Privacy policy

Privacy Policy

Last updated: August 22, 2026

This Privacy Policy describes how THANKS KAI, operated by PLENTY INTERNATIONAL, UVOZ IN IZVOZ IZDELKOV, HUISEOP YUN S.P. ("THANKS KAI", "we", "us" or "our"), collects, uses and discloses personal data when you visit or use thankskai.shop, place an order, create an account or otherwise communicate with us (the "Services"). We are the controller unless stated otherwise.

Please read this Privacy Policy carefully.

Changes to This Privacy Policy We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Site, update the "Last updated" date and take any other steps required by applicable law.

How We Collect and Use Your Personal Information To provide the Services, we collect personal information about you from a variety of sources, as set out below. The information that we collect and use varies depending on how you interact with us.

In addition to the specific uses set out below, we may use information we collect about you to communicate with you, provide or improve the Services, comply with any applicable legal obligations, enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.

What Personal Information We Collect

Information We Collect Directly from You Information that you directly submit to us through our Services may include:

  • Contact details including your name, address, phone number, and email.
  • Order information including your name, billing address, shipping address, payment confirmation, email address, and phone number.
  • Account information including your username, password, security questions and other information used for account security purposes.
  • Customer support information including the information you choose to include in communications with us, for example, when sending a message through the Services.

Information We Collect about Your Usage We may also automatically collect certain information about your interaction with the Services ("Usage Data"). To do this, we may use cookies, pixels and similar technologies ("Cookies"). Usage Data may include information about how you access and use our Site and your account, including device information, browser information, information about your network connection, your IP address and other information regarding your interaction with the Services.

Information We Obtain from Third Parties We may obtain information about you from third parties, including from vendors and service providers who may collect information on our behalf, such as:

  • Companies who support our Site and Services, such as Shopify.
  • Our payment processors, who collect payment information (e.g., bank account, credit or debit card information, billing address) to process your payment in order to fulfill your orders and provide you with products or services you have requested, in order to perform our contract with you.
  • When you visit our Site, open or click on emails we send you, or interact with our Services or advertisements, we, or third parties we work with, may automatically collect certain information using online tracking technologies such as pixels, web beacons, software developer kits, third-party libraries, and cookies.

How We Use Personal Data and Our EEA Legal Bases

  • Contract (Art. 6(1)(b) GDPR). We use contact, account, order, payment-confirmation and delivery data to enter into and perform our contract, including payment, fulfilment, delivery, returns, refunds and service messages.
  • Legal obligations (Art. 6(1)(c)). We process and retain data to meet tax, accounting, consumer-protection, product-safety and other legal duties and to respond to competent authorities.
  • Legitimate interests (Art. 6(1)(f)). We process data where necessary and proportionate to secure the Site, prevent fraud and misuse, troubleshoot, protect legal claims and improve non-advertising operation. We consider the effect on your rights. This basis does not cover non-essential Cookies where consent is required.
  • Consent (Art. 6(1)(a)). In the EEA, we rely on consent for non-essential Personalization, Analytics and Marketing Cookies or similar technologies and for electronic direct marketing where required. You may refuse or withdraw consent at any time without affecting earlier lawful processing.
  • Marketing. We send promotional email or SMS only with consent where required, or where applicable law otherwise permits it. Each promotional message provides an unsubscribe method, and an objection to direct marketing stops that processing.

Cookies and Similar Technologies

Our consent tool uses four categories. Required technologies support security, login, cart, checkout, fraud prevention and recording privacy choices. Personalization technologies remember choices. Analytics technologies measure and improve the Site and review functions. Marketing technologies support advertising, attribution and measurement. In the EEA, non-essential Personalization, Analytics and Marketing technologies are used only after you make the relevant affirmative choice. Refusing them does not prevent essential shopping functions.

You may reject all optional technologies, select categories separately, or later change or withdraw consent through Cookie preferences. Withdrawal is as easy as giving consent and does not affect earlier lawful processing. Browser controls may also delete or block Cookies, but can affect Required functions.

Technology and Provider Register

  • Shopify. Shopify International Limited, Shopify Inc. and their affiliates and subprocessors provide the ecommerce platform, hosting, security, checkout, consent management and analytics services. Required Shopify technologies operate where strictly necessary; optional Shopify analytics, personalization and marketing technologies follow the relevant consent choice. Shopify Network Intelligence is enabled and may combine store interaction data with other Shopify data to improve Shopify services, measurement, advertising targeting and personalization, subject to applicable consent and opt-out choices. Depending on the service, Shopify may act as our processor or as an independent controller. See the Shopify Consumer Privacy Policy and Shopify Cookie Policy for current technologies and durations.
  • Facebook and Instagram by Meta. We use Meta Pixel ID 921559106871580 through Shopify in web and server-side form, including the Conversions API, with optimized data access. When the required Analytics and Marketing permissions are given, this integration may process IP address, browser and device information, online identifiers, referring pages, pages and products viewed, searches and interactions, cart, checkout and purchase events, order value, currency and timestamps. Optimized matching may also use customer identifiers such as name, email address, phone number or address when available, permitted and supported. We use this information for advertising measurement, attribution, audience measurement and personalization. Shopify classifies the integration as data sale or sharing for applicable opt-out rules, and the integration is configured not to collect when an applicable sale or sharing opt-out applies. Meta cookies such as _fbp and _fbc may remain for up to 90 days, subject to Meta settings and policy. See the Meta Privacy Policy and Meta Cookies Policy.
  • Judge.me Reviews. Judge.me Ltd provides product and store review functionality, review invitations, verified-buyer checks, display of reviews, abuse prevention and related analytics. It may process customer name and email, order and product details, and review content where those functions are used. Its Shopify app pixel requires Analytics permission for analytics collection and is configured as not constituting data sale. See the Judge.me Privacy Policy.

As of August 22, 2026, no user-created custom pixel is connected in Shopify Customer events. If we add or materially change an optional analytics, advertising, translation, social-feed, review or custom-pixel provider, we will update this register and connect it to the appropriate consent before optional use in the EEA.

How We Disclose Personal Data

  • With processors and service providers needed to operate the Services, including Shopify, Judge.me, payment processors, IT and cloud providers, customer support, approved fulfilment suppliers, and Post, FedEx or DHL where selected or required for delivery.
  • With analytics or advertising providers, including Meta and the optional Shopify analytics and marketing services described above, only where the relevant consent or another valid legal basis applies.
  • When you direct or consent to a disclosure.
  • To comply with law, respond to authorities, enforce terms, protect legal claims, or address fraud, security or safety.
  • In a lawful business transaction such as a merger, acquisition or insolvency process, subject to applicable safeguards.

Third Party Websites and Links Our Site may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites.

Children's Data The Services are not intended to be used by children, and we do not knowingly collect any personal information about children. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted.

Security and Retention of Your Information No security measure is perfect, but we use technical and organisational measures proportionate to risk. We retain transaction records for statutory tax, accounting, consumer-protection and limitation periods; account data while active and afterward only for obligations or claims; support records until the matter and related claim period end; marketing and consent records until withdrawal or objection and as needed to demonstrate compliance; and Cookie or analytics identifiers according to the consent setting and provider schedule. We then delete or anonymise data unless a legal hold or longer statutory period applies. You may ask for more specific retention information.

Your Rights in the EEA Subject to legal conditions and exceptions, you may request access, rectification, erasure, restriction and portability; object to processing based on legitimate interests; object at any time to direct marketing; withdraw consent at any time; and lodge a supervisory-authority complaint. Where applicable, you may also request not to be subject to a solely automated decision producing legal or similarly significant effects. We may verify identity and will respond without undue delay and within the legal period. Exercise these rights at kai@thankskai.shop.

Complaints Contact us first if you have a concern. You may also complain, without prejudice to another remedy, to the authority where you live, work or where the alleged infringement occurred. Our Slovenian supervisory authority is the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, SI-1000 Ljubljana, email: gp.ip@ip-rs.si.

International Transfers Some service providers may process data outside the EEA. Where no applicable European Commission adequacy decision covers a transfer, we use an available lawful mechanism such as the European Commission Standard Contractual Clauses, with supplementary measures where required. Contact kai@thankskai.shop for information about the applicable safeguard or a copy subject to lawful redactions.

Contact

THANKS KAI is operated by PLENTY INTERNATIONAL, UVOZ IN IZVOZ IZDELKOV, HUISEOP YUN S.P., Cikava 23, 1290 Grosuplje, Slovenia. Registration number: 8954127000. VAT ID: SI31594603. Email: kai@thankskai.shop. Phone: +386 69 976 028.

The operator identified above is the controller for applicable data-protection law.