Personal Data Protection
This Privacy and Personal Data Protection Policy has been developed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("EU GDPR"), and the United Kingdom General Data Protection Regulation ("UK GDPR").
Following the United Kingdom's withdrawal from the European Union, the provisions of the GDPR were incorporated into UK domestic law and operate as the UK GDPR, alongside the UK Data Protection Act 2018.
In this Policy, the term "GDPR" collectively refers to the EU GDPR and the UK GDPR, to the extent that they apply to the processing of personal data by Ksisters Sp. z o.o.
This Policy sets out how your personal data is collected, used, and protected in connection with your use of the website: https://ksisters.uk, (hereinafter the Website), as well as when purchasing goods and receiving services from us. Personal data is used and protected whether collected through the Website or via any other form of interaction with us (for example, through our customer service line or web chat), including your ongoing participation in our loyalty program.
This means that when processing personal data, Ksisters Sp. z o.o. adheres to the principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, data minimization, accuracy, integrity, and confidentiality.
The controller of personal data is Ksisters Sp.z o.o. registered at 50 Novogrodzka street, office 515, Warsaw, code 00-695, entered in the National Court Register, which is maintained by the district court in the city of Warsaw, 12th commercial department of the National Court Register under number WA.XII NS -REJ.KRS/19689/21/434, with authorized capital of PLN 5,000.00 (paid in full), REGON No. 388839360, NIP No. PL7011031806, KRS: 0000894651 (Ksisters), states that all personal data (further also "data") is considered strictly confidential and processed in accordance with applicable legal provisions in the area of personal data protection.
Ksisters Sp. z o.o. processes personal data in accordance with applicable data protection legislation, in particular the GDPR and the UK Data Protection Act 2018, to the extent that these regulations apply to such processing.
The transfer of personal data between the European Union and the United Kingdom is carried out in accordance with applicable data protection legislation, specifically on the basis of adequacy decisions and other applicable transfer mechanisms provided for by the GDPR and UK GDPR.
Ksisters Sp. z o.o. is the controller of your personal data in connection with online sales, product delivery, and fraud prevention.
The personal data processing may be delegated by Ksisters to a processor. For any information regarding the personal data processing, including a list of Ksisters data processors, please contact [email protected].
The security of your personal data is a priority for us. That's why we pay appropriate attention to personal data and its protection. In this Personal data security and protection policy („Rules“), we would like to inform you about what personal information we collect about you and how we continue to use it.
1. Personal data and its processing
1.1. Personal Data Categories
We collect different data depending on which of our services you use.
If you shop with us, we collect:
- Name and contact details. Name, email address, mailing address, phone number.
- Demographics. Gender, date of birth, country and preferred language.
- Data resulting from terms of the contract - purchased products, customer segment and the volume of services provided.
- The login details. We don't have access to your log in password.
If you receive our marketing messages, we collect:
- Name and contact details - e-mail address, name and phone number.
- Demographics - country, gender data.
We also process the following personal data:
- Communication between Ksisters and the customer.
- Data related to the use of the AI assistant on the Website, including the content of messages you enter into the chat yourself, the date and time of your interaction with the chat, technical session data, and other data necessary to ensure the proper functioning of this tool.
Please note that the AI assistant is not intended for the transmission of special categories of personal data or other sensitive information. Do not provide the AI assistant with information about your health, medical diagnoses, payment card details, passwords, documents, financial information, or other confidential information.
- Internet traffic records on websites supported by Ksisters.
1.2. Personal data processing goals
Providing services and improving them. In order to deliver our services as well as to improve them, we collect some of your personal data as follows:
- Processing of an order for goods or services ordered through our website. This is necessary to fulfill the sales contract and to fulfill legal obligations (e.g. accounting documents).
- Product availability notifications. If you ask for notifications on the availability of goods, we will process your personal data with your consent.
- Customer support.
To provide customer service and to eliminate any problems with fulfillment of the sales contract we process your personal data that is necessary to fulfill the contracts.
- Communication.
We use the data we collect to communicate with you and to personalize such communication. For example, we may contact you by e-mail or other means to remind you that you have items in your online cart, to help you to complete your order, to notify you of the current status of your request, order or complaint, or to obtain additional information from you, or to notify you that you need to take the action necessary to maintain the active status of your account.
f you place an order as an unauthorized user (without logging into your account), such messages may be sent based on your consent provided when entering your email address on our website or subscribing to our newsletter, as well as based on Ksisters' legitimate interest in providing quality service, preventing technical errors, and ensuring that you can complete your purchase.
