Tietosuoja
KIPLAR LTD. is the controller of the personal data described in this policy. Effective from 26 October 2026.
1. Who is responsible
- Company: KIPLAR LTD., UIC 206403444, 47 Cherni Vrah blvd., fl. 4, 1407 Sofia, Bulgaria. VAT BG206403444.
- Contact for privacy questions: css@kiplar.agency. We answer within one month, usually much sooner.
- This policy covers: merchants who use KIPLAR CSS (section 2) and visitors of css.kiplar.pro and kiplar.pro (section 3).
- Not covered: the shops you visit from our comparison site. Each shop has its own privacy policy.
2. Merchants: what we process and why
We process only what we need to run KIPLAR CSS, bill you and meet our legal duties. We do not sell personal data and do not receive personal data about your shoppers.
| Data | Why | Legal basis (GDPR art. 6(1)) | How long |
|---|---|---|---|
| Name, work email, phone | Your account, login codes, service messages | (b) contract | While your account exists, then 90 days |
| Google account ID (if you sign in with Google) | Sign-in | (b) contract | Same as your account |
| Company name, address, country, VAT number | Invoices and VAT | (b) contract; (c) legal duty | Account period; on invoices as long as accounting law requires |
| Merchant Center IDs, shop names, shop URLs, countries | Registering your accounts in Google’s CSS program | (b) contract | Account period, then 90 days |
| Product data from your feed | Showing your offers on css.kiplar.pro | (b) contract | Removed within 7 days after your subscription ends |
| Subscription, invoices and payment history | Billing | (b) contract; (c) legal duty | As long as accounting and tax law requires |
| Card brand, last 4 digits, expiry (from Stripe) | Showing your payment method | (b) contract | Account period |
| Date and version of the Terms you accepted | Proof of our agreement | (f) legitimate interest | Account period, then 5 years |
| Messages you send us | Answering you | (b) contract; (f) legitimate interest | 2 years after the last message |
| Login session (IP address, browser) | Keeping you signed in, security | (f) legitimate interest | Session length, 2 hours |
You give us this data yourself when you sign up and use your account, except the payment details, which come from Stripe.
3. Visitors of our websites
You can search and compare prices on css.kiplar.pro without an account; we do not link your searches to you, and a click on an offer takes you straight to the shop.
| Cookie | Set by | Purpose | Lasts |
|---|---|---|---|
| Session and XSRF-TOKEN | Us | Keeps forms and sign-in working and safe (strictly necessary) | 2 hours |
| kcss_locale | Us | Remembers your language | Until you change it (up to 5 years) |
| kcss_country | Us | Remembers the country you chose on the comparison site | Until you change it (up to 5 years) |
- Contact form: we store your name, email, shop, topic and message, plus your IP address and browser type to fight spam. Legal basis: our legitimate interest in answering you (art. 6(1)(f)). Kept 12 months.
- Turnstile: the contact form uses Cloudflare Turnstile, which checks whether a visit looks automated. Cloudflare processes your IP address and browser data for this.
- Analytics and consent: we use no analytics or advertising cookies at the moment. Before we add any (for example Google Analytics or ad conversion tags), we will ask for your consent with a cookie banner and update this policy.
4. Who receives data
We share personal data only with the service providers below, who process it for us under data processing terms, and with authorities where the law requires it.
| Recipient | What for | Where |
|---|---|---|
| Laravel Cloud (Laravel Holdings Inc.), with Neon (database) | Hosting the websites and database | EU, Frankfurt servers |
| Cloudflare | File storage (product feeds), DNS and network delivery; Turnstile, which checks the contact form for bots | Stored files in the EU; DNS, delivery and Turnstile on its worldwide network |
| Stripe Payments Europe Ltd. | Payments, invoices, tax calculation | Ireland, EU |
| Brevo (Sendinblue SAS) | Sending emails: login codes, notices | France, EU |
| Google Ireland Ltd. | Sign in with Google; Google’s CSS program, where we register your Merchant Center IDs | Ireland, EU, and the USA |
| Our accountant, tax authorities | Bookkeeping and VAT, as the law requires | Bulgaria |
Transfers outside the EU: some of these providers belong to US groups and may access data from the USA. Such transfers rely on the EU–US Data Privacy Framework or on the EU Standard Contractual Clauses.
5. Your rights
You can ask us at any time to see, correct, delete or hand over your data, or to stop or limit its use.
- Access, correction, deletion, portability, restriction: write to css@kiplar.agency. We answer within one month. We keep data we must keep by law (for example invoices) even if you ask for deletion.
- Objection: you can object to any processing based on our legitimate interest.
- Consent: where we rely on your consent (for example optional cookies), you can withdraw it at any time; this does not affect what happened before.
- Complaints: you can complain to the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov blvd., Sofia 1592, cpdp.bg, or to the data protection authority in your own country.
6. Security and changes
We protect your data with encrypted connections (HTTPS), access limited to our team, and sign-in by one-time email codes or Google instead of stored passwords.
- Changes: if we change this policy in a way that affects merchants, we email you at least 30 days in advance. The current version and its date are always on this page.
- Version: effective from 26 October 2026.