Privacy

You can browse this entire shop without telling us anything about yourself. Every product page, department and search result is a static file on a CDN. There is no analytics script, no Google Analytics or Tag Manager, no Meta or advertising pixel, no heatmapping, no session recording and no third-party marketing cookie anywhere on the site. There is no sign-in, so nothing sets a cookie either. That is why there is no cookie banner: there is nothing to ask you about.

One qualification, because it is exactly the sort of thing this page ought to say out loud rather than bury. The product photographs are not served by us — they are loaded straight from two image hosts, which see your IP address and which page you are on. That is set out under who else sees it.

We start holding data about you when you do something that needs it — place an order, ask to be told when something is back in stock, message us about an order, or claim a brand. Each of those is set out below, with the reason we are allowed to do it.

We do not sell your data. We do not share it with advertisers, data brokers or analytics companies. Apart from those two image hosts, it goes to three places only: Stripe, Cloudflare, and whichever of our two suppliers is packing your parcel.

UK GDPR requires us to name a lawful basis for each use. Ours are contract (we need it to do what you asked), legal obligation (the law makes us keep it), consent (you asked for it and can take it back), and legitimate interests (a use of your data we think is fair and you can object to).

We do not ask for a date of birth, a title, a gender, a telephone number, or anything else the parcel does not need. There is no account, and none is required to order.

The email address and the delivery address are not optional if you want to order. We cannot price the delivery, take the payment or have the parcel brought to you without them, so if you do not give them there is no order — that is the only consequence, and there is no penalty of any other kind. Everything else is yours to withhold: a back-in-stock alert exists only because you asked for it, and a brand claim only because you sent one.

Our own database records no IP addresses and no browsing history. Cloudflare, which serves every page, necessarily handles the connection itself — including your IP address — to route the request and block attacks, and so do the two image hosts. That is described under who else sees it.

Card details are typed into fields hosted by Stripe, loaded from Stripe’s own domain, inside a frame Kiuki does not control. The number, expiry and security code go from your browser to Stripe. They do not pass through our servers and we do not store them — not the number, not the last four digits, nothing. What we hold is Stripe’s reference for the payment and whether it succeeded.

We tell Stripe the amount, the currency, your order number and your email address, so that Stripe can send you its own receipt. Stripe is a controller in its own right for the card data it handles, under its own privacy policy.

An order is only marked paid when Stripe tells our server, over a signature-verified message, that the payment succeeded and that the amount and currency match what you were quoted. That is deliberate: the system this shop replaced marked orders paid without checking, and told people it had worked while charging them nothing.

There are five, and that is the complete list. There is no newsletter, no marketing list and no advertising email.

Order confirmation, and a refund notice if it comes to that. Sent because you bought something. Basis: contract.

One reminder about an unfinished basket. If you reach checkout, enter your email and address, and then do not pay, we send a single email about an hour later. One only, never twice, never after a week. Basis: legitimate interests — recovering a sale you had already started, using an address you had just given us in the course of buying. Every reminder carries a one-click link that stops them for good, the checkout page tells you we may send one before you type your address, and you can object any time at [email protected] — we will stop and delete the record.

A back-in-stock alert you asked for. One email, about one product, when it returns. Basis: consent. To withdraw it before it is sent, email us and we will delete the entry.

An acknowledgement of a brand claim. Sent to whoever submitted the claim, confirming we have it. Basis: steps taken at your request before a contract.

Emails are sent through Cloudflare. We do not put tracking pixels in them and we do not record whether you opened one or clicked anything. If we ever open a sign-in on this site there will be a sixth — a single-use sign-in link — and this page will say so before it is sent.

Cloudflare hosts the site, runs the database that holds orders, and sends our email. It processes your data on our instructions. As the network carrying every request, it also handles connection data such as your IP address to deliver pages and defend the site.

Stripe processes the payment, and is a controller for the card details it takes directly from you.

Two image hosts. The product photographs on this site are not served by us. They are loaded from Google Cloud Storage (storage.googleapis.com) and from Shopify’s content network (cdn.shopify.com), which means your browser asks Google or Shopify for each picture directly. Those requests carry your IP address, your browser’s user agent and the address of the page you are on. We send them nothing else, they set no cookies here, and none of it is used for analytics or advertising. Both companies are outside the UK. We would rather serve those images from our own domain, and intend to.

The supplier packing your parcel. Kiuki is the seller on every order — your contract is with us — but the goods are picked and posted by one of two suppliers, and they cannot post to you without knowing where you are. They receive your name, delivery address, email address (so the carrier can tell you the parcel is coming), the items and the order reference. Nothing else. They are CLF Distribution, listed on this site as The Good Grocer, who dispatch from their own UK warehouse, and Whole Food Earth, who dispatch from 59–63 Hopes Lane, Ramsgate CT12 6UW. Which one it is depends on what you bought, and it is named on the product page and on your order.

Beyond those, no one — except where the law requires it, such as a valid request from a public authority, or where we need to take or defend a legal claim.

Our database and our site sit on Cloudflare’s network. Both our suppliers are in the United Kingdom. Stripe is headquartered in the United States, so payment data reaches the US, and the two image hosts are outside the UK as well.

Transfers out of the UK by Cloudflare and Stripe are made under the standard contractual clauses and the UK addendum contained in their data processing terms. If you want to read them, email [email protected] and we will send you a copy of each, or a direct link to the current version.

Kiuki sets no cookies at all today. There is no sign-in on this site, so there is nothing to keep you signed in with, and no cookie is set on any page. The software behind the shop can issue one strictly necessary sign-in cookie — kiuki_session, HttpOnly, Secure, SameSite=Lax, thirty days — and if we ever open sign-in we will say so here first. Even then it would be strictly necessary and would need no permission, and there would still be nothing else to ask about. That is why there is no cookie banner.

Four things are kept in your browser’s own storage. Nothing here is sent anywhere while you browse, and the only one that ever reaches us is the basket, at the moment you check out:

kiuki-basket — your basket. It lives in your browser, not on our server. We only learn what is in it when you go to checkout and enter your details.
kiuki-theme — whether you chose light or dark.
kiuki-over18 — that you have already confirmed you are 18 or over, so you are not asked repeatedly.
kiuki-order — the reference of the order you have just placed, so the confirmation page can find it.

You can clear all of it at any time through your browser’s site-data settings. You will lose your basket and your theme; nothing else breaks.

Stripe’s script is loaded on two pages only — the checkout page and the confirmation page after payment. It is not on any page you browse. Stripe sets its own storage on those two pages, for fraud prevention, under its own terms.

We are going to be straight about this, because the alternative is to publish a schedule that is not real. Today, nothing is deleted automatically. There is no expiry job running against our database. Orders, addresses, messages and stock alerts from the shop’s first day are still there.

That is not where we intend to leave it. This is the schedule we are putting in place, and until it runs we will apply it by hand whenever anyone asks:

Orders, order items and order messages — six years after the end of the financial year the order falls in, which is how long we have to keep business and tax records. Unpaid, abandoned checkouts — twelve months. Back-in-stock alerts — deleted 30 days after the email is sent, or immediately if you ask. Brand claims — two years after the claim is settled.

Where a record has to stay for the six-year tax period, we can still remove what is not needed for it. Ask us and say what you want gone.

One thing to be straight about: there is no automatic deletion job yet. Those periods are the schedule we work to, and today we apply them by hand when a record reaches them or when you ask. If you ask us to delete something we will do it, and we will tell you what we had to keep for the tax period and why.

Under UK GDPR you can ask us to give you a copy of the personal data we hold about you; correct it if it is wrong; delete it; restrict what we do with it; or send it to you, or another provider, in a machine-readable form. You can object to anything we do on the basis of legitimate interests, which here means the abandoned-basket email and the record that you confirmed your age. You can withdraw consent to a back-in-stock alert at any time, which does not affect anything done before you withdrew it.

Email [email protected]. We will reply within one month. It is free. We may need to ask something to be sure it is your data we are handing over — usually the email address the order was placed with and the order reference — and we will not ask for more than that.

Nothing here is decided about you by an automated system, and we do not profile you.

Tell us first, at [email protected] — it is usually the fastest way to have something fixed. You do not have to. You can complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Complaining to them does not affect any other right you have.

If we change what we do with your data, we change this page and the date at the top. We will not quietly add analytics, an advertising pixel or a marketing list and leave this page saying otherwise; if any of that ever changes, it will say so here first.

What we buy under, and what happens if something goes wrong with an order, is on Terms of sale and Returns & refunds.