Under Law No. 124/2024 "On the Protection of Personal Data" (collectively referred to as the "Law"), the data controller is responsible for ensuring that your data is held securely, that you are provided with accurate information on how your data is used, and that your rights in relation to your data are respected.

For the purposes of the Law, the data controller for any personal data we hold about you is UNLIMITED FASHION SHPK, part of the Balfin Group, with NIPT M42325020H and with its registered office at Brunes Space Building, TEG Shopping Centre, Tirana–Elbasan National Road, Farkë, Lundër, Tirana, Albania (referred to as "KIABI").

We collect and process only data that is required to enable us to provide you with our services.

We collect the following data when you browse and seek to place an order through www.kiabi.al:

• In the event of account creation, we collect first name, last name and email address.
• In the event of processing a distance purchase, we collect (first name, last name, email address, phone number and residential (billing) address and the shipping address if different from the residential (billing) address).
• We collect and process data relating to your browsing on www.kiabi.al, including the pages you visit and the way you interact with those pages. If you are registered with an account, we collect browsing data relating to your access to www.kiabi.al.
• We collect and process your personal data for direct marketing activities if you are a Kiabi customer or have given us your consent.
• When you use www.kiabi.al, we will request your consent to collect personal data from you in order to send short messages, "push notifications", regarding products that we believe may be of interest to you.
• When you call our Customer Care team, your call will be recorded for training and fraud prevention purposes.

We collect and process your personal data for the following purposes:

• When you visit the website, we will use some data relating to your use of the website to help us improve the Website and our promotion of it. This will include data on how you arrived at the website, the date and time of your visit, the products you viewed or searched for, page response times, download errors, etc.), the duration of visits to certain pages, page interaction data and the methods used to leave the page;
• We also collect data relating to your use of the Website using Cookies. More information on how we use Cookies is included in our Cookie Policy.
• When you register for a user account on www.kiabi.al, we will collect data to identify you as a user and to grant you access to various functionalities, products and services available to you as a registered user. If you prefer not to continue receiving this access, you may unsubscribe at any time using the link at the bottom of the page or by contacting our Customer Care team.
• When you register for our marketing communications, we will ask you for your email address, gender, first name, last name, date of birth and phone number. If you prefer not to receive any communications, you may unsubscribe at any time from each communication channel or by contacting our Customer Care team.
• We analyse contact data and purchase history in order to fulfil your preferences.-    We will use your data (first name, last name, email address, phone number, residential (billing) address and shipping address if different from the residential (billing) address) in order to process your order placed on www.kiabi.al.
• When you contact our Customer Care team, we will use the personal data you provide and that we have collected to respond to your requests for assistance or information.
• When you call our Customer Care team, your call will be recorded for training and fraud prevention purposes.
• We will use the contact information you provide to send service messages, such as any changes to our Terms and Conditions or Privacy Policy, delivery updates or other non-marketing communications.

Under the Law, we must have a valid reason for using your personal data and cannot collect, store or use data about you that is not consistent with that reason. There are three valid reasons for our use of your personal data:

The legal basis for each of the ways in which we use your personal data is as follows:Most of the data we collect from you is necessary to allow us to fulfil our contract with you or to enter into a contract with you, e.g. when ordering a product you provide your first name, last name, email address, phone number and residential (billing) address and shipping address if different from the residential (billing) address.;

In certain circumstances, we will request your permission or consent to use your personal data, e.g. if we wish to send you marketing information about items we believe may be of interest to you via email or SMS. If you have given your consent to our use of your personal data, you have the right to withdraw that consent at any time.

We may also have a legitimate interest in using your personal data, e.g. to ensure that the content of our Programme is presented to you and your device as effectively as possible, or to ensure that our marketing communications are relevant to your interests. If this is our reason for using your data, we must ensure that our interests do not override yours, and you have the right to object to this use of your data.

Your personal data will be processed by Unlimited Fashion's internal staff, who are specifically trained and authorised for this processing.

Your personal data will also be transmitted to third parties that we use to provide our services; these parties have been rigorously assessed and provide a guarantee of compliance with the legislation on personal data processing. These parties are appointed as data processors and carry out their activities in accordance with the instructions given by Unlimited Fashion and under our control.

With your consent, by accepting these Policies, we may share your behaviour as a customer solely for surveys with Happy or sub-contractors, listed below:

The third parties in question belong to the following categories: Customer Care Service (Happy), Courier / Postal Service, Shopify, Kiabi International Development.

In some circumstances we may be required to disclose or share your data without your consent, for example if required to do so by police forces, courts or for other legal reasons. Your data may be transmitted to police, judicial and administrative authorities, in accordance with the law, for the investigation and prosecution of crimes, prevention and protection against threats to public security, to allow HAPPY to establish, exercise or defend a right in court, as well as for other reasons related to the protection of the rights and freedoms of others.

We may also transfer your personal data to a buyer or potential buyer in the event that our assets are purchased by another organisation. The buyer will be legally obliged to use your personal data only as described in this Privacy Policy.

We retain your personal data for a limited period of time in accordance with our data retention policy. The specific retention period will vary depending on the reason for the processing of your personal data. After this period, your data will be permanently deleted or irreversibly anonymised. Your personal data is retained in accordance with the following criteria:

When you make a request for a distance purchase, we will retain your data for 3 (three) years or until you cancel your subscription to the service, and we will delete your data within one month of your request. In the event that you do not use the Programme within 3 (three) years, we will delete your data one month after the end of this period.

When you give us your consent to send you marketing communications, you may withdraw your consent at any time. We will consider your consent to be valid for 3 (three) years from your last interaction with any email we send you, with our Application or with www.kiabi.al. In the event that consent is not renewed, we will not send marketing communications.

When we use your personal data and browsing history to analyse your behaviour with the aim of personalising the Programme and showing you personalised sales offers, we will retain the data for analytical purposes until you ask us to delete them.

When we use personal data for market research and satisfaction surveys, we will retain the data until you ask us to stop.

When you contact our Customer Care team, we will retain any additional personal data you provide that is specific to your request for as long as you remain an active customer of www.kiabi.al and the application.

When you contact our Customer Care team, we will retain the call recording for six months.

Distance purchases through the www.kiabi.al website are permitted for persons over the age of 16. The processing of personal data for those of you who have made purchases and are between 16 and 18 years of age will be carried out on the basis of consent as provided for in this Policy.

In the event that a minor under the age of 16 makes a distance purchase, consent and authorisation must be provided by the parent or legal guardian.

You have the right to request a copy of the data we hold about you (and we will provide it to you free of charge once we have confirmed your identity).

If you would like a copy of some or all of your personal data, please send us an email or write to us using the contact details in this policy.

If we hold data about you, we will:

- provide you with a description of it
- tell you why we are holding it
- tell you who it may be shared with
- tell you how long we will hold the data
- if the data has not been provided by you, we will provide you with any available information, such as the source of the data
- tell you whether the data has been used for automated decision-making
- allow you to have a concise and clear copy of the data

You have the right to ask us to correct any inaccuracies in the personal data we hold about you and to ask us to stop using your data until they have been corrected. We want to ensure that your personal data is accurate and up to date and will be happy to correct or remove data that you consider to be inaccurate.

If you have given us your consent to use your personal data for marketing, you have the right to withdraw your consent at any time by calling our Customer Care team, clicking "unsubscribe" in a marketing email or replying STOP to a text message. You may receive a small number of further communications immediately after unsubscribing, but we will action your request as soon as possible.

You have the right at any time to object to the processing of your personal data on the basis of our legitimate interest. You will need to explain the reasons behind your request and allow us to review it and respond to you.

You have the right to request the deletion of your personal data. Upon receipt and review of your request, if it is lawful, it will be our responsibility to immediately cease processing and delete your personal data. You have the right to receive a copy of your data that we process based on your consent or on the basis of a contract with you in a standard format. If you wish, where technically possible, we may transfer your data directly to a third party indicated by you.

To exercise any of these rights, you may access your account or contact our Customer Care team at customer.support@unlimitedfashion.al.

To ensure that our users' data is not subject to breaches or unlawful use by third parties, we will ask you to confirm your identity before we process your request.

We protect your personal data with specific technical and organisational security measures aimed at preventing unlawful or fraudulent use of your personal data.

In particular, we use security measures that guarantee: the pseudonymisation or encryption of your data; the confidentiality, integrity and availability of your data, as well as the resilience of the systems and services that process them; the ability to restore data in the event of a data breach. Furthermore, Unlimited Fashion undertakes to regularly test, verify and assess the effectiveness of the technical and organisational measures in order to guarantee the continuous improvement of processing security.

If you believe that Unlimited Fashion is processing your personal data in breach of the Law, you may lodge a complaint with the supervisory authority responsible for compliance with the rules on personal data protection.

In Albania, a complaint may be submitted to the Commissioner for the Protection of Personal Data (referred to as the "DPC"). More information on how to complain is available on the DPC Platform at https://www.idp.al/ankohu-3/.

Where and how to ask questions or contact us regarding this policy.

If you need more information regarding our privacy policy, please go to the Help section of our Programme where frequently asked questions (FAQs) are answered. We welcome your questions, comments and requests regarding this privacy policy. If you need more information, please contact our privacy officer. If you would like to speak with a Customer Care representative, please call us on + 044 81 3007 or by email at customer.support@unlimitedfashion.al.

The processing of your personal data is carried out by Unlimited Fashion SH.P.K. in accordance with Law No. 124/2024 "On the Protection of Personal Data" and Articles 13 and 14 of the General Data Protection Regulation (GDPR) on the processing of personal data and the rules on the processing of personal data.