Privacy policy

This Privacy Policy describes how Marta Zamojska, operating the website kiviora.com ("we", "us", "our"), collects, uses, stores and shares personal information when you visit, interact with, or make a purchase from Kiviora.com (the "Site"). It also explains how we use cookies, analytics, advertising technologies and similar tools.

We respect your privacy and process personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Data Controller

The controller of personal data processed in connection with the Site is:

Marta Zamojska
VAT UE: PL8262225537
REGON: 540143342
Gen. Andersa 22, 08-450 Łaskarzew, Poland
Website: kiviora.com
E-mail: support@kiviora.com

2. Personal Information We Collect

Depending on how you use the Site and the choices you make regarding cookies and similar technologies, we may process the following categories of information:

Device and technical information, such as IP address, browser and device information, operating system, approximate location derived from technical information, language, time zone, referring website, technical identifiers, information about cookies and similar technologies, and information required for security, fraud prevention and proper operation of the Site.

Website usage information, such as pages and products viewed, interactions with Site elements, navigation events, search activity, traffic source, advertising campaign information, session information, events and conversions. Depending on your consent choices, this information may be processed using analytics and advertising technologies described below.

Order and transaction information, such as your name, billing address, shipping address where applicable, email address, telephone number, payment and transaction information, products purchased, order value, order identifiers, payment status and other information required to process and fulfil your order.

Communication information, including information you voluntarily provide when contacting customer support, submitting a complaint, requesting a refund, asking a question or otherwise communicating with us.

Marketing and advertising information, where permitted by law and subject to your consent where required, including information about interactions with advertisements, attribution data, advertising identifiers, conversion events and audience or remarketing information.

3. Shopify Platform

Kiviora.com is operated using the Shopify e-commerce platform. Shopify provides the technical infrastructure required to operate the online store, including storefront functionality, shopping cart, checkout, order processing, security and related services.

Shopify and its technologies may process technical, transaction and customer information as necessary to provide these services. Certain cookies and similar technologies used by Shopify are strictly necessary for the Site, shopping cart, checkout, security, fraud prevention and order processing and may therefore operate regardless of your consent to optional analytics or marketing technologies.

The Site may also use Shopify applications and integrations, including the Google & YouTube sales channel, to connect the store with services such as Google Merchant Center, Google Ads and other Google services.

For more information about how Shopify processes personal information when consumers interact with Shopify-powered merchants and Shopify services, please see the Shopify Consumer Privacy Policy.

4. Consent Management and Cookiebot

We use Cookiebot by Usercentrics as our Consent Management Platform ("CMP") to display the cookie consent interface, record and manage your consent choices, and communicate relevant consent signals to technologies used on the Site.

Where consent is required, non-essential storage and processing are controlled according to the choices made through the Cookiebot consent interface. You may accept or reject available categories of processing and may withdraw or modify your consent at any time using the cookie settings available on the Site.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

We use Google Consent Mode v2 in connection with Cookiebot. Consent Mode communicates consent states to compatible Google services, including signals relating to analytics storage, advertising storage, advertising user data and advertising personalisation.

Depending on your consent choices and the configuration of a particular Google service, Google technologies may operate in a restricted mode when consent is denied. This may involve transmission of limited, cookieless measurement signals without storing advertising or analytics cookies on your device. Such restricted signals may be used for purposes such as aggregate measurement and modelling, subject to Google's applicable controls and policies.

For more information about Usercentrics and its privacy practices, please see the Usercentrics Privacy Policy.

5. Categories of Cookies and Similar Technologies

Strictly necessary technologies are required for the Site to operate and cannot generally be disabled through our consent interface. They may be used to maintain the shopping cart and checkout session, remember essential regional or currency settings, process orders, maintain security, prevent fraud, balance traffic and provide other functionality necessary for the service requested by you.

Preference and functional technologies may be used to remember optional settings or functionality and improve your experience on the Site.

Analytics technologies help us understand how visitors use the Site, measure traffic and interactions, identify technical or usability issues and improve the Site. Where required by law, cookies or similar identifiers used for these purposes are activated only after the appropriate consent has been obtained.

Marketing technologies may be used to measure advertising performance, attribute conversions, create advertising audiences, perform remarketing and personalise advertising where permitted. Storage of advertising cookies and use of personal data for advertising purposes are subject to your consent where required by applicable law.

The exact cookies and technologies present on the Site may change as our technical configuration and third-party services evolve. The Cookiebot consent interface provides current information about detected cookie categories and allows you to manage your consent choices.

6. Google Tag Manager

We use Google Tag Manager ("GTM") to manage and deploy measurement and marketing technologies used on the Site.

GTM acts as a technical tag-management layer through which services such as Google Analytics, Google Ads and other measurement technologies may be configured. The behaviour of technologies deployed through GTM is subject to the applicable consent settings and the consent signals communicated through our CMP.

The use of GTM does not remove the independent privacy and consent requirements applicable to the individual analytics or advertising services managed through it.

7. Google Analytics 4

We use Google Analytics 4 ("GA4") to understand how visitors use the Site, analyse traffic and website performance, measure interactions and e-commerce events, evaluate acquisition channels and improve the Site and our services.

Depending on your consent choices and our configuration, Google Analytics may process information such as page views, sessions, interactions, product views, shopping activity, purchases, traffic sources, campaign information, device and browser information, approximate location information derived from technical data and other analytics events.

We do not intentionally send information such as your payment card details to Google Analytics.

Where Google Analytics advertising features are enabled, GA4 data may also be used in connection with Google advertising services for functions such as conversion measurement, audience creation, remarketing and advertising performance analysis, subject to applicable consent requirements.

Google Analytics operates in conjunction with Google Consent Mode. Where analytics consent is denied, Google Analytics functionality and storage are restricted according to the applicable consent signals and Google may use limited cookieless measurement and modelling where supported.

8. Google Ads, Conversion Measurement and Remarketing

We use Google Ads technologies to advertise our products and measure the effectiveness of advertising campaigns.

This may include Google Ads conversion measurement, conversion attribution, remarketing, audience measurement and other advertising features. Depending on your consent choices, these technologies may process advertising identifiers, information about advertisements and campaigns that referred you to the Site, interactions with the Site, purchases and other conversion events.

Where required by law, advertising storage, the use of personal data for advertising measurement and advertising personalisation are controlled through the consent choices communicated to Google using Google Consent Mode v2.

If you do not consent to advertising cookies or advertising personalisation, Google services may operate in a restricted mode and personalised advertising features will not be enabled on the basis of consent-dependent data from your visit.

9. Google Merchant Center and Google & YouTube Integration

We use the Google & YouTube integration for Shopify and Google Merchant Center to make product information available to Google services and support product listings, advertising, conversion measurement and related e-commerce functionality.

Product, store and transaction-related information may be transmitted to Google where necessary to provide these services. Depending on the functionality enabled and your consent choices, Google technologies may also process information relating to visits, advertising interactions and conversions.

The Site may display Google-provided store, merchant or customer-review functionality. Such functionality may communicate with Google services and may use cookies or similar technologies. Where the functionality involves non-essential storage or tracking, it is subject to applicable consent requirements.

Google may receive information from websites using Google services, including technical information such as the URL visited and IP address, and may use cookies or similar technologies depending on the service, configuration and consent state. For more information about Google's processing of information received from websites using Google services, please see How Google uses information from sites or apps that use its services. You can also review the Google Privacy Policy and information about Google's use of cookies and similar technologies.

10. Meta Pixel and Meta Advertising

We use the Meta Pixel and related Meta advertising technologies to measure advertising performance, understand interactions following advertisements displayed on Meta platforms, attribute conversions, create advertising audiences and conduct remarketing.

Depending on your consent choices, Meta technologies may process information about pages and products viewed, interactions with the Site, shopping and conversion events, campaign information, browser and device information, IP address and identifiers used for advertising and measurement purposes.

Information collected through Meta advertising technologies may be associated by Meta with information available through its services, subject to Meta's own terms and privacy practices.

Meta Pixel and other non-essential Meta advertising technologies are subject to your consent where required by applicable law. If the relevant consent is denied, consent-dependent Meta advertising tracking and storage will not be enabled through our Site.

For more information about how Meta collects, uses and shares information through its products and technologies, please see the Meta Privacy Policy.

11. Microsoft Clarity

We use Microsoft Clarity to understand how visitors interact with the Site, identify usability and technical issues and improve the user experience. Clarity may provide aggregated behavioural analytics and functionality such as interaction analysis and session-based insights.

Depending on the applicable consent state, Clarity may process information about interactions with pages, navigation, clicks, scrolling, device and browser characteristics, technical information and related usage data.

For visitors for whom consent is required, Clarity is configured to respect consent signals. When the relevant consent is not granted, Clarity may operate in a restricted no-consent mode without setting Clarity cookies used to persist a user across sessions. When the appropriate consent is granted, additional cookie-based functionality and cross-page or cross-session analysis may become available.

We use Clarity for analytics and website optimisation and not for intentionally collecting payment card details, passwords or other information designated by us as sensitive input data.

For more information about Microsoft's processing of personal data, please see the Microsoft Privacy Statement.

12. How We Use Personal Information

We may process Personal Information for the following purposes:

  • to provide, operate and secure the Site;
  • to maintain the shopping cart and checkout process;
  • to process payments and fulfil orders;
  • to deliver digital products and provide order confirmations or invoices;
  • to communicate with customers about orders and provide customer support;
  • to handle complaints, refunds and disputes;
  • to detect and prevent fraud, abuse and unauthorised transactions;
  • to comply with accounting, tax and other legal obligations;
  • to analyse website performance and improve usability and services;
  • to diagnose technical problems;
  • to measure advertising and marketing effectiveness;
  • to attribute conversions and understand acquisition channels;
  • to create advertising audiences and perform remarketing where permitted and consented to;
  • to personalise advertising where you have provided the required consent;
  • to establish, exercise or defend legal claims.

13. Legal Bases for Processing

Where the GDPR applies, we process personal data on one or more of the following legal bases:

Performance of a contract: where processing is necessary to process and fulfil your order, deliver purchased products or provide requested customer services.

Compliance with legal obligations: including tax, accounting, consumer-protection and other obligations imposed by applicable law.

Legitimate interests: including maintaining Site and transaction security, preventing fraud and abuse, protecting legal rights, providing appropriate customer service, maintaining technical infrastructure and improving our business where those interests are not overridden by your rights and freedoms.

Consent: including where required for analytics technologies, advertising cookies, advertising measurement, personalised advertising, remarketing or optional marketing communications. You may withdraw consent at any time.

14. Behavioural Advertising and Advertising Audiences

Where you have provided the required consent, we may use information about your interactions with the Site to measure advertisements and create audiences for advertising through services such as Google Ads and Meta.

This may allow us, for example, to measure whether an advertisement resulted in a purchase, create audiences of visitors who interacted with particular products, exclude existing purchasers from selected campaigns or show advertisements to previous visitors on third-party platforms.

Advertising providers may process information according to their own privacy policies and account-level settings. You can withdraw consent for consent-dependent advertising technologies using the cookie settings available on the Site. You may also manage advertising preferences through the controls provided by the relevant advertising platform.

15. Sharing Personal Information and Service Providers

We may disclose or make Personal Information available to service providers and other recipients where necessary to operate the Site, fulfil orders, provide analytics and advertising services, protect the Site, comply with law or otherwise carry out the processing described in this Privacy Policy.

Depending on the services used, recipients may include:

The exact recipients involved may depend on the services you use, the actions you take on the Site and your consent choices. Third-party providers may process personal information in accordance with their respective roles under applicable data protection law and their own privacy notices.

16. Order Verification and Fraud Prevention

Orders may be subject to security, fraud-prevention or payment-verification procedures. Information processed for these purposes is used to protect customers and the Site, verify transactions, prevent unauthorised purchases, comply with applicable requirements and establish or defend legal claims.

We do not use information collected solely for order security or payment verification for unrelated advertising purposes.

17. International Data Transfers

Some service providers used by the Site operate internationally and may process personal data outside Poland or the European Economic Area, including in the United States or Canada.

Where personal data is transferred outside the European Economic Area, such transfers are carried out using an appropriate transfer mechanism where required by applicable law. Depending on the recipient and destination, this may include an adequacy decision, an applicable recognised data-transfer framework, Standard Contractual Clauses approved by the European Commission, or another lawful transfer mechanism.

Further information about international transfers carried out by individual providers can be found in their respective privacy notices linked in this Privacy Policy.

18. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected and as required by applicable law.

Order and transaction information may be retained for periods required by tax, accounting, consumer-protection and other legal obligations. Customer-service and dispute information may be retained for as long as necessary to resolve the matter and establish, exercise or defend legal claims.

Analytics, advertising and technical information is retained according to the configuration and retention periods applicable to the relevant service and may be deleted, aggregated or anonymised earlier where appropriate.

Withdrawal of consent does not necessarily require deletion of information that we are legally required or otherwise lawfully entitled to retain.

19. Your Rights

If the GDPR applies to you, subject to the conditions and limitations established by law, you may have the right to:

  • request access to your personal data;
  • request correction of inaccurate or incomplete data;
  • request deletion of personal data;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • receive certain personal data in a portable format;
  • withdraw consent at any time where processing is based on consent;
  • lodge a complaint with a competent data protection supervisory authority.

Where processing is based on consent, withdrawal does not affect the lawfulness of processing performed before consent was withdrawn.

To exercise your rights, contact us using the details provided in this Privacy Policy. We may request information reasonably necessary to verify your identity before responding to certain requests.

20. Managing Your Cookie and Advertising Choices

You can manage consent for optional cookies and similar technologies through the Cookiebot consent interface available on the Site. You may change or withdraw your choices at any time.

You may also use browser controls to view, delete or block cookies. Blocking strictly necessary cookies may prevent parts of the Site, shopping cart or checkout from operating correctly.

Google and Meta additionally provide controls relating to advertising and personalisation. These controls operate independently from the consent settings available on Kiviora.com.

For information about controlling information used by Google, please see Google's information for users of sites and apps using Google services.

21. Data Security and Personal Data Breaches

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, accidental or unlawful loss, alteration, disclosure or misuse.

No method of electronic transmission or storage can guarantee absolute security. If a personal data breach occurs, we will investigate and respond to it and will notify the competent supervisory authority and affected individuals where required by applicable law.

22. Minors

The Site is not intended to knowingly collect personal information from children who are not legally permitted to use the Site or provide the relevant information under applicable law.

If you are below the age at which you may independently provide valid consent in your jurisdiction, you should not provide consent-dependent personal information without appropriate involvement of a parent or legal guardian.

If we become aware that personal data relating to a child has been collected unlawfully, we will take reasonable steps to delete or otherwise appropriately handle that information.

23. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including when we change the technologies, analytics tools, advertising services, service providers or processing activities used on the Site, or where changes are necessary because of legal or regulatory requirements.

The date shown below indicates when this Privacy Policy was most recently updated. We encourage you to review it periodically.

24. Contact and Complaints

If you have questions about this Privacy Policy, would like to exercise your data protection rights, or wish to make a complaint concerning our processing of your personal information, please contact:

Data Controller: Marta Zamojska
VAT UE: PL8262225537
REGON: 540143342
Address: Gen. Andersa 22, 08-450 Łaskarzew, Poland
Website: kiviora.com
E-mail: support@kiviora.com

If you believe that the processing of your personal data infringes applicable data protection law, you also have the right to lodge a complaint with the competent data protection supervisory authority. In Poland, the competent authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

Last Updated: September 9, 2026

Kiviora.com is operated by Marta Zamojska.

VAT UE: PL8262225537
REGON: 540143342

Gen. Andersa 22, 08-450 Łaskarzew, Poland