You can opt out of these messages at any time free of charge by using the unsubscribe link included in each email or by contacting us at [email protected].
- Improving services.
We use the data to continuously improve our services and systems, including adding new features and at the same time making informed decisions using aggregated analyses and business intelligence, all based on our legitimate interest in the freedom to conduct a business and the need to improve the services provided in order to succeed on the market. In order to ensure sufficient protection for your rights and interests, we use personal data that is anonymised as much as possible.
- Protection, security and dispute resolution.
We may also process data based on a legitimate interest, which is to ensure the protection and security of our systems and our customers, to detect and prevent fraud, to resolve disputes and to enforce our agreements on the basis of a legitimate interest.
- Marketing offers.
1) We may send you commercial and marketing messages about Ksisters products and services that may be of interest to you.
2) We may send the following messages:
- to our customers — based on Ksisters' legitimate interest in promoting its own products similar to those you have already purchased;
- to unauthorized users — based on your consent provided when entering your email address on our website or subscribing to our newsletter.
3) You can opt out of these communications at any time, free of charge, by using the unsubscribe link included in each email or by contacting us at [email protected].
4) If you opt out of subscribing to marketing notifications, we will no longer use your e-mail contacts for this purpose. We will only start to send you the merketing notification once you re-subcribe
5) The marketing offers you see may be selected based on additional information we have subsequently obtained about you based on your contact information, demographic information, selected products, data about your use of our products and website (cookies, IP address, data provided by your browser, click data, regarding the display of marketing offers, as well as information about visited products). We do not perform fully automated processing that would have legal consequences for you.
6) If you are not our client, we will process your data only with your consent.
7) You have the right to refuse data processing for free at any time.
- Processing of cookies from web sites managed by Ksisters.
If your web browser includes cookies, we process records of proceedings from cookie files posted on the website, in order to ensure the best operation of the website and for the purposes of online advertising by Ksisters. More information can be found in a separate chapter of the document.
- Using an AI assistant for customer support: We may use automated tools, including an AI assistant, to provide answers to common inquiries, assist with product searches, and provide information about shipping, returns, warranties, and other matters related to the use of the Website and our services.
1.3. Transfer of personal data to third parties
Your personal information can only be transferred to third parties if it is necessary to fulfill the sales contract, on the basis of legitimate interest or if you have given your prior consent:
а) To subsidiaries and contractors in order to comply with the sales contract, as well as to perform internal processes and procedures.
b) To financial institutions, payment service providers to process payments, as well as to banks to fulfill a sales contract.
c) To logistic companies to deliver the goods you ordered, as well as to resolve the claim, including the termination of the contract.
d) To our partners, to implement the loyalty system in which you participate.
e) To other partners who provide additional data processing services.
f) To third parties, such as a legal or financial representative.
g) To public authorities (for example, police).
h) To third parties conducting surveys between customers.
i) To contractors that provide services on our behalf, assist us in maintaining and/or enhancing our websites, manage our loyalty program, and distribute, improve, and/or market the products and services we offer you, including organizations that handle order fulfillment, web hosting, security in our stores, data storage, email service providers, marketing services including direct marketing, as well as research and analytics services, tag management, and cookies, such as Google Analytics. As part of this processing based on Google Analytics, we have established appropriate security measures, which include the use of a 'proxy server. You can check out the Google documentation regarding Google Analytics and how to deactivate it by clicking on the following links: Browser add-on for disabling Google Analytics - Google Analytics Help.
2. Customer account and purchase without registration
а) As a part of creating of personal account, we create a password-protected customer account for you. Within a customer account, you get direct access to your data, including a possibility of editing, and you can view your data about completed and unfinished orders. You can also manage your personal information and newsletter subscription through your customer account.
b) If you don't want to open a customer account to make purchases, you can also shop without registration.
c) You have the right to terminate the contract in accordance with the relevant terms and conditions.
Registration and login using existing online profiles.
If you already have a profile on Facebook or Google, you can also use that profile to create a Ksisters customer account and then log into your Ksisters account. The relevant providers, Facebook or Google, are collectively referred to below as 'profile providers.
During your registration and thereafter, the profile provider shares certain information from your profile with us. When you create a Ksisters customer account, the profile provider will inform you of the data it will send us. This primarily includes your name and email address. We process the transmitted data solely in line with this data protection information.
If you register or log in to Ksisters via a profile provider, your browser verifies with the corresponding profile provider whether you have allowed this registration or login. This informs the profile provider that you are registering or logging into your personal account. Further processing of this information by the profile provider is explained in the relevant terms of use and data protection information provided by the profile provider.
3. Security of personal data and retention period
3.1. Security of personal data
а) Your personal data is transferred to us in an encrypted form. We use Encoding system HTTPS (HyperText Transfer Protocol Secure). We secure our websites and other systems with technical and organizational measures protecting against loss and destruction of your data, against access, alteration or dissemination by unauthorized persons.
b) We require that our processes stay in line with GDPR and UK GDPR.
c) Access to your account is only possible once your personal password has been entered. In this context, we would like to remind you that it is important that you do not disclose your access data to third parties and always close your web browser window when you complete your activity in your customer account, especially if you are using your computer with other users. Ksisters is not responsible for the abuse of passwords used, unless Ksisters directly contribute to such condition.
3.2. Processing period
We collect and store personal data:
- In the time required to ensure all rights and responsibilities of the sales contract.
- 1 year after the end of the warranty period in order to ensure resolution of possible disputes.
- For the period during which Ksisters is required to remain the Controller in accordance with generally applicable legal provisions. Accounting documents, such as invoices issued by Ksisters, are archived in accordance with the law for a period of 6 years from the date of issuance;
- The consent for the notification of the availability of goods remains valid until the information on availability is sent, but no longer than within 1 year or until its revocation.
- The consent to marketing offers is valid for 4 years or until its revocation.
- Data related to the use of the AI assistant—including the content of messages, the date and time of interactions, and technical session data—is retained for the period necessary to ensure the functionality, security, and prevention of misuse of the AI chat, as well as to improve its performance, but for no longer than 12 months from the date of the relevant interaction. Upon expiration of this period, such data is deleted or anonymized, unless longer retention is required by law or is necessary to protect the rights and legitimate interests of Ksisters.
In other cases, the processing period depends on the purpose of processing or is determined by the legal acts in the area of personal data protection.
4. Rights of data subjects
1. Pursuant to Article 15 of the UK GDPR.
You have the right to obtain from us, free of charge and within one month of submitting your request, confirmation as to whether or not your personal data is being processed. If so, you have the right to receive a copy of such data, along with comprehensive information regarding the purposes of the processing, the categories of data involved, the storage periods, and the recipients to whom the data is disclosed.
Furthermore, in accordance with Article 19 of the UK GDPR, you have the right to be informed about the recipients to whom we have notified any rectification, erasure, or restriction of processing carried out in respect of your personal data at your request.
2. Pursuant to Article 16 of the UK GDPR.
You have the right to request the correction of inaccurate personal data held about you (for example, if your name, phone number, or delivery address is incorrect), or to have incomplete data completed. We aim to ensure that your information is always accurate and up to date. We will process your request and make the necessary updates free of charge within one month.
3. The right to submit a complaint under Article 77 of the UK GDPR.
If you consider that the processing of your personal data is in breach of the law, you have the right to lodge a complaint.
We ask that you first contact us directly at [email protected] or our UK Representative - Prighter Group to: https://app.prighter.com/portal/15124881955, so that we can resolve your issue as quickly as possible.
You also have the legal right to lodge a complaint with: The Information Commissioner’s Office (ICO): Address: Wycliffe House, Water Lane, Wilmslow SK9 5AF. Complaints website: https://ico.org.uk/make-a-complaint/.
4. Right to cancel consent according to Art. Art.7 UK GDPR.
You may withdraw your consent to the processing of personal data at any time. If you withdraw your consent to the processing of personal data, your personal data will be deleted; however, this does not apply to those personal data that Ksisters needs to fulfill the legal obligations (e.g. processing an order already placed) or to protect their legitimate interests. Personal data will also be destroyed if the personal data is not necessary for the intended purpose or if the storage of your data is inadmissible for other statutory reasons.
5. Right to deletion according to Art.17 UK GDPR.
You have the right to request the deletion of your personal data that we process about you. We will delete or anonymize your personal information without delay.However, this does not pertain to personal data that we require to meet our legal obligations and that must be retained in accordance with legal requirements (such as processing an already placed order) or for the protection of our legitimate interests. Personal data will also be removed if it is no longer necessary for the purpose for which it was collected or if the retention of your personal data is not allowed for other reasons specified by law. You can make a request for the deletion of personal data to the Data Protection Officer at the email address [email protected]. This right also applies to personal data provided while using the AI assistant. In particular, you may contact us to request the deletion of a conversation with the AI assistant or the personal data provided during such a conversation.
