Privacy policy
Effective date: 30 August 2026
This policy explains what personal information kimjie collects when you visit kimjie.com, buy something, sign up for messages or write to us; why we collect it; who else sees it; how long we keep it; and what you can tell us to do with it. It applies to the website and to everything connected to it — orders, subscriptions, customer support, reviews and marketing.
The short version
- We collect what an order needs: your name, address, email, what you bought and what you paid.
- We never see or store your full card number. Payment is handled by our payment providers.
- We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
- Marketing emails and text messages only go out if you asked for them, and one click or one word stops them.
- You can ask us for a copy of what we hold, ask us to correct it, or ask us to delete it. Write to hello@kimjie.com.
The rest of this page is the detail behind those five lines.
1. Who is responsible for your information
kimjie is the controller of the personal information described here — meaning we decide why and how it is processed. We are established in the Netherlands and we sell to the countries listed in our Shipping Policy.
For anything in this policy, write to hello@kimjie.com. That address reaches a person, and it is the right one for a request about your rights, a complaint, or a question about a specific order.
Our store runs on Shopify. Shopify processes personal information on our behalf in order to host the shop, take payments and send transactional email, and it also processes some information as a controller in its own right. Shopify's own privacy policy explains that part.
2. The information we collect
2.1 What you give us
| What | When |
|---|---|
| Name, email address, shipping and billing address, phone number where you give one | Placing an order, creating an account |
| Order contents, order number, currency, amount, discount or gift card used | Placing an order |
| Payment method type, the last four digits of a card, the billing postcode, and the authorisation result | Paying — see 2.4 |
| Account login details, including a hashed password | Creating an account |
| Subscription settings: interval, quantity, next delivery date, pauses and cancellations | Starting or changing a subscription |
| The content of your messages to us and our replies | Emailing us, using the contact form |
| Marketing preferences and consent records, including when and how you opted in or out | Signing up, unsubscribing |
| Reviews, photographs and anything else you send us or tag us in | Submitting content |
| Return and refund details, including the reason you give | Making a return |
| Anything you volunteer about your skin — a sensitivity, an ingredient you avoid, a reaction to a product | Writing to us |
2.2 What we collect automatically
When you visit the Site, our systems and the services we use record: your IP address; the type of device, browser, operating system and language; the pages you open, the products you view, the time you spend and the order in which you move through the shop; the site or advertisement you arrived from; the contents of your basket; and identifiers stored in cookies or similar technologies. Section 5 explains cookies in detail, including which of them only run with your consent.
2.3 What we receive from others
| Source | What we receive |
|---|---|
| Shopify | Order, account and analytics data for our own shop |
| Payment providers | Whether a payment succeeded, the payment method type, the last four digits, the billing postcode, and any fraud signal |
| Carriers | Delivery status, tracking events, delivery failures and returns |
| Fraud prevention services | A risk assessment of an order |
| Email and messaging platforms | Whether a message was delivered, opened or clicked, and unsubscribe events |
| Analytics providers | Aggregated and pseudonymous statistics about how the shop is used |
| Social platforms | Public content you tag us in, and the messages you send us there |
2.4 Payment details
We do not receive, see or store your full card number, its expiry date or its security code. Those go directly to the payment provider you choose at checkout, over their own encrypted connection. What comes back to us is enough to identify the payment and to handle a refund or a dispute: the method type, the last four digits, the billing postcode and the result.
2.5 Sensitive information
We do not ask for special category data, and you should not send us any. If you choose to tell us about a skin condition, an allergy or a reaction to a product, we treat that as health information: we use it only to answer you, and we keep it only as long as we need to. Where a reaction to a cosmetic product is reported to us we are required by cosmetics law to record it and, in a serious case, to notify the competent authority. That record is kept for as long as the law requires, and we minimise it — we do not need your medical history in order to record that a product caused a reaction.
2.6 Children
The Site is not intended for children. We do not knowingly collect personal information from anyone under 16, and you must be 18 to order. If you believe a child has given us information, write to hello@kimjie.com and we will delete it.
