Privacy Policy

Website kumplo.com. Last updated: 28.10.2026.

This policy explains what personal data we collect on the kumplo.com website, why, who we share it with, how long we keep it and what rights you have.

The controller is a UK company, so we apply the law of the United Kingdom: the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). For people in the European Union we also apply Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

Where this policy refers to an article of the GDPR, in the United Kingdom the corresponding provision of the UK GDPR or the Data Protection Act 2018 applies.

1. Data controller

The controller of your personal data is Aggressive Marketing Ltd, a company registered in England and Wales under number 13010433, with its registered office at 60 White Horse Lane, Boston, PE21 8SZ, United Kingdom (“we”, “us” or the “Controller”).

The Controller operates the websites wypromowani.pl and kumplo.com (details in section 18).

For personal data matters, write to [email protected] or use the contact form: https://kumplo.com/contact-us/.

We have not appointed a data protection officer.

We have not appointed a representative in the European Union within the meaning of Article 27 GDPR. People in the European Union can contact us directly, at the email address and through the form given above.

2. What data we collect

2.1. Data you provide

Email address. You give it when you place an order, and if there is no account for that address yet, we create one automatically.

First name and surname or company name, address, tax identification number or VAT number, if you buy as a business or ask for a sales document with these details.

Telephone number, if you provide it.

The link to or name of the social media account to which the ordered service relates, and the service parameters (for example the number of followers). For the comments service, also the text of the comments you enter. We never ask for the password to your social media account and we do not need it.

The content of tickets, complaints and messages you send through the ticket system in your customer account, the contact form or by email, together with the address you write from.

2.2. Data from signing in with Google, Facebook or Apple

If you sign in with Google, Facebook or Apple, we receive from that company the data described in section 6: the account identifier, email address, first name or profile name and, from Google and Facebook, also your profile picture.

2.3. Technical data and data about your use of the website

When you use the website, we record technical data: IP address, the country determined by our traffic protection provider (Cloudflare), information sent by your browser (browser type and version, operating system, device type), and the session and cart identifier. When you place an order, we also record the set of device data described in section 7. Visit statistics are described in section 8.

2.4. Transaction data

Order history: date, services, amount, currency, delivery status and payment method. Sales document data. From the payment operator we receive the transaction identifier and status and, for cryptocurrency payments, the wallet address from which the payment came and the transaction identifier on the blockchain network. We have no access to your card details, BLIK codes, online banking login details or wallet keys.

2.5. Data of people who are not our customers

An order may relate to a social media account that belongs to someone other than the person placing the order. If your account has been indicated in an order, we process its public name, the link to it or to the post, and the public account and post data described in point 4.4. We receive these data from the person placing the order or from information publicly available on the social media platform. We use them only to carry out and settle the order, on the basis of our legitimate interest (Article 6(1)(f) GDPR). You can contact us and exercise the rights described in section 14, including the right to object.

2.6. Free samples

If you receive a free sample of a service on the kumplo.com website, or buy the paid package for new customers instead, you must confirm your email address with a one-time code from a message or by signing in with Google, Apple or Facebook. If there is no account for that address yet, we create one automatically. In the samples register we record:

  • the account email address, including in a normalised form for comparisons (lower case, for Gmail without dots and without additions after the “+” sign),
  • the name of the Instagram account to which the post belongs (the post link itself is recorded in the order, as for any service),
  • a random device identifier from the cleafs_did cookie (valid for 400 days) and the IP address,
  • the method used to confirm the address (email code, Google, Apple or Facebook),
  • the date, the choice made (sample or paid package), the outcome (issued, or refused with the reason), the order number, the number of likes on the post before delivery, the time delivery was completed and the discount code issued,
  • the steps taken on the sample page (visit, click, confirmation, order) with the session identifier from the cleafs_probki_s cookie (valid for 24 hours).

Purposes and legal bases:

  • issuing the sample or package and checking whether you are entitled to it (whether you are a new customer and have not already received a sample of that type): Article 6(1)(b) GDPR, performance of a contract,
  • protection against abuse (one sample per person, a limit per IP address, detecting multiple accounts on one device or Instagram account, blocks): Article 6(1)(f) GDPR, our legitimate interest,
  • programme statistics (how many samples we have issued, how many people bought something later): Article 6(1)(f) GDPR, our legitimate interest,
  • emails with offers and discount codes: Article 6(1)(a) GDPR, your consent.