6. Right to restriction of processing as provided by Art 18 of the UK GDPR.
You can restrict the processing of your personal data by sending us a request to the email address of the Commissioner [email protected].
7. Right to data transfer as provided by Art.20 UK GDPR.
You have the right to request all personal data you have provided to us that we process under your consent. We will provide this data in a structured and machine-readable format. We will be happy to generate the data for you in this format; just send your request to the email address of the Commissioner [email protected].
8. Right to object under Article 21 of the UK GDPR.
You have the right to object at any time to the processing of your personal data based on legitimate interests (Article 6(1)(f) of the UK GDPR):
Direct marketing: If you object to the processing of your data for direct marketing purposes and related profiling, we will immediately cease such processing. This right is absolute and does not require justification.
Other purposes: If you object to processing for other purposes, you must provide reasons related to your specific situation. We will cease processing unless our legitimate interests override your interests, rights, and freedoms, or if the data is necessary to defend legal claims.
To exercise this right, use the unsubscribe button in emails or send a request to: [email protected].
Our services are not intended for minors. We do not intentionally collect or process personal data related to minors.
5. Websites
5.1. Cookies
Our site uses cookies to make our offer relevant, interesting and user-please. Cookies are small text files that are stored on your computer, smartphone or other device and that are used in your browser. We use cookies e.g. to:
- the correct functionality of the shopping basket so that you can complete your order as easy as possible.
- remember your login details so you don't have to enter them repeatedly.
- best tailor our site to your requirements by tracking traffic, your site movements and the features you use.
- find out about viewing adds so we don't show you adds for goods you're not interested in.
5.2. Use of cookies
Cookies used on our site can be divided into two basic types. Short-term session cookies are deleted as soon as you stop visiting our site. Long-term persistent cookies remain stored on your device for much longer or until you manually delete them (the time cookies are left on your device depends on the cookie itself and your browser settings).
The cookie can also be divided according to their functionality into:
– analytics to help us increase the user experience of our site by understanding how users use it.
- conversion, which allow us to analyze the performance of different sales channels.
- tracking, which in combination with conversion help to analyze the performance of different sales channels.
- the remarketing we use to personalize ad content and target it correctly.
- the basics that are important for the basic functionality of the site.
5.3. Refusal of cookies
Settings for the use of cookies are part of your internet browser. Most browsers automatically accept cookies by default. Cookies can be rejected or restricted to the types you select using your web browser.
You can find information about browsers and how to set preferences for cookies on the following websites or in other internet browser documentation.
Chrome
5.4. Links
Our website contains links to other websites that are practical and contain usefull information. Please note that such sites may be owned and operated by other companies and organizations and have different security and privacy policy. Our company has no control and assumes no responsibility for any information, material, products or services contained on or accessible through such websites.
6. Transfer of data outside the EEA
As part of the Controller's use of tools to maintain ongoing operations provided, for example, by Google, your personal data may be transferred to a country outside the European Economic Area (EEA), in particular the United States of America (USA) or another country in which Google is a partner maintains tools used to process Personal Data together with the Controller. Adequate security of processed personal data outside the EEA is guaranteed by the application of external agreements related to data processing based on standard contractual clauses that meet the requirements of the UK GDPR.
International Data Transfers (for UK residents): The transfer of personal data outside the UK to countries that do not have an official adequacy decision (Adequacy Regulations) is carried out in compliance with the UK GDPR and the Data Protection Act 2018. To ensure data security, Ksisters uses the International Data Transfer Agreement (IDTA) or the UK Addendum to the Standard Contractual Clauses, approved by the Information Commissioner’s Office (ICO), or the UK Extension to the Data Privacy Framework.
7. Contact us
If you have any questions, comments or requests regarding this Policy, please do not hesitate to contact us at our e-mail address.
For any questions regarding the protection, modification, or deletion of your data, please contact us directly at: [email protected].
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions: United Kingdom (UK).
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/15124881955.
Contact: Ksisters Sp.z o.o.
Reg. address: 00-695, Warszawa, ul. Nowogrodzka 50/515
REGON: 388839360
KRS: 0000894651
NIP: PL7011031806
Customer Service: [email protected].
This Policy applies from 16.02.2026.