Kollateral

PRIVACY POLICY

Last updated: 20 August 2026

This Privacy Policy explains how [LEGAL BUSINESS NAME], trading as KOLLATERAL (“Kollateral”, “we”, “us”, “our”), collects, uses, discloses and protects personal data when you visit [STORE URL], interact with our services, subscribe to marketing communications or place an order.

Data controller: [LEGAL BUSINESS NAME]

Registered address: [REGISTERED BUSINESS ADDRESS]

VAT / tax ID: [VAT / TAX ID]

Privacy contact: [PRIVACY / SUPPORT EMAIL]

1. SCOPE

This Privacy Policy applies to the Kollateral online store, customer support, marketing communications, analytics, advertising and order fulfilment.

It does not apply to third-party websites or services that have their own privacy policies.

2. PERSONAL DATA WE COLLECT

Depending on how you interact with the store, we may collect:

A. Identity and contact data

  • name and surname;
  • email address;
  • telephone number where provided;
  • billing and delivery address;
  • country or region.

B. Order and transaction data

  • products, sizes and quantities ordered;
  • order number and order history;
  • payment status;
  • delivery and returns information;
  • refunds, disputes and customer-support history.

Kollateral does not normally receive or store full payment-card details. Payment information is processed by the payment providers available at checkout.

C. Device and usage data

  • IP address;
  • browser, device and operating-system information;
  • cookie and similar-technology identifiers;
  • pages and products viewed;
  • clicks, referring URLs and session information;
  • shopping-cart and checkout events;
  • approximate location derived from IP address;
  • consent preferences.

D. Marketing and advertising data

  • email and SMS marketing subscription status;
  • campaign engagement;
  • advertising identifiers;
  • interactions with Kollateral advertisements;
  • attribution and conversion events;
  • audience and campaign data supplied by advertising platforms.

E. Communications

  • messages sent to customer support;
  • order-related requests;
  • return or withdrawal requests;
  • information and photographs supplied in relation to an incorrect, damaged or defective product.

3. HOW WE COLLECT DATA

We collect personal data:

  • directly from you when you place an order, subscribe, contact us or submit information;
  • automatically through Shopify, cookies, pixels, analytics and similar technologies, subject to applicable consent requirements;
  • from service providers involved in payments, marketing, analytics, advertising, attribution, fraud prevention and delivery;
  • from advertising platforms where you interact with Kollateral advertisements.

4. WHY WE USE PERSONAL DATA

We use personal data for the following purposes.

A. To operate the store and perform a contract

We use data to:

  • process and confirm orders;
  • collect and reconcile payments;
  • deliver products;
  • provide order updates;
  • manage returns, withdrawals, refunds and product issues;
  • provide customer support;
  • prevent duplicate or invalid order processing.

The legal basis is performance of a contract or steps requested before entering into a contract.

B. To comply with legal obligations

We use and retain data where necessary to:

  • comply with accounting, tax and consumer-protection obligations;
  • respond to lawful requests;
  • document consent and withdrawal requests;
  • establish, exercise or defend legal claims.

The legal basis is compliance with a legal obligation.

C. For legitimate business interests

Where permitted by law, we may use data to:

  • protect the store, customers and payment systems;
  • prevent fraud, abuse and unauthorized commercial resale;
  • diagnose technical problems;
  • improve store performance and customer experience;
  • maintain accurate records;
  • measure non-marketing operational performance;
  • defend legal claims.

We balance these interests against your rights and expectations.

D. With your consent

Where consent is required, we use data for:

  • email and SMS marketing;
  • non-essential analytics;
  • personalized advertising;
  • audience creation and measurement;
  • Meta, Google and TikTok tracking;
  • server-side advertising and attribution events;
  • non-essential cookies and similar technologies.

You may withdraw consent at any time through the cookie-preference controls or by unsubscribing from marketing communications. Withdrawal does not affect processing already carried out lawfully before withdrawal.

5. SHOPIFY

The store is hosted and operated using Shopify.

