Kinoko
BG
Kinoko
BG

Your Cart

No items found.

Kinoko

Privacy Policy

Last updated: 19 October 2026

1. Who is responsible for your data

This Privacy Policy explains how [COMPANY LEGAL NAME], UIC/EIK [COMPANY REGISTRATION NUMBER], registered address [COMPANY REGISTERED ADDRESS] ("Kinoko", "we", "us") collects, uses and protects personal data when you visit kinokoclothing.com or place an order with us, as the data controller within the meaning of Regulation (EU) 2016/679 ("GDPR").

You can reach us about any privacy question at website@kinokoclothing.com or through the Contact us page.

2. What personal data we collect

We only collect personal data that you give us directly, or that is generated automatically by your use of the Site:

  • Order and delivery data: name, delivery address, email address, phone number, and the contents/value of your order, when you place an order.
  • Payment data: we do not collect or store your card number. When you pay by card, your payment details are entered directly on our payment provider's secure hosted page and processed by them; we only receive confirmation that payment succeeded or failed and a payment reference. For cash-on-delivery orders, no card data is involved.
  • Contact form data: your name, surname, email address and the content of your message, when you contact us.
  • Newsletter data: your email address, if you choose to subscribe.
  • Cart and browsing data: the products and variants in your cart, stored in a session so the cart works as you browse; and your chosen language preference.
  • Technical data: IP address, browser type, device information and pages visited, collected automatically as part of operating the Site securely and reliably.
  • Admin/back-office data: if you are a member of the Kinoko team with access to the administration panel, we process your name, email address and login activity to operate that panel securely.

We do not knowingly collect any special category data (such as health, religious or political information) through the Site.

3. Why we use your data and our legal basis

  • To process and deliver your order, handle payment, returns and customer service queries — necessary for the performance of a contract with you (Article 6(1)(b) GDPR).
  • To issue accounting and tax documents and keep records required by Bulgarian law — necessary for compliance with a legal obligation (Article 6(1)(c) GDPR).
  • To send you the newsletter, if you subscribed — based on your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by unsubscribing.
  • To respond to messages sent through the contact form — necessary to take steps at your request before/in relation to a contract, or based on our legitimate interest in responding to enquiries (Article 6(1)(b) or (f) GDPR).
  • To keep the Site secure, prevent fraud and abuse, and improve how it works — based on our legitimate interest in operating a safe and reliable service (Article 6(1)(f) GDPR).
  • To set non-essential cookies (for example, analytics or marketing, if and when we introduce them) — based on your consent given through our cookie banner (Article 6(1)(a) GDPR).

4. Who we share your data with

We share only the data needed to operate the store, fulfil your order and meet our legal obligations:

  • Speedy and its delivery partners receive the recipient name, delivery address or office, phone number and shipment details. For cash on delivery, they also receive the amount to collect.
  • Paypercut receives the order amount, payment reference and contact details required for hosted card checkout. Your card details are entered directly with the payment provider; KINOKO does not store card numbers.
  • Our email service, configured at orbit.superhosting.bg, processes recipient addresses and message content to deliver order confirmations, shipping updates and customer replies. Messages submitted through our contact form are sent to the authorised KINOKO team.
  • [NAME OF WEB HOSTING PROVIDER] hosts the website and order database and may process technical logs and stored customer data for this purpose.
  • Accounting service providers, where engaged, receive the order and invoice data necessary for bookkeeping and tax compliance.
  • Competent public authorities receive data when disclosure is required by law.

Service providers act as processors or independent controllers according to their role. We do not sell your personal data or share it for third-party marketing.

5. International data transfers

Where a service provider processes personal data outside the European Economic Area, the transfer must be covered by an applicable GDPR safeguard, such as an adequacy decision or Standard Contractual Clauses. You may contact us for information about the safeguards applicable to your data.

6. How long we keep your data

  • Order, invoice and accounting records: 10 years from the end of the relevant financial year, as required by the Bulgarian Accountancy Act (Закон за счетоводството).
  • Contact form enquiries: up to 2 years after our last exchange with you, or until resolved plus a reasonable period, whichever is longer.
  • Newsletter email addresses: until you unsubscribe or, if you never engage with our emails, no longer than 2 years from your last interaction.
  • Cart/session data: automatically deleted when your browser session ends.
  • Language preference cookie: up to 1 year, or until you clear it.
  • Admin account activity logs: for as long as the account is active, plus a limited period afterwards for security purposes.

When a retention period ends, we securely delete or anonymise the data, unless we are required to keep it longer by law or need it to establish, exercise or defend legal claims.

7. Your rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you;
  • Rectify inaccurate or incomplete data;
  • Erasure of your data ("right to be forgotten"), where applicable;
  • Restrict how we process your data in certain circumstances;
  • Data portability, i.e. receive your data in a structured, machine-readable format;
  • Object to processing based on our legitimate interest, including direct marketing;
  • Withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
  • Lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at website@kinokoclothing.com. We will respond within one month, as required by the GDPR.

If you are not satisfied with our response, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, phone +359 2 915 3518, email kzld@cpdp.bg, website cpdp.bg, or with the supervisory authority in your own EU country of residence.

8. Cookies

We use a small number of cookies to run the Site and remember your preferences. You can review and change your choices at any time using the "Cookie settings" link in the site footer or the cookie banner shown on your first visit.

  • KINOKO_SHOP — strictly necessary — keeps your cart working as you browse — deleted when you close your browser.
  • kinoko_language — preference — remembers whether you're browsing in English or Bulgarian — kept for up to 1 year.
  • kinoko_consent — strictly necessary — remembers your cookie choices so we don't ask again on every visit — kept for up to 6 months.
  • KINOKO_ADMIN — strictly necessary, back-office only — keeps a signed-in team member logged into the administration panel — deleted when they close their browser or log out.

We do not currently use analytics or advertising cookies. If we introduce them in future, they will only be set after you give consent through the cookie banner, and this section will be updated to describe them.

9. Children

The Site is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

10. How we protect your data

We use technical and organisational measures appropriate to the risk, including encrypted (HTTPS) connections, hashed passwords, restricted access to the administration panel, and keeping card payment data entirely outside our systems by using a hosted, PCI-DSS compliant payment page. No method of transmission or storage is 100% secure, but we work to protect your data to current industry standards.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. The updated version will be published on this page with a new "last updated" date. If the changes are significant, we will take reasonable steps to notify you, for example through a notice on the Site.