Privacy policy.

We collect the minimum we need to ship Kalmely, take payment, and answer your questions. We don't sell your data — to anyone, ever.

1. Who we are

Kalmely Ltd ("Kalmely", "we", "us"). Registered office: [REPLACE: registered UK address]. Companies House: [REPLACE: company number]. Contact: hello@kalmely.com.

This policy explains how we handle personal data under the UK General Data Protection Regulation (UK GDPR), the EU GDPR, and the Data Protection Act 2018.

2. What we collect

When you place an order:

• Name, billing and delivery address, email, phone (optional)
• Payment details — processed by Stripe and Klarna directly; we never see or store full card numbers
• Order history, refund history, support correspondence

When you browse kalmely.com:

• IP address, browser type, device, referring URL
• Pages viewed, bundle selected, items added to cart
• Cookie identifiers (see section 5)

What we never collect:

• Health records, diagnoses, or any clinical data
• Special-category personal data under Article 9 UK GDPR — Kalmely is a wellness device, not a medical service

3. Why we process it

We process your data on the following lawful bases:

• Contract: to fulfil your order, deliver Kalmely, process refunds, and respond to support requests.
• Legitimate interest: to improve the site, prevent fraud, and measure the effectiveness of advertising.
• Consent: to send marketing emails (you can withdraw at any time), and to drop non-essential cookies (see section 5).
• Legal obligation: to retain tax records under HMRC rules (6 years), and to respond to lawful requests from authorities.

4. Who we share it with

We share data only with carefully chosen processors, each bound by data-processing agreements:

• Stripe Payments Europe Ltd — payment processing. Stripe has its own privacy policy.
• Klarna Bank AB — instalment payments, where you elect to use Klarna at checkout.
• EU warehouse and carrier partners — to dispatch and track your order. Currently DPD, Royal Mail, and Evri for UK deliveries.
• Meta Platforms Ireland Ltd — Meta Pixel for advertising measurement, only if you accepted marketing cookies.
• Google Ireland Ltd — Google Analytics 4 for site performance, only if you accepted analytics cookies.
• Customer support platform — to manage tickets. Currently [REPLACE: helpdesk provider, e.g. Help Scout].

5. Cookies and trackers

We use the following cookie categories:

• Essential (always on): session, cart contents, cookie-consent record. Cannot be disabled — the site won't function without them.
• Analytics (opt-in): Google Analytics 4. We use these to understand which pages and bundles get the most attention.
• Advertising (opt-in): Meta Pixel, Pinterest tag. We use these to measure ad effectiveness and to show you our products on platforms you already use.

You can change your cookie preferences at any time by clearing your browser's site data for kalmely.com, after which the banner will reappear.

6. International transfers

Our warehouse and most processors are in the EU/EEA, where data is protected under EU GDPR. Stripe and Meta may transfer data to the United States; in those cases, transfers rely on the EU-US Data Privacy Framework (where the processor is certified) and on Standard Contractual Clauses where it is not.

7. How long we keep it

• Order records: 6 years (HMRC requirement)
• Support tickets: 24 months from last contact
• Marketing email lists: until you unsubscribe, then 12 months suppression
• Cookie identifiers: see expiry dates listed in our cookie banner

8. Your rights

Under UK GDPR you have the right to: access your data, rectify inaccuracies, request erasure, restrict processing, object to processing, request portability, and withdraw consent at any time. To exercise any right, email hello@kalmely.com. We'll respond within one calendar month.

You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

9. Children

Kalmely is sold to adults only — minimum age 18. We do not knowingly collect data from anyone under 18. If you believe a child has placed an order, contact us and we will delete the record.

10. Changes to this policy

We may update this policy from time to time. Material changes will be flagged on the homepage for 30 days. The "Last updated" date at the top of this page always reflects the current version.