Shopify processes store, device, transaction and customer data to provide ecommerce, checkout, security, fraud-prevention, order and platform services.

Shopify may act as a processor on behalf of Kollateral and, for certain platform purposes, as an independent controller as explained in Shopify’s own privacy documentation.

6. PAYMENTS

Payments may be processed by providers displayed at checkout, including:

  • Shopify Payments and its underlying payment partners;
  • PayPal;
  • other payment providers activated and displayed at checkout.

Payment providers process payment, fraud-prevention and transaction data under their own privacy terms.

Kollateral does not offer instalment-payment options unless they are expressly displayed at checkout.

7. KLAVIYO AND EMAIL / SMS MARKETING

Kollateral uses Klaviyo for email and SMS marketing, subscriber management, forms, campaign measurement and marketing automations.

Klaviyo may process:

  • email address or telephone number;
  • email and SMS subscription and consent status;
  • order and product-event data;
  • campaign engagement;
  • onsite behaviour where enabled and consented to;
  • customer-profile and segmentation data.

Marketing emails and text messages are sent only where an appropriate legal basis exists. You can unsubscribe using the link included in each marketing email or reply STOP to a marketing text message.

Transactional messages, such as order and shipping confirmations, are separate from marketing communications and may be sent where necessary to perform the contract.

8. ANALYTICS, ADVERTISING AND SERVER-SIDE TRACKING

Subject to configuration and consent requirements, Kollateral may use:

  • Meta Pixel and Meta Conversions API;
  • Google Analytics 4 and related Google advertising services;
  • TikTok Pixel and TikTok Events API;
  • WeTracked.io for server-side attribution and event delivery.

These tools may process device, browser, cookie, advertising, event, order, attribution and conversion data.

Server-side tracking does not remove applicable consent requirements. Kollateral will configure tracking so that consent choices are respected and will avoid intentionally sending duplicate events through multiple overlapping integrations.

Where a platform or integration is not activated at launch, references to it should be removed or marked as inactive before publication.

9. COOKIE AND CONSENT MANAGEMENT

Kollateral plans to use Shopify’s customer-privacy and cookie-banner controls to collect and record preferences.

Non-essential analytics and marketing technologies should remain blocked or limited until the required consent is provided.

Available choices should include:

  • accept all;
  • reject non-essential technologies;
  • manage preferences;
  • change or withdraw consent later.

More information will be provided in the Kollateral Cookie Policy at:

COOKIE POLICY

10. LOGISTICS AND DELIVERY PROVIDERS

We disclose the personal data necessary to fulfil and deliver orders to logistics, postal, fulfilment and delivery-service providers selected according to the destination.

This data may include:

  • recipient name;
  • delivery address;
  • email address or telephone number where needed for delivery updates;
  • order and parcel details;
  • customs information for international shipments.

Specific carriers may vary by destination and availability.

11. FRAUD PREVENTION AND STORE SECURITY

We may use Shopify, payment providers and other service providers to identify suspicious activity, prevent unauthorized payments, protect accounts and transactions and comply with legal requirements.

Automated indicators may be used to assess risk. A high-risk indicator does not by itself remove any mandatory consumer right.

12. WHO WE SHARE DATA WITH

We may disclose personal data to:

  • Shopify and ecommerce-platform providers;
  • payment processors;
  • Klaviyo and email or SMS marketing providers;
  • WeTracked and tracking or attribution providers;
  • Meta, Google and TikTok where enabled and lawfully configured;
  • analytics providers;
  • logistics, postal, fulfilment and delivery providers;
  • hosting, security, fraud-prevention and technical-support providers;
  • professional advisers, accountants and legal advisers;
  • public authorities where required by law;
  • a buyer or successor in connection with a genuine corporate transaction.

We do not sell personal data for money.

Certain advertising disclosures may be treated as “sharing”, “sale” or targeted advertising under some non-EU privacy laws. Where applicable, relevant choices will be made available.