3. Why we use it, and on what legal basis
If you are in the European Economic Area or the United Kingdom, the law requires us to have a legal basis for every use. This is ours.
| Purpose | Legal basis |
|---|---|
| Taking, packing, shipping and tracking your order; handling returns, refunds and subscriptions; running your account | Performance of our contract with you |
| Answering your messages | Contract, or our legitimate interest in running a shop people can write to |
| Taking payment and preventing fraud and abuse | Contract; legal obligation; our legitimate interest in not being defrauded |
| Keeping accounting and tax records | Legal obligation |
| Recording and, where required, reporting an adverse reaction to a product | Legal obligation under cosmetics law; protection of vital interests |
| Sending marketing email or text messages | Your consent, which you can withdraw at any time |
| Analytics and marketing cookies | Your consent |
| Essential cookies, security, and keeping the Site working | Our legitimate interest in a shop that functions and is not attacked |
| Publishing a review or User Content you sent us | Your consent, and our agreement with you under the Terms of Service |
| Defending a legal claim, or complying with a lawful request | Legal obligation; our legitimate interest in defending ourselves |
Where we rely on a legitimate interest we have weighed it against your rights and concluded it does not override them. You may object to any of those uses — see section 8.
4. What we do not do with it
- We do not sell personal information, and we have not sold any in the twelve months before the date at the top of this page.
- We do not share it for cross-context behavioural advertising as those laws define it.
- We do not use it to make a decision about you by automated means that produces a legal or similarly significant effect. Fraud checks may flag an order for review, and a person makes the decision.
- We do not use special category data to profile you.
- We do not share your information with anyone for their own marketing.
5. Cookies and similar technologies
A cookie is a small file placed on your device; a pixel and local storage do a similar job. We use three kinds.
| Kind | What it does | Consent |
|---|---|---|
| Essential | Keeps you logged in, remembers your basket and your region, keeps the checkout secure, and blocks abuse. The shop does not work without them. | Not required |
| Analytics | Tells us which pages are used, where people give up, and whether a change made anything better. Aggregated, not used to identify you. | Required |
| Marketing | Measures whether an advertisement led to a visit or an order, and may allow a platform to show you our advertising again. | Required |
Where consent is required we ask for it before the cookie is set, and you can change or withdraw it at any time through the cookie settings on the Site. You can also block or delete cookies in your browser; if you block the essential ones, parts of the shop will stop working.
We honour the Global Privacy Control signal. Where your browser sends it, we treat it as an opt out of any sale or sharing of personal information and of targeted advertising, for that browser and device.
6. Who we share it with
We share personal information only with organisations that need it to do something for us, and only with what they need. Each of them is bound by a contract that limits them to our instructions and requires them to protect it.
| Who | Why |
|---|---|
| Shopify | Hosting the shop, processing orders, storing customer accounts, sending transactional email |
| Payment providers | Taking payment, refunds, chargebacks, fraud screening |
| Carriers and fulfilment partners | Getting the parcel to you and back |
| Email and messaging platforms | Sending the messages you asked for |
| Analytics providers | Understanding how the shop is used |
| Advertising platforms | Measuring advertising, where you consented to marketing cookies |
| Professional advisers, accountants and auditors | Running the business lawfully |
| Authorities, courts and regulators | Where the law requires it, or to establish or defend a legal claim |
| A buyer of the business | If kimjie is sold or merged, your information moves with it and this policy continues to apply until you are told otherwise |
7. Where your information goes
We are in the Netherlands, and some of the services above are in the United States or elsewhere outside the European Economic Area and the United Kingdom. When personal information is transferred out of the EEA or the UK we rely on one of the following: an adequacy decision by the European Commission or the UK government covering that country or that recipient's certification; the European Commission's Standard Contractual Clauses, with the UK Addendum where the UK GDPR applies; or another lawful transfer mechanism. Where the safeguard needs it, we assess the risk in the destination country and apply extra measures such as encryption in transit and at rest. Write to hello@kimjie.com if you want to know which mechanism covers a specific transfer.