Marketing consent with a sample. We issue free samples to people who agree to receive emails with offers and discount codes and confirm that they are at least 16 years old. Anyone who does not wish to give consent can buy the same service at the normal price, and the paid package for new customers does not require consent. We keep evidence of consent: its wording and version, the time, the confirmed email address, the source (the sample page) and the IP address. Your address has already been confirmed with a code or by signing in, so we do not send a separate confirmation link for a sample. You can withdraw your consent at any time using the “unsubscribe” link in every message. Withdrawing consent does not take away a sample already ordered or delivered.

Recipients. To check whether the email address and the Instagram account have made purchases before and have not already received a sample, we pass the normalised email address, the Instagram account name, the post link and the IP address to the order fulfilment panel (point 4.2). The panel compares them with the orders of all shops it serves, including shops run by other companies. The panel obtains public post and account data from an external provider of data on public Instagram profiles (point 4.4).

Retention period. We keep the entries in the samples register for as long as the free samples programme runs, because without them the one-sample-per-person rule cannot be checked. When the programme ends, we delete or anonymise them. We keep the sample order in the same way as other orders (section 13). We keep evidence of marketing consent even after it has been withdrawn, until the limitation period for claims expires, so that we can show that consent was given.

2.7. Do you have to provide data

Providing an email address is necessary to place an order, and a link or account name is necessary to carry it out. You provide the details for the sales document if you want to receive a document with those details. All other data are provided voluntarily.

We do not collect special categories of data (for example data about health, beliefs or membership).

Carrying out orders, maintaining your account, signing in: Article 6(1)(b) GDPR (performance of a contract).

Issuing and keeping sales documents, tax settlements: Article 6(1)(c) GDPR (legal obligation).

Handling tickets, complaints and contact: Article 6(1)(b) GDPR and, where the ticket does not relate to a contract, Article 6(1)(f) GDPR (our legitimate interest in replying to the message).

Website security, protection against fraud and abuse, including device data (section 7) and the block list (point 4.10): Article 6(1)(f) GDPR (our legitimate interest in protection against losses and attacks).

Establishing and defending claims: Article 6(1)(f) GDPR.

Visit statistics (points 8.1 and 8.2): Article 6(1)(a) GDPR (your consent given in the cookie banner).

Page speed measurement (point 8.3): Article 6(1)(f) GDPR (our legitimate interest in improving the website). You can object (section 14).

Cloudflare Web Analytics statistics (point 8.4): Article 6(1)(f) GDPR (our legitimate interest in visit statistics and in the security of the website). You can object (section 14).

Reminder about an unpaid order: Article 6(1)(b) GDPR (completing a contract you have started to conclude).

Marketing emails: Article 6(1)(a) GDPR (your consent).

4. Who we share data with

We share data only to the extent needed for the purpose concerned. We do not sell personal data and do not make it available to other companies for their own advertising.

4.1. Server and traffic protection

OVH (the OVHcloud group) provides the dedicated server on which the website, its database and the order fulfilment panel run. The server is located in a data centre in Warsaw (Poland).

The Controller concluded the contract for this server with OVH Limited (London, United Kingdom), a company of the OVHcloud group. We keep database backups on this server and on the Controller’s own device in the United Kingdom.

Cloudflare, Inc. (USA) handles traffic to the website: it speeds up loading and protects against attacks and bots. On every visit, Cloudflare sees the IP address, the request headers and the country you are connecting from.

4.2. Order fulfilment and ticket handling panel

We handle orders and tickets in the Cleafs panel, which is operated by Cleafs Technologies L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates (licence no. 2530208.01, Meydan Free Zone Authority). The panel runs on the server described in point 4.1, and Cleafs Technologies has access to it from the UAE. The panel receives: your email address, first name and surname, telephone number and billing address if you have provided them, the order number and content, the link or account name, the payment amount and status, the content of tickets and data reported to the block list. The transfer of data to the UAE is described in section 5.

