Integritet
KIPLAR LTD. is the controller of the personal data described in this policy. Effective from 4 November 2026.
1. Who is responsible
- Company: KIPLAR LTD., UIC 206403444, 47 Cherni Vrah blvd., fl. 4, 1407 Sofia, Bulgaria. VAT BG206403444.
- Contact for privacy questions: css@kiplar.agency. We answer within one month, usually much sooner.
- This policy covers: merchants who use KIPLAR CSS (section 2) and visitors of css.kiplar.pro and kiplar.pro (section 3).
- Not covered: the shops you visit from our comparison site. Each shop has its own privacy policy.
2. Merchants: what we process and why
We process only what we need to run KIPLAR CSS, bill you and meet our legal duties. We do not sell personal data and do not receive personal data about your shoppers.
| Data | Why | Legal basis (GDPR art. 6(1)) | How long |
|---|---|---|---|
| Name, work email, phone | Your account, login codes, service messages | (b) contract | While your account exists, then 90 days |
| Google account ID (if you sign in with Google) | Sign-in | (b) contract | Same as your account |
| Company name, address, country, VAT number | Invoices and VAT | (b) contract; (c) legal duty | Account period; on invoices as long as accounting law requires |
| Merchant Center IDs, shop names, shop URLs, countries | Registering your accounts in Google’s CSS program | (b) contract | Account period, then 90 days |
| Product data from your feed | Showing your offers on css.kiplar.pro | (b) contract | Removed within 7 days after your subscription ends |
| Subscription, invoices and payment history | Billing | (b) contract; (c) legal duty | As long as accounting and tax law requires |
| Card brand, last 4 digits, expiry (from Stripe) | Showing your payment method | (b) contract | Account period |
| Date and version of the Terms you accepted | Proof of our agreement | (f) legitimate interest | Account period, then 5 years |
| Messages you send us | Answering you | (b) contract; (f) legitimate interest | 2 years after the last message |
| Login session (IP address, browser) | Keeping you signed in, security | (f) legitimate interest | Session length, 2 hours |
You give us this data yourself when you sign up and use your account, except the payment details, which come from Stripe.
3. Visitors of our websites
You can search and compare prices on css.kiplar.pro without an account; we do not link your searches to you, and a click on an offer takes you straight to the shop.
| Cookie | Set by | Purpose | Lasts |
|---|---|---|---|
| Session and XSRF-TOKEN | Us | Keeps forms and sign-in working and safe (strictly necessary) | 2 hours |
| kcss_locale | Us | Remembers your language | Until you change it (up to 5 years) |
| kcss_country | Us | Remembers the country you chose on the comparison site | Until you change it (up to 5 years) |
| CookieScriptConsent | Cookie Script | Keeps your cookie choice (strictly necessary) | As shown in the cookie banner |
| _ga, _ga_8NX89FZ4JN | Google Analytics | Tells visits apart and measures how the websites are used (analytics) | 2 years |
| _fbp, _fbc | Meta | Measures the results of our ads on Facebook and Instagram and helps show them to people who visited the websites (advertising) | 3 months |
- Contact form: we store your name, email, shop, topic and message, plus your IP address and browser type to fight spam. Legal basis: our legitimate interest in answering you (art. 6(1)(f)). Kept 12 months.
- Turnstile: the contact, login and sign-up forms use Cloudflare Turnstile, which checks whether a visit looks automated. Cloudflare processes your IP address and browser data for this.
- Analytics: Google Analytics 4 by Google shows us how visitors use kiplar.pro, css.kiplar.pro and the merchant account, for example which pages they open and where they came from.
- Advertising: the Meta Pixel by Meta measures the results of our ads on Facebook and Instagram and helps show our ads to people who visited kiplar.pro, css.kiplar.pro or the merchant account. For the Meta Pixel, we and Meta Platforms Ireland Limited are joint controllers for collecting the data on our websites and passing it to Meta; Meta is responsible for what it does with the data afterwards, under its own privacy policy.
- Your choice: analytics and advertising cookies are set from your first visit, and by using the websites you agree to them. You can refuse or withdraw them at any time in the cookie banner (Cookie Script) or with the “Cookie settings” link at the bottom of the page. After a refusal Google measures without cookies, and the Meta Pixel does not load. The banner also lists every cookie we use. Legal basis: your consent, given by using the websites and withdrawable at any time (art. 6(1)(a)).
- Key actions through our server: a sign-up, the start of a trial or subscription, and a sent contact form also reach Google Analytics and Meta from our own server (server-side tracking). Google Analytics gets them with the ID of its cookie, only if you have not refused analytics. Meta gets them with the IDs of its cookies, your IP address and browser type, only if you have not refused advertising cookies. If you have not refused advertising cookies, your email address goes too, hashed: turned into a one-way code that cannot be turned back into the address, so Google and Meta can tell us which ad led to the action.
4. Who receives data
We share personal data only with the service providers below, who process it for us under data processing terms, and with authorities where the law requires it.
| Recipient | What for | Where |
|---|---|---|
| Laravel Cloud (Laravel Holdings Inc.), with Neon (database) | Hosting the websites and database | EU, Frankfurt servers |
| Cloudflare | File storage (product feeds), DNS and network delivery; Turnstile, which checks the contact, login and sign-up forms for bots | Stored files in the EU; DNS, delivery and Turnstile on its worldwide network |
| Stripe Payments Europe Ltd. | Payments, invoices, tax calculation | Ireland, EU |
| Brevo (Sendinblue SAS) | Sending emails: login codes, notices | France, EU |
| Google Ireland Ltd. | Sign in with Google; Google’s CSS program, where we register your Merchant Center IDs; Google Analytics | Ireland, EU, and the USA |
| Meta Platforms Ireland Ltd. | The Meta Pixel and key actions from our server: measuring our ads on Facebook and Instagram and showing them to people who visited the websites (joint controller, see section 3) | Ireland, EU, and the USA |
| Cookie Script (Objectis Ltd.) | The cookie banner, which keeps your cookie choice | Lithuania, EU |
| Our accountant, tax authorities | Bookkeeping and VAT, as the law requires | Bulgaria |
Transfers outside the EU: some of these providers belong to US groups and may access data from the USA. Such transfers rely on the EU–US Data Privacy Framework or on the EU Standard Contractual Clauses.
5. Your rights
You can ask us at any time to see, correct, delete or hand over your data, or to stop or limit its use.
- Access, correction, deletion, portability, restriction: write to css@kiplar.agency. We answer within one month. We keep data we must keep by law (for example invoices) even if you ask for deletion.
- Objection: you can object to any processing based on our legitimate interest.
- Consent: where we rely on your consent (for example optional cookies), you can withdraw it at any time; this does not affect what happened before.
- Complaints: you can complain to the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov blvd., Sofia 1592, cpdp.bg, or to the data protection authority in your own country.
6. Security and changes
We protect your data with encrypted connections (HTTPS), access limited to our team, and sign-in by one-time email codes or Google instead of stored passwords.
- Changes: if we change this policy in a way that affects merchants, we email you at least 30 days in advance. The current version and its date are always on this page.
- Version: effective from 4 November 2026.