8. How long we keep it
| What | How long |
|---|---|
| Order and invoice records | Seven years from the end of the financial year, because tax law requires it |
| Customer account | Until you close it, or after three years with no order and no login |
| Support messages | Two years after the conversation ends |
| Marketing list and consent records | Until you withdraw consent, then a suppression record so we do not message you again; the consent record itself is kept as proof of when you opted in and out |
| Analytics data | At most fourteen months |
| Records of an adverse reaction | As long as cosmetics law requires |
| Reviews and published User Content | Until you ask us to remove it |
| Fraud and security logs | Twelve months, longer where an investigation is open |
When a period ends we delete the information or anonymise it so that it can no longer be linked to you. Where deletion is not immediately possible — a backup, for instance — we isolate it and delete it on the next cycle.
9. How we protect it
The Site is served over TLS, and payment happens on the provider's own encrypted connection. Access to customer data is limited to the people who need it, protected by strong authentication, and reviewed. Passwords are stored hashed, never in readable form. Our processors are chosen partly on their security posture and are contractually bound to it.
No system is perfectly secure, and we do not claim otherwise. If a breach is likely to result in a risk to your rights we will notify the supervisory authority within 72 hours of becoming aware of it, and we will tell you directly where the risk to you is high.
10. Your rights in the EEA and the UK
You have the right to:
- Access — ask whether we hold information about you and get a copy of it.
- Rectification — have inaccurate information corrected and incomplete information completed.
- Erasure — ask us to delete information, where we no longer need it, where you withdraw the consent it rested on, or where you object and we have no overriding ground.
- Restriction — ask us to pause processing while a dispute about accuracy or grounds is resolved.
- Portability — receive the information you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where that is technically feasible.
- Object — object to processing based on our legitimate interests. If you object to direct marketing we stop, without exception and without asking why.
- Withdraw consent — at any time, without affecting what was lawful before you withdrew it.
- Complain — to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens; in the United Kingdom, the Information Commissioner's Office. You may also complain to the authority where you live or work. We would rather you told us first, but you do not have to.
11. Your rights in the United States
Depending on where you live — California, Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana and a growing list of other states — you may have the right to know what we collect and why, to get a copy of it, to correct it, to delete it, to opt out of the sale or sharing of it and of targeted advertising, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of those rights. We do not sell or share personal information as those laws define it, and we do not charge a different price or offer a lower level of service to anyone who exercises a right.
The categories we collect, the purposes, the sources and the recipients are set out in sections 2, 3 and 6, and the retention periods in section 8; together they serve as the notice at collection.
You may use an authorised agent to make a request on your behalf. We will ask for written proof of their authority and may ask you to confirm it directly.
If we decline a request we will tell you why. In the states that provide for it you may appeal that decision by replying to our answer within a reasonable time; we will review the appeal and respond in writing with our reasoning, and if we still decline we will tell you how to contact your state's Attorney General.
12. How to exercise a right
Write to hello@kimjie.com and say what you want. You do not need a form or a particular wording.
We may need to confirm that the request is yours — usually by asking you to write from the address on the account, or by asking about a recent order. We do not ask for a copy of an identity document unless there is no other way, and we do not keep it afterwards. We answer within one month, and if a request is complex we may extend that by two further months and will tell you why within the first month. It is free, unless a request is manifestly unfounded or excessive, in which case we will explain the charge before doing anything.
13. Marketing, and how to stop it
We only send marketing to people who asked for it. Every email has an unsubscribe link at the bottom, every text message stops on STOP, and hello@kimjie.com works for both. We act on it immediately, and we keep a minimal record of the fact that you unsubscribed so that you are not added again by accident.
Stopping marketing does not stop the messages an order needs — confirmations, shipping notices, delivery problems and subscription reminders. You cannot opt out of those while an order is open, and they are not advertising.
14. Other sites
The Site links to other places on the internet, and we may be present on social platforms. Those are run by other companies, under their own privacy policies, and what they do with your information is not something we control. Reading their policies is worth the minute it takes.
15. Changes to this policy
When we change this policy we update the effective date at the top. If the change is material we will say so on the Site, and where we hold your email address and the change requires it, we will tell you directly and ask for your consent again where the law requires that. Earlier versions are available from hello@kimjie.com on request.
16. Contact
Questions, requests, complaints: hello@kimjie.com. A person reads that inbox, and a privacy request is never treated as an inconvenience.