4.3. Providers who carry out the service

The ordered service is carried out by external providers of services on social media platforms. We pass on to them only what is needed to carry it out: the link or account name, the type of service and the quantity and, for the comments service, the text of the comments. We do not pass on your email address, name, IP address or payment data. We use several such providers, and their list changes depending on the availability of services. Most of them do not publicly state the name of the company or the country of establishment, so we treat the transfer of data to these providers as a transfer outside the United Kingdom and the EEA (section 5). We will give you the current list of providers on request (section 20).

4.4. Data of public Instagram accounts and posts

HikerAPI (hikerapi.com) is an external provider of data on public Instagram accounts and posts. The panel referred to in point 4.2 obtains from it the public data of the account or post that you indicate in the order, on the account preview card or in the free sample form: the post image, the profile picture and account name, the name of the post owner’s account, the number of likes and whether the account is public. These data are used to show the preview, to check whether the order can be carried out and to read the counts before and during delivery. HikerAPI receives only the address of the public post or the name of the public account. We do not pass on your email address, IP address or any other data from your account. HikerAPI does not publicly state the name of the company or the country of establishment, so we treat the transfer of data to it as a transfer outside the United Kingdom and the EEA (section 5).

4.5. Payments

Payment is handled by the operator of the method you choose at checkout. We redirect you to its page or payment window, and the operator processes card, BLIK and online banking login data on its own servers. From the operator we receive only confirmation of the transaction (status, amount, identifier and, for cards, possibly the card type and last digits).

If you pay by card, Apple Pay, Pay by Bank, iDEAL, Bancontact or another method handled by Mollie, the data are processed by Mollie B.V., Amsterdam, the Netherlands.

If you pay by cryptocurrency, the payment is handled by the BoxCoin software running on our server, without an external operator. A transaction on the blockchain network is public by nature: the wallet address, amount and time are visible to everyone. We check receipt of the payment in public blockchain explorers.

If you pay by ordinary bank transfer, we see the transfer details (sender, account number, reference), and the transfer goes through the bank that holds our account.

4.6. Email

Messages from the website (login codes, order confirmations, sales documents, replies to tickets) are sent through Mailgun Technologies, Inc. (Sinch group, USA) from servers in the European Union region. The website keeps copies of sent messages in the sending log for no automatic deletion; we delete individual entries at your request (section 14), so that we can check whether a message went out.

4.7. Signing in with Google, Facebook and Apple

If you choose this sign-in method: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) or Apple Distribution International Limited (Ireland). Details in section 6.

4.8. Statistics

Google Ireland Limited and Google LLC (USA) provide the Google Analytics 4 service (section 8).

Cloudflare, Inc. (USA, point 4.1) provides the Cloudflare Web Analytics service (point 8.4).

4.9. Accounting and advisers

Accounting firm: J&K Accounts Ltd (Company Number SC560383, United Kingdom). It receives data from sales documents (customer details, amounts, dates). In the event of a dispute, data may be received by our legal advisers and, in the event of an inspection, by auditors.

4.10. Block list

To protect ourselves against fraud, especially orders paid for with stolen cards and unfounded chargebacks, we use a block list kept in the panel referred to in point 4.2. A person is added to the list if their order ended in a chargeback or if our support team blocked them for abuse. The list contains data that make it possible to recognise that person at the next purchase attempt: email address (including in normalised form), account identifier, first name and surname, address, IP address (checked for 90 days), device identifier, payment card characteristics provided by the payment operator (without the full number) and the link to or name of the social media account.

The list is shared by the shops served by the panel, including shops of other controllers. Today this is the liikye.com website, which is run by LEAD PROVIDER LTD (United Kingdom). Data of people blocked on the wypromowani.pl and kumplo.com websites are added to the list available on that website, and data of people blocked on it reach us. The legal basis is our legitimate interest and the legitimate interest of that controller in preventing fraud (Article 6(1)(f) GDPR). The scope of the data shared, the purpose, the retention period and the way your requests are handled are set out in a data sharing agreement concluded between Aggressive Marketing Ltd and LEAD PROVIDER LTD.

If you think you have been added to the list without reason, write to us (section 20). A person will review it.

4.11. Public authorities

We pass data to state authorities (courts, police, prosecutors, tax authorities) only where the law requires it.

5. Transfers of data outside the United Kingdom and the EEA

The Controller is established in the United Kingdom. The European Commission has decided that the United Kingdom ensures an adequate level of data protection, so transferring the data of customers from the European Union to the Controller does not require additional safeguards. The server holding the data is located in Poland, and the United Kingdom recognises the EEA states as ensuring adequate protection.

Data are transferred outside the United Kingdom and the EEA in the following cases:

United Arab Emirates, Cleafs Technologies L.L.C-FZ (point 4.2). Neither the European Commission nor the UK government has recognised the UAE as a country ensuring an adequate level of data protection. Safeguard for this transfer: standard contractual clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914, module 2: transfer from controller to processor) together with the UK International Data Transfer Addendum issued by the UK data protection authority, concluded by us with Cleafs Technologies L.L.C-FZ.

USA: Cloudflare, Inc. (point 4.1), Mailgun Technologies, Inc. (point 4.6) and Google LLC (point 4.8). These companies are certified under the EU-US Data Privacy Framework and its UK Extension, on which the transfer is based. When you sign in with Google, Facebook or Apple, we pass data to those companies’ entities in Ireland (point 4.7); any further transfer to companies in the USA takes place under the rules of their own privacy policies.

The service providers referred to in point 4.3 and the data provider referred to in point 4.4, if they are established outside the United Kingdom and the EEA. We pass on to them only the link or account name and the service parameters, because the order cannot be carried out without them. Basis for the transfer: it is necessary for the performance of the contract concluded with you (Article 49(1)(b) GDPR and Article 49(1)(b) UK GDPR). We do not have standard contractual clauses with these providers, so we pass on to them only the data without which the order cannot be carried out.

You can ask for information about the safeguards and for a copy of the clauses (section 20).

6. Sign-in methods

The website lets you create an account and sign in in six ways.

6.1. One-time code (PIN) by email

You enter your email address and we send a one-time code to it. The message is sent through Mailgun (point 4.6).

6.2. Password

Classic sign-in with email address and password. We store the password only as a one-way hash (bcrypt), not in plain text.

6.3. Facebook

Operator: Meta Platforms Ireland Limited. On your first sign-in we receive from Facebook: your first name, public name, profile picture, Facebook identifier and the email address assigned to the account. We use them only to create your account or match it to an existing account with the same email address, for subsequent sign-ins and to show your name and picture in your account. We do not post anything on your behalf, we do not read your friends list or posts, and we do not use data from Facebook for advertising. How to disconnect your Facebook account and delete the data: https://kumplo.com/delete-facebook-data/.

6.4. Google

Operator: Google Ireland Limited. Sign-in through Google Identity Services (OAuth 2.0). We receive: email address, first name and public name, Google identifier and profile picture. We use them in the same way as the data from Facebook.

6.5. Apple

Operator: Apple Distribution International Limited (Ireland). We receive your Apple account identifier, email address (if you choose “Hide My Email”, this is an Apple relay address that forwards messages to your mailbox) and your first name and surname, if you share them on your first sign-in. We use them only to create or match your account and for subsequent sign-ins. We do not receive your Apple account password.

6.6. Passkey

Sign-in with a cryptographic key stored on your device (for example Face ID, Touch ID or a hardware security key). We store only the public part of the key. The private part never leaves your device, and biometric data stay on the device and do not reach us.

7. Device technical data and protection against abuse

When you place an order, we record a set of technical data about your device and browser. They are used to detect payment fraud, bots and the creation of multiple accounts by one person. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in protection against fraud).

We record:

  • the device type, model and manufacturer (if the browser provides them), the operating system and its version, the processor architecture and number of cores, the graphics card identifier and the amount of memory reported by the browser,
  • the browser name and version, the User-Agent header, the screen resolution and colour depth, the window size and browser automation signals,
  • the time zone, system and browser language, the country determined by Cloudflare and the full IP address,
  • campaign parameters (UTM), the page you came from and the time from arrival to the order,
  • detected inconsistencies, for example a time zone that does not match the country of the IP address.

We do not collect biometric data, screen recordings or the content typed into other forms. We do not use these data for advertising and do not pass them on to other companies. We keep them together with the order for as long as the data of the order for which they were collected (with no separate deletion date; at your request we delete them earlier if we do not need them to defend against fraud or a claim).

Account event log. When you sign in (including failed attempts), create an account, request a code, sign out, change your sign-in details, place an order or pay for an order, we record in a log the event with its date, the sign-in method, the account e-mail address or the one entered, the IP address, the network and network operator determined from the IP address, the approximate location (country, region, city, postcode and time zone passed on by Cloudflare, where it provides them), device and browser data (User-Agent, languages, device model and system version, where the browser provides them), the visit identifiers from our statistics (point 8.2) if you have consented, and a random browser identifier from the cookie cleafs_did (valid for 400 days). The log serves the security of accounts and of the website: detecting account takeovers, attempts to get around blocks and other abuse, and clarifying disputed events. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in protecting accounts and the website against abuse). The entries are visible to our support staff in the panel described in point 4.2, which retrieves them from the website on request. When our staff view your account in preview mode in order to help you, we do not record this in your log; only a note on the order remains. We do not clear the log automatically (retention: section 13).

8. Visit statistics and page speed measurement

8.1. Google Analytics 4

We use Google Analytics 4 to know how many visitors we have, where they come from and which pages they view. We load the script from our own server. It stores a random browser identifier in browser storage (localStorage) and session data in session storage (sessionStorage), and sends visit data to Google. We do not pass your email address, name or order number to Google.

We load the script only after your consent given in the cookie banner (the “Accept” button or switching on statistics in the settings window). With no decision, and after you select “Reject”, the script is not loaded. You can change or withdraw your consent at any time in the cookie settings (the “Cookie settings” link in the page footer); after you withdraw it, we delete the identifier from your browser and do not load the script. Legal basis: Article 6(1)(a) GDPR, your consent.

8.2. Our own visit statistics

Our server records the course of a visit: the pages visited, time on the page, scroll depth, clicks, page errors, discount codes used and, at checkout, the fact that a field has been filled in, without its content. In addition: the source of the visit (UTM parameters, Google, Facebook and Microsoft ad click identifiers, the page you came from), the device type and the country. We recognise a visit by the cookies cleafs_vid (up to 400 days), cleafs_sid (30 minutes) and cleafs_ft. If you place an order or are signed in, we link the visit to the order and the account so that we know which pages and campaigns lead to sales. We record the IP address only as a hash. These data are not passed on to other companies. We keep detailed data for 90 days and aggregated summaries for 36 months. These statistics run only after your consent to statistics given in the cookie banner; without consent the cookies cleafs_vid, cleafs_sid and cleafs_ft are not stored, and after you withdraw it we delete them from your browser. Legal basis: Article 6(1)(a) GDPR, your consent. We also use data about the visit preceding an order to protect against fraud and abuse (Article 6(1)(f) GDPR).

8.3. Page speed measurement

For visitors who are not signed in, we measure how quickly the page loads (loading time, layout shifts, response time to a click). We record the page address, the measurement results, the window width, the device and connection type and the country. The measurement does not use cookies, does not record the IP address or any identifier and does not allow a specific person to be identified. The data stay on our server.

8.4. Cloudflare Web Analytics

The pages of the website also use Cloudflare Web Analytics, visit and page speed statistics provided by Cloudflare, Inc. (point 4.1). Cloudflare itself adds the script of this service to the pages, for every visitor. The script sends Cloudflare the address of the page you are viewing, the address of the page you came from and the page loading times, and Cloudflare adds the country, device type, browser and operating system. We only see aggregated reports: the number of visits and page views, the pages viewed, the sources of visits and the loading speed. The script stores nothing in your browser (it sets no cookies and uses no browser storage). According to Cloudflare, the service does not collect visitors’ personal data, does not identify them by IP address or browser characteristics and does not track them across websites. The measurement runs without consent, regardless of your choice in the cookie banner, including after you choose “Reject”. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in visit statistics and in the security of the website. You can object (section 14); as the measurement does not identify individuals, the simplest way is to block the address static.cloudflareinsights.com in your browser, and the website will work normally.

9. Cookies

The website uses cookies and similar technologies (browser storage): those necessary for the shop to work (session, cart, sign-in, Cloudflare bot protection), those that remember settings (language, currency) and statistical ones (section 8). The full list, the storage periods and how to change your settings are described in the Cookie Policy: https://kumplo.com/cookie-policy/.

10. Features available on some websites

10.1. Cleafs Wallet wallet and loyalty programme

If you use the Cleafs Wallet wallet and loyalty programme (availability depends on the website), we process the wallet balance, payments into it, points for purchases, badges and ranks, missions completed and rewards received, gift cards and referrals. Your rank does not affect prices or the availability of services. Points give only a discount on your next purchase and a customer status label. Legal basis: Article 6(1)(b) GDPR (programme contract).

10.2. Newsletter

If you sign up for the newsletter (when placing an order, when receiving a free sample or in a form on the website), we send it only with your consent. After you sign up through the form or when placing an order, we send a message with a confirmation link and do not start sending until you click it. With a free sample, your address has already been confirmed with a code or by signing in, so we do not send a separate link. Every message contains an “unsubscribe” link, which stops the newsletter immediately. Messages are sent through Mailgun (point 4.6).

10.3. Reviews

If you leave a review of a service, we record its content, the rating, the signature you give, the date and the related order. We publish the review with the signature on the website. After an order, we may email you a request for a review with a link that signs you in to the review form. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in collecting customer reviews) and, for publication, Article 6(1)(b) GDPR (the review rules in the terms).

10.4. Partner programme

If you take part in the partner programme, we process the partner account data, payout details, your referral link and the number and value of orders placed through your referral. For a person who arrives through a partner link, we store in the browser for 30 days the cookies affwp_ref (partner identifier), affwp_ref_visit_id (visit number) and affwp_campaign (campaign name, if the link contains one), in order to credit the commission to the partner. We record the entry from the link together with the IP address. In their panel the partner sees the date of the entry, the address of the page to which the link led and the page from which the referred person came and, for orders from a referral, the order number, description, commission amount and its status. They do not see the first name, email address or IP address of the people they referred. Legal basis: Article 6(1)(b) GDPR (partner programme contract) and, for the referred customer, Article 6(1)(f) GDPR.

If you arrive at the website through a link with a discount code, we store that code in your browser (the cookie cleafs_coupon, 7 days) so that the discount is applied once you add a service to the cart. If the link or an advertising page indicates a campaign, we also store its name (the cookie cleafs_landing, 30 days) and attach it to the order so that the order can be attributed to the campaign. Legal basis: Article 6(1)(b) GDPR for applying the discount code you ask for, and Article 6(1)(f) GDPR for attributing orders to campaigns (our legitimate interest in assessing which campaigns lead to sales).

11. Contact form and tickets

Messages from the contact form and tickets from the customer account go to the panel referred to in point 4.2, where our support team answers them. We send replies by email.

12. Profiling and automated decisions

To a limited extent we assess data automatically:

  • we award loyalty programme points and ranks on the basis of total purchases (if you use the programme),
  • we compare the order and device data with the block list (point 4.10) and fraud risk signals; if there is a match, the system may restrict the available payment methods or put the order or sign-in on hold.

Entries on the block list are made by a person. The exception: when the payment operator Mollie reports a chargeback, the system creates a block itself, which restricts only the payment methods (without blocking the account). If such a restriction affects you, you can write to us, present your point of view and ask for the matter to be assessed by a person. We do not profile customers for advertising and do not vary prices on the basis of profiling.

13. How long we keep data

Customer account and order history: until the account is deleted at your request. We do not delete inactive accounts automatically.

Sales documents and accounting data: 10 years from the end of the year in which the sale took place for sales to consumers in the EU accounted for under the VAT OSS scheme, and 6 years in all other cases (UK VAT rules).

Tickets, complaints and correspondence: for as long as the account is kept, with no automatic deletion; at your request we delete them earlier, unless we need them to establish or defend claims.

Log of sent emails: no automatic deletion; we delete individual entries at your request (section 14).

Device technical data from the order (section 7): as long as the data of the order for which they were collected (with no separate deletion date; at your request we delete them earlier if we do not need them to defend against fraud or a claim).

Account event log (section 7): not deleted automatically; we delete entries together with the account or on your request, and entries of an account under an active block remain for the duration of the block.

VAT number check log: we anonymise the IP address after 30 days and delete the entry after 24 months.

Our own visit statistics (point 8.2): detailed data 90 days, aggregated summaries 36 months.

Block list: for the duration of the block, and the IP address for 90 days from being recorded.

Data from signing in with Google, Facebook or Apple: until that method is disconnected or the account is deleted.

Newsletter and other consents: until consent is withdrawn, and evidence of consent until the limitation period for claims expires.

Data needed to establish or defend claims: until the limitation period expires.

After these periods we delete or anonymise the data, that is we remove the features that make it possible to identify a person.

14. Your rights

You have the right to:

  • access your data and receive a copy of it,
  • have inaccurate or outdated data rectified,
  • have your data erased; some data, for example sales documents, cannot be erased before the end of the period required by law,
  • restrict processing,
  • receive the data you have provided to us in a machine-readable format (data portability),
  • object to processing based on our legitimate interest, including statistics and profiling, and at any time to direct marketing,
  • withdraw your consent at any time; withdrawal does not affect the lawfulness of processing before withdrawal.

Send your request to [email protected]. We reply without undue delay and in any event within one month of receiving the request. For complex or numerous requests, this period may be extended by a further two months; we will inform you of this within the first month. We may ask you to confirm your identity if we have reasonable doubts about who is making the request.

15. Complaints

You can first make a complaint about your data to us: by email to [email protected] or through the contact form https://kumplo.com/contact-us/. We will acknowledge receipt of the complaint within 30 days, deal with it without undue delay and inform you of the outcome.

You also have the right to lodge a complaint with a supervisory authority:

  • in the United Kingdom: the Information Commission (formerly the Information Commissioner’s Office, ICO), ico.org.uk,
  • in the European Union: the data protection authority of the state in which you have your habitual residence or place of work or in which the infringement took place (list of authorities: edpb.europa.eu).

16. Deleting your account and data

To delete your account and data, write to [email protected] with the subject “Data deletion request”. You can disconnect sign-in with Facebook, Google or Apple in your account settings. Instructions for deleting data received from Facebook: https://kumplo.com/delete-facebook-data/. We carry out the request without undue delay and in any event within one month. Data we are required to keep (sales documents, data needed to defend claims, a block list entry) are kept only to that extent and until the end of the period in section 13.

17. Data security

We use technical and organisational measures appropriate to the risk:

  • an encrypted connection (HTTPS) on the website and in the panel,
  • passwords stored only as a one-way hash,
  • protection against attacks and bots (Cloudflare, limits on the number of attempts),
  • database backups several times a day,
  • access to data only for the people and providers who need it,
  • monitoring of unusual events (sign-in attempts, unusual traffic),
  • updates to the server software, the shop and plugins.

If a personal data breach occurs, we will report it to the competent supervisory authority within 72 hours of becoming aware of it, unless the breach poses no risk to individuals, and we will notify the people facing a high risk.

The Controller operates the websites wypromowani.pl (Poland) and kumplo.com (other countries). Accounts on these websites are separate, but orders from both websites are handled in the same panel (point 4.2), so if you have an account on both, we may link your orders by email address, for example when checking your entitlement to a free sample or when protecting against fraud.

19. Changes to this policy

We change this policy when the law, our services or our providers change. We will inform people with an account of material changes by email and by a notice on the website. The date of the last update is always at the beginning of the policy. The rules for using the website are set out in the terms and conditions: https://kumplo.com/terms-and-conditions/.

20. Contact

For personal data matters: email [email protected], contact form https://kumplo.com/contact-us/, postal address: Aggressive Marketing Ltd, 60 White Horse Lane, Boston, PE21 8SZ, United Kingdom.

We use cookies

This website uses cookies to make sure it works properly and to analyse traffic. You can change your at any time. Read more in our Privacy Policy.