13. INTERNATIONAL DATA TRANSFERS

Some providers may process personal data outside the European Economic Area, including in the United States or other countries.

Where required, transfers will rely on an approved legal mechanism, such as:

  • an adequacy decision;
  • the European Commission’s Standard Contractual Clauses;
  • supplementary safeguards;
  • another lawful transfer mechanism.

The specific safeguards depend on the provider and service configuration.

14. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including legal, tax, accounting, fraud-prevention, warranty and dispute-resolution requirements.

Indicative retention periods are:

  • order, invoice and accounting data: for the period required by applicable tax and accounting law;
  • customer-support and dispute records: for the time needed to resolve the request and protect legal rights;
  • marketing subscription data: until consent is withdrawn or the data is no longer needed, while retaining a suppression record where necessary to honour an opt-out;
  • cookie and consent records: for the period required to demonstrate and manage consent;
  • analytics and advertising data: according to the retention settings configured in the relevant platform.

Final retention periods must be reviewed when the store configuration and legal entity details are confirmed.

15. CUSTOMER ACCOUNTS

Kollateral does not currently plan to offer customer login accounts.

If customer accounts are activated later, this Policy must be updated before or at the time of activation.

16. CONTACT FORMS AND CUSTOMER SUPPORT

Kollateral may initially provide customer support through a published email address rather than a website contact form.

If a contact form is introduced, the store will process the information submitted through the form only to respond to the request, manage an order or address another customer-service matter.

17. YOUR RIGHTS

Subject to applicable law, you may have the right to:

  • obtain confirmation of whether we process your personal data;
  • access your personal data;
  • correct inaccurate or incomplete data;
  • request deletion;
  • restrict processing;
  • object to processing based on legitimate interests;
  • withdraw consent;
  • receive certain data in a portable format;
  • lodge a complaint with a competent supervisory authority;
  • obtain information about international-transfer safeguards;
  • request human review where a decision producing significant legal effects is based solely on automated processing.

These rights may be subject to legal conditions and exceptions.

18. HOW TO EXERCISE YOUR RIGHTS

To exercise a privacy right, contact:

[PRIVACY / SUPPORT EMAIL]

We may request information reasonably necessary to verify identity and protect personal data.

We will respond within the period required by applicable law.

19. MARKETING CHOICES

You may unsubscribe from email marketing using the link in each marketing email and opt out of SMS marketing by replying STOP to a marketing text message.

You may also contact [PRIVACY / SUPPORT EMAIL] or update your preferences where an applicable preference centre is available.

Unsubscribing from marketing does not stop necessary transactional communications about an existing order.

20. CHILDREN

The store is not directed to children.

We do not knowingly collect personal data from children below the age at which they can lawfully provide consent for the relevant processing.

If you believe a child has provided personal data unlawfully, contact [PRIVACY / SUPPORT EMAIL].

21. SECURITY

We use reasonable technical and organizational measures appropriate to the nature of the data and risks involved.

No method of transmission or storage is completely secure. Customers should protect access to their email account and payment method and should contact us if they suspect unauthorized use connected with an order.

22. THIRD-PARTY LINKS

The store may contain links to third-party websites, social platforms or services.

Their privacy practices are governed by their own policies. Kollateral is not responsible for third-party privacy practices.

23. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect legal, operational or technical changes.

The current version and last-updated date will be published on this page.

Material changes will be communicated where required by law.

24. SUPERVISORY AUTHORITY

You may lodge a complaint with the data-protection supervisory authority in your country of residence, work or the place of the alleged infringement.

For a controller established in Italy, the relevant authority is generally the Garante per la protezione dei dati personali.

25. CONTACT

KOLLATERAL

Legal business name: [LEGAL BUSINESS NAME]

Registered address: [REGISTERED BUSINESS ADDRESS]

VAT / tax ID: [VAT / TAX ID]

Privacy email: [PRIVACY / SUPPORT EMAIL]

Store URL: [STORE URL]