Privacy Policy

This Privacy Policy explains how Knala Ltd ("Knala", "we", "us", "our") collects, uses, stores and protects your personal information when you visit our website knala.co.uk, create an account, or purchase our products.

We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations (PECR).

1. About Us

We are the data controller of your personal information.

2. Information We Collect

2.1 Information you provide directly

• Name and contact details
• Shipping and billing address
• Account login details
• Order information and purchase history
• Email preferences and marketing consents
• Customer service communications

2.2 Information collected automatically

When you browse our website, we automatically collect:

• IP address
• Device type and browser type
• Cookies and tracking data
• Pages viewed and time spent on our website
• Referral source

2.3 Information from third parties

We may receive information from:

• Shopify (checkout, orders, fraud prevention)
• Omnisend (email sign-ups, pop-ups, marketing preferences)
• Meta Ads / Meta Pixel (ad performance and analytics, subject to your cookie consent)
• Google Analytics (site analytics and behaviour, subject to your cookie consent)
• Payment providers (fraud checks and payment confirmation)
• QuickBooks (accounting information related to orders)

3. How We Use Your Personal Information

We process your personal data for the following purposes. The lawful basis for each is shown alongside.

3.1 To fulfil your order Contractual necessity

• Processing your payment
• Shipping your order
• Updating you about delivery

3.2 To manage your Knala account Contractual necessity

• Login, password resets and maintaining account details

3.3 To send service and transactional messages Contractual necessity

• Order confirmations, dispatch emails and delivery updates

3.4 To provide customer support Contractual necessity

• Handling returns and refunds
• Resolving issues with orders or products

Where we receive general enquiries or complaints not tied to a specific order - for example, from prospective customers - we process your data on the basis of legitimate interests, specifically our interest in operating our business responsibly and maintaining customer relationships.

3.5 To send abandoned checkout reminders Legitimate interests / Soft opt-in

• If you begin a purchase but do not complete it, we may send you a single reminder email about your basket
• We only do this where you have provided your email address during checkout and we have a lawful basis to contact you under PECR
• You can opt out at any time using the unsubscribe link in the email

3.6 For marketing Consent Legitimate interests

• Email marketing via Omnisend - sent only where you have given explicit consent (opt-in). You may withdraw consent at any time by clicking "unsubscribe" in any email or contacting us.
• Meta Ads and Google Shopping - advertising campaigns directed at existing customers or similar audiences, on the basis of legitimate interests where PECR consent for cookies has been given. We conduct a Legitimate Interests Assessment for this processing and it is available on request.

3.7 To improve our website Legitimate interests

We use analytics tools including Google Analytics, Meta Pixel and Omnisend reports to understand how our website is used and improve the experience it provides. These tools only operate where you have consented to the relevant cookies via our cookie banner.

3.8 Legal or regulatory compliance Legal obligation

• Accounting and tax record-keeping
• Fraud prevention and security checks

4. Cookies & Tracking Technologies

We use cookies and similar technologies to enable site functionality, analyse performance, and, where you have consented, deliver personalised advertising.

Types of cookies we use

• Essential cookies - required for checkout and core site functionality. These do not require consent.
• Performance cookies - analytics tools such as Google Analytics. Active only with your consent.
• Marketing cookies - Meta Pixel, Google Ads and Omnisend tracking. Active only with your consent.

You can manage or withdraw cookie consent at any time via our cookie banner or your browser settings. Please note that withdrawing consent for marketing or performance cookies does not affect cookies that are strictly necessary for the site to function.

Analytics and marketing cookie data is retained in line with the default settings of each platform (typically up to 14 months for Google Analytics and in accordance with Meta's data retention policy). For full details, see our Cookie Policy.

5. Sharing Your Personal Information

We do not sell your personal data.

We share your data with trusted partners who help us operate our business. Each is either a data processor acting on our instructions, or an independent data controller with their own legal obligations.

• Shopify - website, checkout and order processing
• Omnisend - marketing emails, pop-ups and automations
• Royal Mail / DPD - shipping and delivery
• Payment processors (Stripe / Shop Pay, PayPal, Klarna, Google Pay, Apple Pay) - payment handling and fraud checks. These providers act as independent data controllers for their own fraud and compliance purposes.
• QuickBooks - accounting and tax compliance
• Meta & Google - advertising and analytics (subject to your cookie consent)
• Judge.me - product reviews and ratings

We may also share information with professional advisors (legal or financial) and with law enforcement or regulatory bodies where we are required or permitted to do so by law.

6. International Transfers

Some of our service providers - including Shopify, Omnisend, Meta and Google - store or process data outside the UK or European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, including:

• UK-approved International Data Transfer Agreements (IDTAs)
• Standard Contractual Clauses (SCCs)
• Transfers to countries with UK adequacy decisions

We have Data Processing Agreements (DPAs) in place with our key processors, which include appropriate international transfer safeguards where relevant.

7. How Long We Keep Your Information

We keep your data only for as long as necessary for the purpose it was collected, or as required by law.

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access - request a copy of the personal data we hold about you
• Right to rectification - ask us to correct inaccurate or incomplete information
• Right to erasure - request deletion of your data where there is no lawful reason to retain it
• Right to restrict processing - ask us to pause processing in certain circumstances
• Right to object - object to processing based on legitimate interests, including direct marketing
• Right to withdraw consent - where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Right to data portability - request a copy of your data in a structured, machine-readable format where processing is automated and based on consent or contract

To exercise any of these rights, email us at support@knala.co.uk. We will respond within one calendar month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

9. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or disclosure. These include encryption, secure system access controls and restricted data permissions.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and inform you directly where the risk is high.

10. Children's Data

Our website is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child under 13, please contact us at support@knala.co.uk and we will delete it promptly.

11. Links to External Websites

Our website may contain links to third-party websites. We are not responsible for their privacy practices or content, and encourage you to read their privacy policies before providing any personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page will always show when the policy was last revised. Where changes are material, we will notify you by email or by a prominent notice on our website.

13. Contact Us

If you have any questions about this policy or how we handle your personal data, please get in touch: