Privacy Policy

KIRAKIRA TOY SHOP LTD

Last updated: 12 October 2026

SECTION 1 — ABOUT THIS POLICY

This Privacy Policy explains how KIRAKIRA TOY SHOP LTD collects, uses, shares and protects personal information when you visit kirakira-shop.com, create an account, place an order, subscribe to our newsletter or contact us.

“Personal information” means information that identifies you or can reasonably be linked to you.

In this policy, “we”, “us” and “our” mean KIRAKIRA TOY SHOP LTD.

This policy explains our use of personal information. It does not mean that you consent to every activity described here simply by visiting our website. Where consent is required, we ask for it separately.

Our Cookie Policy provides further information about cookies and similar technologies. Our Terms of Service, Delivery Policy and Refund Policy explain the conditions that apply to purchases.

SECTION 2 — WHO IS RESPONSIBLE FOR YOUR INFORMATION

KIRAKIRA TOY SHOP LTD is the data controller for the personal information we use to operate our shop. This means we decide why and how that information is used.

Company number: 17483664

Registered office: 566 Chiswick High Road, London, United Kingdom, W4 5YA

Email: [email protected]

Customer support hours: Monday to Friday, 9am to 5pm UK time.

For privacy enquiries or requests concerning your information, please contact us using the email address above.

Banks, payment providers and certain other organisations may act as separate data controllers for their own activities. Their privacy notices explain how they use information for those purposes.

SECTION 3 — PERSONAL INFORMATION WE COLLECT

The information we collect depends on how you interact with our website.

Account and contact information

When you register or update your profile, we collect information needed to create and manage your account. This may include your name, email address, account identifiers, login credentials and saved addresses.

We may also collect a telephone number where it is requested for delivery or customer support.

Order and delivery information

When you place an order, we collect details such as:

• Your name, billing address and delivery address.
• The products, quantities and options you select.
• Your order number, purchase date, prices and currency.
• Discount codes applied to your order.
• Delivery instructions and shipment status.
• Information about cancellations, returns, refunds and complaints.

If you arrange delivery to someone else, we may receive that person’s name, address and contact details. Please provide only information needed for delivery and ensure that you are entitled to share it.

Transaction information

Although payments are processed by third parties, we may receive limited information confirming a payment or refund, such as its status, amount, currency and transaction reference.

Depending on the provider, this may include the payment method used or masked card information. It does not include your full card number, card security code or banking authentication credentials.

Customer support information

We collect the information you provide when contacting us, including messages, order references and any photographs or documents you choose to send.

Please avoid sending sensitive information that is not necessary to resolve your enquiry.

Technical information

When you use the website, our systems and service providers may collect technical information such as your IP address, browser type, device information, access times, pages requested and error or security logs.

Information collected through optional cookies or similar technologies depends on the tools used and your choices.

Newsletter preferences

If you subscribe to our newsletter, we collect your email address, subscription preferences and records of your consent or withdrawal of consent. We may also record the issue and use of your welcome discount code.

SECTION 4 — HOW WE RECEIVE YOUR INFORMATION

We receive personal information:

• Directly from you when you register, order, subscribe or contact us.
• Automatically through the website and the technologies described in our Cookie Policy.
• From payment providers confirming payments, refunds or disputes.
• From delivery providers supplying tracking information, delivery confirmations or details of a delivery problem.
• From someone who provides your details as the recipient of an order.

We use information from these sources only for the purposes described in this policy or otherwise explained to you.

SECTION 5 — HOW AND WHY WE USE YOUR INFORMATION

We use personal information when we have a lawful reason to do so. The main reasons are explained below.

Managing your account and purchases

We use account, contact and order information to register you, process purchases, arrange delivery and provide customer support. This is necessary to perform our contract with you or take steps you request before a purchase.

If you are the recipient of someone else’s order, we use your delivery details for our legitimate interest in delivering that purchase to its intended recipient.

Sending order updates

We use your email address to send your order confirmation and invoice after payment, followed by a dispatch confirmation when the goods are sent.

We may also contact you about delivery problems, returns, refunds or product safety issues. These messages support your purchase or meet our legal obligations.

Keeping financial and legal records

We retain necessary invoices, order records and transaction information to meet accounting, tax and other legal obligations.

Protecting the shop and its customers

We use relevant account, technical and transaction information to prevent fraud, investigate suspicious activity, secure the website and handle payment disputes.

We normally rely on our legitimate interests in protecting customers and operating a secure business, or on a legal obligation where one applies.

Handling complaints and legal claims

We use relevant records to investigate complaints and establish, exercise or defend legal claims. This supports our legitimate interests in resolving disputes and may also be necessary to meet legal obligations.

Sending the newsletter and welcome offer

We use your consent to send the newsletter and your welcome email containing a 10% promotional code. You can withdraw your marketing consent at any time.

Maintaining and improving the website

We use necessary technical information to diagnose errors and maintain website performance and security.

Where optional analytics or similar technologies require consent, we ask for it before using them. Further details are available in our Cookie Policy.

When relying on legitimate interests, we consider whether our use of the information is necessary and whether your rights and interests outweigh our reasons for using it.

SECTION 6 — INFORMATION NEEDED TO PROVIDE OUR SERVICES

Some information is necessary to create your account, accept an order and deliver your products.

For example, we need a contact email address to manage your account and send order updates, and a delivery address to send physical goods.

If you do not provide required information, we may be unable to register your account, complete your purchase or resolve an enquiry.

Optional information and marketing subscriptions are not required to buy from us.

We do not routinely ask for sensitive personal information, such as health information or identity documents, to process an ordinary purchase. If additional information is genuinely needed for a specific issue, we will explain why and request only what is necessary.

SECTION 7 — THIRD-PARTY PAYMENTS

All payments are processed by third-party payment providers.

We do not directly collect or store your full payment card number, card security code, online banking password or payment authentication codes.

You provide payment credentials directly through the payment provider’s interface, your bank or the payment method you choose.

Our available payment methods include Visa, Mastercard and Apple Pay, subject to the options displayed at checkout.

To complete a transaction, we may share necessary order and checkout information with the payment provider, such as the order reference, amount, currency and relevant billing or contact details.

The provider may return limited transaction information so we can confirm your order, issue an invoice, arrange a refund or respond to a dispute.

Payment providers and banks may also process information for their own security, fraud prevention and regulatory obligations. Please read the privacy notices made available through the relevant payment service.

SECTION 8 — STRONG CUSTOMER AUTHENTICATION AND PSD2

Our checkout supports Strong Customer Authentication (SCA) through the payment providers and banks involved in the transaction.

SCA generally uses at least two independent verification elements from the following categories:

• Knowledge: something you know, such as a password or PIN.
• Possession: something you have, such as a registered phone or authentication device.
• Inherence: something you are, such as a fingerprint or facial recognition feature.

For card payments, authentication may be carried out through 3D Secure. Your bank may ask you to approve the payment in its app or complete another verification step.

The applicable requirements may arise under the UK Payment Services Regulations 2017 and related standards, or under the EU’s revised Payment Services Directive, commonly known as PSD2, and its implementing rules.

The relevant payment provider or bank determines which checks are needed and whether a permitted exemption applies. Not every payment requires a visible two-step authentication process.

We do not receive the PINs, one-time codes or biometric templates used to authenticate your payment. We may receive the authentication outcome or other transaction information needed to process the order.

SECTION 9 — NEWSLETTER AND WELCOME DISCOUNT

You can choose to subscribe to our newsletter for product news, new arrivals and special offers.

We keep appropriate records of your subscription, including when and how you agreed to receive marketing.

Creating an account or making a purchase does not automatically subscribe you to our newsletter.

You can unsubscribe at any time using the unsubscribe link in a marketing email or by contacting [email protected].

After you unsubscribe, we stop sending marketing emails. We may keep a minimal record of your opt-out so that your address is not accidentally added back to the mailing list.

Unsubscribing does not stop messages necessary to manage an order, such as invoices, dispatch confirmations or refund updates.

Withdrawing consent does not affect the lawfulness of marketing sent before you withdrew it.

SECTION 10 — COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies to support functions such as account access, shopping baskets, security and saved preferences.

Technologies that are strictly necessary to provide a service you request may operate without optional consent where the law permits.

If we use optional analytics, advertising or other technologies that require consent, we ask for your permission before activating them.

You can manage your choices through the cookie controls available on the website and your browser settings. Refusing optional technologies will not prevent you from using features that do not depend on them.

Please read our Cookie Policy for full details about the technologies used, their purposes and how to change your preferences.

SECTION 11 — WHO WE SHARE INFORMATION WITH

We share personal information only where needed for the purposes explained in this policy.

Recipients may include:

• Website and hosting providers that support our shop, account systems and data storage.
• Payment providers, banks and card networks involved in payments, refunds, fraud checks and disputes.
• Delivery and fulfilment providers that prepare, transport or deliver your order.
• Email and customer support providers that help us send service messages, manage enquiries and deliver newsletters to subscribers.
• Professional advisers, including accountants, legal advisers and insurers, where relevant to their work.
• Public authorities, including tax, customs, regulatory or law enforcement bodies, where disclosure is legally required or otherwise lawful.

Where a provider processes information on our behalf, we require appropriate contractual protections and instructions limiting its use of the information.

Some recipients, such as banks and customs authorities, use information under their own legal responsibilities and privacy notices.

If our business is reorganised, sold or transferred, relevant personal information may be shared with advisers or a prospective new owner, subject to appropriate confidentiality and data protection safeguards.

SECTION 12 — INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION

Our company is based in the United Kingdom. Some service providers or delivery partners may process personal information in other countries, including countries outside the European Economic Area (EEA).

An international transfer can occur when information is stored abroad or accessed remotely from another country.

Where a transfer is restricted by applicable data protection law, we use an appropriate legal mechanism before making it.

Depending on the transfer, this may include:

• An applicable UK adequacy regulation or EU adequacy decision recognising an adequate level of protection in the destination.
• The UK International Data Transfer Agreement.
• The UK Addendum used with the European Commission’s Standard Contractual Clauses.
• The European Commission’s Standard Contractual Clauses for transfers governed by EU GDPR.
• Another mechanism or limited exception permitted by the applicable law.

EU Standard Contractual Clauses alone are not sufficient for a restricted transfer under UK GDPR; an appropriate UK mechanism must also apply.

Where required, we assess the protection available in the destination country and use additional safeguards.

You can contact [email protected] to ask about relevant destinations and the safeguards used, or request a copy of applicable safeguards. We may redact confidential information or information relating to other people.

SECTION 13 — DATA SECURITY

We use technical and organisational safeguards appropriate to the information we handle and the risks involved.

These measures include encryption where appropriate, restricted access to personal information and security checks intended to identify weaknesses or unauthorised activity.

Access is limited to people and service providers who need the information for their work. Staff handling personal information receive appropriate guidance and training on confidentiality and data protection.

We periodically review our practices and security controls, including relevant internal checks and assessments of service providers, and make improvements where needed.

These measures aim to protect information against unauthorised access, misuse, alteration, disclosure, accidental loss or destruction.

No website or storage system can be guaranteed completely secure. This does not reduce our responsibility to maintain appropriate protections and respond to incidents.

If a personal data breach occurs, we will assess it, take appropriate action and notify the relevant authority and affected individuals where the law requires.

SECTION 14 — GDPR AND UK DATA PROTECTION

As a UK-based company, we handle personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.

The EU GDPR may also apply to certain activities, including offering goods to individuals in the EEA. Where it applies, we follow its relevant requirements.

Our approach is to:

• Use personal information lawfully, fairly and transparently.
• Collect it for clear purposes and avoid incompatible uses.
• Limit collection to information needed for those purposes.
• Take reasonable steps to keep information accurate.
• Retain information only for as long as there is a justified need.
• Protect it through appropriate security measures.
• Maintain records and procedures that support accountability.

We review our data handling, provide relevant staff training and assess risks when introducing or changing activities involving personal information. Where legally required, we carry out a data protection impact assessment before beginning higher-risk processing.

SECTION 15 — HOW LONG WE KEEP INFORMATION

We keep personal information only for as long as needed for the purpose for which it was collected, including any relevant legal requirements.

The retention period depends on the type of information and why we need it.

Account information

We keep information needed to operate your account while it remains active. After deletion, we remove or anonymise information that is no longer needed, subject to the exceptions below.

Orders, invoices and transaction records

We retain these records for the periods required by applicable accounting and tax laws. Relevant records may also be needed to handle returns, payment disputes or legal claims.

Customer support records

We retain correspondence for as long as reasonably needed to resolve the issue, support related follow-up and meet applicable legal or dispute requirements.

Newsletter records

We keep subscription information while you remain subscribed. After you unsubscribe, we may retain limited consent records and an opt-out record to demonstrate compliance and respect your preferences.

Technical and security records

Retention depends on the purpose of the log, the time needed to investigate errors or suspicious activity and any continuing security or legal need.

If information is relevant to an ongoing complaint, investigation or legal claim, we may retain it until that matter and any applicable retention obligation have ended.

Information no longer needed is deleted or anonymised. Backup copies are removed through the applicable backup lifecycle and are not used for ordinary business activities while awaiting removal.

SECTION 16 — DELETING YOUR ACCOUNT

You can delete your account directly through your profile settings.

You can also contact [email protected] if you need help or wish to make a separate request to erase personal information.

Deleting your account does not necessarily erase every record immediately. We may need to retain information about completed purchases, invoices, outstanding deliveries, refunds, fraud investigations or legal obligations.

Account deletion does not automatically cancel an existing order or remove your rights relating to that purchase.

Newsletter preferences are managed separately. You can unsubscribe using the link in a marketing email or ask us to stop marketing when you request account deletion.

SECTION 17 — YOUR DATA PROTECTION RIGHTS

Depending on the circumstances and the law that applies, you may have the following rights:

Access

Ask whether we hold personal information about you and request a copy.

Correction

Ask us to correct inaccurate information or complete information that is incomplete. You can also update available details through your profile.

Erasure

Ask us to delete information where there is no continuing lawful reason to keep it. This right is subject to exceptions, including certain legal recordkeeping obligations.

Restriction

Ask us to limit how we use information in certain circumstances, such as while its accuracy is being checked.

Portability

Request certain information you provided to us in a structured, commonly used, machine-readable format, where the legal conditions apply.

Withdrawal of consent

Withdraw consent at any time where our processing relies on it. This does not affect processing lawfully carried out before withdrawal.

Objection

You can object to processing based on legitimate interests for reasons relating to your situation. We will consider your objection and stop that processing unless a lawful reason allows us to continue.

You can object to the use of your information for direct marketing at any time. We will stop using it for that purpose.

To exercise a right, email [email protected]. You do not need an active account.

We may request information reasonably needed to verify your identity. We normally respond within one month, subject to lawful rules concerning verification, clarification and extensions. If an extension is permitted and needed, we will explain why.

Requests are normally free. If the law permits a fee or refusal in exceptional circumstances, we will explain our decision and your options.

SECTION 18 — COMPLAINTS AND APPLICABLE LAW

Our company is established in the United Kingdom, and UK data protection law applies to our activities. This does not remove protections available to you under other mandatory laws, including EU GDPR where applicable.

If you have a concern about how we use your information, please contact [email protected] so we can investigate.

SECTION 19 — CHANGES TO THIS POLICY

We may update this Privacy Policy when our services, providers, data practices or legal obligations change.

The current version will be available on the website with its update date.

Where a change materially affects how we use your personal information, we will provide appropriate notice. If a new use requires your consent, we will obtain it before beginning that activity.

SECTION 20 — CONTACT US

For questions about this policy or requests concerning your personal information, contact:

KIRAKIRA TOY SHOP LTD

Company number: 17483664

Registered office: 566 Chiswick High Road, London, United Kingdom, W4 5YA

Email: [email protected]

Customer support hours: Monday to Friday, 9am to 5pm UK time.