The controller of your personal data is ACT BY KIRIN Foundation, based in Poland, which runs the BY KIRIN brand and this website (“we”, “us”).
You can reach us about anything in this policy at kirin@bykirin.com or +48 691 903 459.
We collect only what you give us or what is needed to run the site:
- Enquiries. When you write to us through a contact form or by email: your name, email address and, if you give them, your phone number, company or publication, country, website and the content of your message.
- Orders. When the shop is open: your name, delivery and billing address, email address, phone number, the items you order and any tailoring you request. Card details are entered directly with our payment provider and never reach us.
- Technical data. Our hosting provider’s servers record standard connection data, such as your IP address, browser type and the pages requested, to keep the site secure and working.
- Cookies. Information stored in your browser, described in section 7.
We process personal data under the EU General Data Protection Regulation (GDPR), on these grounds:
- to answer your enquiry and take steps you ask for before a purchase, and to perform a contract with you — Art. 6(1)(b);
- to meet our legal obligations, in particular tax and accounting — Art. 6(1)(c);
- our legitimate interests in running and securing the site, answering correspondence and establishing or defending legal claims — Art. 6(1)(f);
- your consent, for cookies that are not strictly necessary and for marketing — Art. 6(1)(a). You can withdraw consent at any time; this does not affect processing that took place before.
We do not sell personal data. We share it only with providers who process it on our behalf, under data processing agreements, and only as far as they need to:
- website hosting (Poland);
- email delivery, for our replies and order emails (Brevo, EU);
- payment processing, when the shop is open (Stripe);
- delivery, when you order (DHL, InPost);
- analytics and advertising measurement, only if you accept those cookies (Google, Meta).
Some of these providers may process data outside the European Economic Area, in particular in the United States. Where they do, the transfer relies on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
- Enquiries: for as long as the correspondence is ongoing, and then for up to two years, unless it leads to an order.
- Orders: for the period required by Polish tax and accounting law, currently five years from the end of the year in which the order was placed.
- Data processed on the basis of consent: until you withdraw it.
- Technical logs: for a short period set by our hosting provider, usually no more than a few weeks.
Data may be kept longer only where needed to establish, exercise or defend legal claims.
You have the right to access your personal data, to have it corrected or erased, to restrict its processing, to object to processing based on our legitimate interests, to data portability, and to withdraw consent at any time.
To use any of these rights, write to kirin@bykirin.com. We will reply within one month.
You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
We use cookies and similar technologies in the following categories:
- Necessary — required for the site to work, for example remembering your cookie choices. These do not need consent.
- Statistics — help us understand how the site is used. Set only with your consent.
- Marketing — measure the effect of our advertising. Set only with your consent.
You choose which categories to allow when you first visit, and you can change your choice at any time through “Cookie settings” at the bottom of every page.
For any question about your personal data or this policy, write to kirin@bykirin.com.
We may update this policy; the current version is always published on this page.
Last updated: 24 October 2026.
