system
• Usage data: Pages visited, time spent on pages, click patterns, search queries
• Location data: Country and city (derived from IP address)
• Referral data: The website that referred you to us

2.3 Data from third parties

• Payment providers: Transaction confirmations and fraud prevention data
• Social networks: Profile information if you connect your social media accounts
• Address verification: Address validation through postal services

3. Purposes of processing

We process your personal data for the following purposes:

4. Legal basis for processing

We process your personal data on the following legal bases:

4.1 Performance of the contract (Art. 6(1)(b) GDPR)

The processing is necessary for the performance of the sales contract or for the execution of pre-contractual measures taken at your request (for example, account creation, order processing).

4.2 Consent (Art. 6(1)(a) GDPR)

Where you have given us your explicit consent, for example to receive our newsletter or to allow certain cookies. You may withdraw your consent at any time.

4.3 Legitimate interest (Art. 6(1)(f) GDPR)

The processing is necessary for our legitimate interests, such as fraud prevention, the security of the website and the improvement of our services, provided that these interests are not overridden by your rights.

4.4 Legal obligation (Art. 6(1)(c) GDPR)

The processing is necessary to comply with legal obligations, such as tax and accounting requirements.

5. Data retention

We retain your personal data only as long as necessary to fulfil the purposes for which it was collected, or in accordance with legal requirements:

• Order data: 10 years (statutory retention period for commercial and tax documents)
• Account data: Until the account is deleted, plus 30 days for backups
• Newsletter data: Until you unsubscribe
• Analytics data: Maximum 26 months
• Server logs: 7 days
• Customer support tickets: 3 years

6. Your rights

Under the GDPR, you have the following rights regarding your personal data:

6.1 Right of access (Art. 15 GDPR)

You have the right to obtain confirmation as to whether or not we process your personal data and, where applicable, to access this data and receive a copy.

6.2 Right to rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate personal data and the completion of incomplete data.

6.3 Right to erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data in certain circumstances, in particular when the data is no longer necessary for the purposes for which it was collected.

6.4 Right to restriction of processing (Art. 18 GDPR)

You have the right to request restriction of processing in certain circumstances, for example while we verify the accuracy of your data.

6.5 Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used and machine-readable format, and to transmit this data to another controller.

6.6 Right to object (Art. 21 GDPR)

You have the right to object to the processing of your personal data based on legitimate interest, including profiling. You can object to direct marketing at any time.

6.7 Right to withdraw consent (Art. 7(3) GDPR)

Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing prior to the withdrawal.

6.8 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. The competent authority for us is:

To exercise any of these rights, please contact us at: privacy@kashiku.com

7. Cookie policy

Our website uses cookies and similar technologies. Cookies are small text files stored on your device that help us provide and improve our services.

7.1 Types of cookies we use

7.2 Cookie management

You can manage your cookie preferences via our cookie settings panel, accessible via the cookie icon at the bottom left of the website. You can also configure your browser to block or delete cookies.

8. Third-party services

We use the following third-party services that may process your personal data:

8.1 Payment providers

• Stripe (United States) – Credit card processing. Privacy policy: stripe.com/privacy
• PayPal (Luxembourg) – PayPal payments. Privacy policy: paypal.com/privacy
• Klarna (Sweden) – Pay later. Privacy policy: klarna.com/privacy

8.2 Shipping partners

• DHL (Germany) – Delivery and parcel tracking
• UPS (United States) – Express delivery
• DPD (United States) – European delivery

8.3 Analytics and marketing

• Google Analytics (United States) – Website analytics with IP anonymisation enabled
• Meta Pixel (United States) – Advertising measurement (with consent only)
• Mailchimp (United States) – Email marketing (newsletter subscribers)

8.4 International data transfers

Some of our third-party service providers are located outside the European Economic Area (EEA). We ensure that appropriate safeguards are in place, in particular:

• EU-US Data Privacy Framework certification
• Standard contractual clauses approved by the European Commission
• Binding corporate rules

9. Data security

We implement appropriate technical and organisational measures to protect your personal data, including:

• SSL/TLS encryption for all data transmissions
• Encrypted storage of sensitive data
• Regular security audits and penetration testing
• Access controls and employee training
• Secure data centres within the EU

10. Protection of minors' data

Our website and services are not intended for children under 16. We do not knowingly collect personal data from children under 16. If we learn that we have collected data from a child under 16, we will take steps to delete this information as soon as possible.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will inform you of any significant changes by email or by a prominent notice on our website. We encourage you to review this policy regularly.

12. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us: