Legal documents

Privacy Policy

Last updated: 18 July 2026

Note: this document describes data processing in line with the actual technical state of the Site as of the update date (i.e. no active newsletter, no cookies in use). This document does not replace legal advice — especially before real sales and customer data collection begin.

1.Data controller

The controller of personal data processed in connection with the use of kyoraikitchen.com is Igor Wnuk, gen. Walerego Wróblewskiego 21/T, 93-566 Łódź (the "Controller"). Contact: kyorai.kitchen@gmail.com.

2.What data we process

The scope of data processed depends on how you use the Site:

Purposes and scope of data processing
Situation	What data	Current status
Simply browsing the Site	Standard server logs (IP address, browser type, visit time) — generated automatically by the Vercel hosting infrastructure	Active
Visit statistics	Aggregated, anonymous data about page views — which page was opened, the referring site, approximate country, device and browser type. Collected by Vercel Web Analytics, which uses no cookies and does not build a profile or identify individual visitors	Active
Using the cart	Selected products and their quantities — saved only locally in the browser (localStorage), not transmitted to the Controller	Active, data never leaves your device
Newsletter sign-up	Email address	The form is currently in development — it does not send or store any email addresses. Once the service is launched, this policy will be updated with the name of the newsletter provider.
Placing an order	First name, last name, delivery address, email address, payment details	The order is processed entirely on the Shopify platform, to which the Site redirects during checkout — Shopify then acts as an independent controller/processor of this data, under its own privacy policy

3.Legal bases for processing

Article 6(1)(f) GDPR (legitimate interest of the Controller) — for standard server logs necessary to ensure the security and proper functioning of the Site, and for aggregated, anonymous visit statistics used to understand which pages are useful and improve the Site.
Article 6(1)(b) GDPR (performance of a contract / pre-contractual steps) — for data provided when placing an order.
Article 6(1)(a) GDPR (consent) — for the future newsletter, once it launches.

4.Data recipients

Data may be entrusted to the following processors, to the extent necessary to provide the service:

Vercel Inc. — the hosting provider on whose infrastructure the Site runs, and the provider of Vercel Web Analytics, the cookieless tool used to count page views.
Shopify Inc. — the platform that handles the order and payment process.
Google LLC — the provider of fonts (Google Fonts) loaded from external servers; while a font is loading, the visitor's IP address is transmitted to Google.

5.Transfers outside the EEA

The providers listed above (Vercel, Shopify, Google) may process data on servers located outside the European Economic Area, including in the United States. Such transfers rely on GDPR-compliant mechanisms, in particular the standard contractual clauses approved by the European Commission, as applied by these providers.

6.Retention period

Cart data — stored locally in the browser until manually cleared or until the browser's storage expires; it never reaches the Controller.
Order data — stored by Shopify for the period required by tax and accounting regulations (typically 5 years from the end of the tax year).
Server logs — stored for as long as necessary to ensure the Site's security, in accordance with the hosting provider's policy.

7.Your rights

In connection with the processing of your personal data, you have the right to:

access your data,
rectify (correct) your data,
erase your data,
restrict processing,
data portability,
object to processing based on legitimate interest,
withdraw consent at any time (without affecting the lawfulness of processing carried out before withdrawal),
lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warsaw, Poland), if you believe the processing violates the GDPR.

To exercise the rights above, contact the Controller at the address given in §10.

8.Cookies and localStorage

The Site does not currently use cookies. The cart feature uses localStorage technology, which operates entirely locally in your browser — this data is not transmitted to the Controller or to any third party. Details are described in a separate Cookie Policy.

9.Data security

The Controller uses infrastructure (Vercel, Shopify) that applies connection encryption (HTTPS/TLS) and the standard security mechanisms of these service providers. Only authorized personnel have access to the data, to the extent necessary to carry out their duties.

10.Contact

For matters related to the protection of personal data, you can contact us at: kyorai.kitchen@gmail.com.

11.Changes to this policy

This policy may be updated, in particular in connection with the launch of new Site features (e.g. the newsletter). The date of the last update is shown at the top of this document.