Privacy Policy
This is a considered draft, prepared in house on 24 August 2026. The processors listed below were checked against what the website actually does, rather than copied from a template. It has not yet been reviewed by a solicitor, and we will have it reviewed before launch.
This policy explains what Kiguland LTD does with your personal data when you use www.kiguland.co.uk, and what you can do about it. We have tried to write it in plain English rather than in the language of a data protection seminar.
1. Who is responsible for your data
The controller of your personal data is Kiguland LTD, registered in England and Wales under company number 16963198, registered office Unit 10 Enterprise Court, Farfield Park, Manvers, Rotherham, S63 5DB, England, United Kingdom. KIGULAND is our trading name.
To ask us anything about your data, or to exercise any of the rights described below, use our contact form and say that your message is about personal data. We have not appointed a data protection officer: we are not required to, and enquiries come straight to the people who run the shop.
We sell only to customers in the United Kingdom, and the shop is not intended for children. We do not knowingly collect data from anyone under 16. If you think a child has given us data, tell us and we will delete it.
2. What we collect and why
The table below is the full picture: what we collect, what we do with it, and the lawful basis under Article 6 of the UK GDPR that lets us do it.
| What we collect | What we use it for | Lawful basis |
|---|---|---|
| Name, email address, delivery address, phone number | Taking your order, dispatching it, giving the courier what it needs, and sending you order and delivery updates | Performance of a contract with you |
| Order contents, order value, order number, delivery choice | Fulfilling and tracking the order, handling returns, exchanges and complaints | Performance of a contract with you |
| Payment confirmation, the last four digits and card brand, the payment reference from Stripe | Confirming payment, issuing refunds, investigating chargebacks and fraud | Performance of a contract, and our legitimate interest in preventing fraud |
| Invoice and VAT details, transaction records | Issuing receipts and invoices and keeping the accounting records we are required to keep | Legal obligation |
| Account email address and a hashed password, saved addresses, order history | Running your account if you choose to create one | Performance of a contract with you |
| The content of your messages to us, and our replies | Answering enquiries, handling complaints, and keeping a record of what was agreed | Performance of a contract, and our legitimate interest in running the shop properly |
| Product reviews, ratings and any photograph you attach, with the name you choose to display | Publishing reviews on the product page | Consent, which you give when you submit the review |
| Marketing preference and email address | Sending you offers and news about our products by email, where you asked for them | Consent, which you can withdraw at any time |
| IP address, browser and device information, pages viewed, error reports | Keeping the site secure and working, spotting abuse, and diagnosing crashes and bugs | Our legitimate interest in a secure and functioning website |
| Analytics and advertising identifiers, referral source, campaign parameters, purchase events | Understanding how the shop is used, measuring our advertising and improving what we sell | Consent, given through the cookie banner |
Where our basis is legitimate interests, we have weighed our interest against your rights, and you can object at any time using the contact form.
We do not process special category data. We do not carry out profiling or automated decision-making that produces legal effects for you or similarly significantly affects you. We do not sell your data, and we do not pass it to anyone else for their own marketing.
We never see or store your full card number. Card details go directly from your browser to Stripe.
3. Who processes data for us
We use a small number of service providers, and each of them acts on our instructions under a written contract that meets Article 28 of the UK GDPR. This is the actual list, checked against the code that runs the shop.
| Who | What they do | What they receive |
|---|---|---|
| Stripe | Takes card, Apple Pay and Google Pay payments, and processes refunds | Payment amount and currency, your name, billing and delivery address and email address, plus the card data you enter directly with them |
| Amazon Web Services (Simple Email Service) | Sends our transactional email: order confirmations, dispatch notices, replies to enquiries | Your email address, name, order number and order details, and the delivery address shown in the email |
| Baselinker | Our order management and fulfilment system, which passes orders to the warehouse and the couriers | Your name, email address, phone number, delivery address, invoice details and the items ordered |
| Funky Planet Ltd | Our fulfilment partner, which picks, packs, dispatches orders and receives returns | Your name, delivery address and the items in your order |
| Delivery couriers | Deliver your parcel and, where you choose one, show available collection points | Your name, delivery address, phone number or email for delivery notifications, and, for the collection point finder, the postcode or location you enter |
| OpenStreetMap Foundation (Nominatim) | Suggests addresses while you type at checkout | The address text you type. The request is made by our server, so your IP address is not passed on |
| Google (Analytics 4 and Google Ads) | Website analytics and advertising measurement, used only if you accept analytics or marketing cookies | Online identifiers, pages viewed, referral and campaign data, and purchase events. Where enhanced conversion measurement is switched on, contact details are hashed before being sent |
| Sentry | Error and performance monitoring, so we can find and fix crashes | Technical error data: the page and the request involved, browser and device information, and the IP address the request came from. Authentication and cookie headers are stripped before sending |
| Typesense | Powers search on the shop | The product catalogue and the search term you type. No account or order data |
| Our object storage and hosting | Stores the shop's database, files and images and serves the website | Everything above that we hold, at rest |
| Slack | Receives operational alerts and a daily summary for our team | Aggregate figures and order references, not your name or email address |
| Our accountants and professional advisers | Bookkeeping, tax and legal advice | Transaction records, and correspondence where it is relevant to advice |
Some of these services are only active when they have been configured. If Google Analytics, Google Ads or Sentry are switched off for the site, nothing is sent to them at all.
We may also disclose personal data where the law requires it, to establish, exercise or defend legal claims, to prevent fraud, or to a buyer if we ever sell the business. If that last one happens, we will say so on this page.
4. Sending data outside the UK
Some of our providers process data outside the United Kingdom, mainly in the European Economic Area and the United States.
Where data goes to a country covered by UK adequacy regulations, including the EEA, that regulation is the safeguard. Where it goes to the United States, we rely on the UK International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission's standard contractual clauses, and on the UK extension to the EU-US Data Privacy Framework where the provider is certified under it. Stripe, Amazon Web Services, Google and Sentry are the providers this applies to.
You can ask us for a copy of the safeguards we rely on for any specific transfer through the contact form.
A review you publish on the site can be read anywhere in the world, because the site is public.
5. How long we keep it
We keep personal data only as long as we need it, then delete it or reduce it to anonymous figures.
| What | How long | Why |
|---|---|---|
| Order, invoice and payment records | Six years from the end of the financial year the order falls in | The record-keeping periods required by HMRC for VAT and company accounts |
| Account data, including saved addresses | Until you close the account, or after three years of inactivity, whichever comes first | We do not need it once you have stopped using the account |
| Enquiries, complaints and returns correspondence | Two years after the matter is closed, or six years where it relates to a claim | So we can answer follow-up questions, and defend claims within the limitation period |
| Marketing consent and mailing list membership | Until you unsubscribe or withdraw consent, plus a permanent suppression record so we do not email you again | Consent, and evidence that we honoured your opt out |
| Published reviews | Until you ask us to remove yours, or the product is withdrawn | Consent |
| Analytics data | Up to 14 months in Google Analytics, and the underlying cookies expire within two years | Consent, and Google's own retention settings |
| Error monitoring data in Sentry | 90 days | Long enough to diagnose a bug, no longer |
| Server and security logs | Up to 12 months | Security and abuse investigation |
Where we must keep a record for tax purposes we keep it even if you ask us to delete your account, because a legal obligation overrides the request. We keep only what the obligation needs.
6. Your rights
Under the UK GDPR you have the right to:
- be told what we do with your data, which is what this policy is for;
- get a copy of the personal data we hold about you;
- have it corrected if it is wrong or incomplete;
- have it erased, where we no longer need it and no legal obligation requires us to keep it;
- restrict what we do with it while a dispute about accuracy or our grounds is sorted out;
- object to processing we base on legitimate interests, and to direct marketing at any time and without giving a reason;
- receive your data in a portable form, where we process it by automated means on the basis of consent or a contract;
- withdraw consent at any time, which does not affect anything we did with your data before you withdrew it.
To use any of these rights, send us a message through the contact form. We answer within one month. If a request is complicated we may take up to two further months, and if we do we will tell you why within the first month. We do not charge a fee unless a request is clearly unfounded or excessive. We may ask you to confirm your identity before we hand over personal data, and we will ask only for what we need to be sure.
Every marketing email we send has an unsubscribe link that works immediately, so you do not have to contact us to stop them.
8. How we protect your data
The site runs over HTTPS, account passwords are stored hashed rather than in readable form, and access to the admin system and the database is limited to the people who need it.
Card payments are handled entirely by Stripe, which is PCI DSS compliant, so card numbers never reach our systems.
No transmission over the internet is completely secure, and we cannot promise absolute safety. If a breach happens that is likely to be a risk to your rights and freedoms, we will tell the Information Commissioner's Office within 72 hours and, where the risk is high, tell you too.
9. Complaints
If you are unhappy with how we have handled your data, tell us first through the contact form and we will try to put it right.
You also have the right to complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk or on 0303 123 1113. You can complain to the ICO without coming to us first.
10. Changes to this policy
We update this policy when what we do with data changes, for example if we add or drop a provider. The date at the bottom tells you when the current version was drafted.
If a change matters to you, for instance a new purpose for data we already hold, we will tell you by email where we have your address, and ask for fresh consent where consent is the basis.
Our details
Kiguland LTD
Registered office: Unit 10 Enterprise Court, Farfield Park, Manvers, Rotherham, S63 5DB, England, United Kingdom
Registered in England and Wales, company number 16963198
VAT registration number GB511424732
Data protection enquiries: use our contact form and mark the message for the attention of the data protection contact.
Drafted in house on 24 August 2026. Considered draft, pending solicitor review before launch.