Privacy Policy

Kingdom of Wow — KOW Lifestyle Europe B.V.

Last updated: 8 September 2026

Introduction

KOW Lifestyle Europe B.V. (“Kingdom of Wow,” “we,” “us” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you visit our website kingdomofwow.com (the “Site”) or purchase goods from us.

We are the data controller responsible for your personal data. Our contact details are set out in Section 1 (Identity of the Data Controller) and Section 14 (Contact Us) below.

We will notify you of any material changes to this Privacy Policy by posting a prominent notice on the Site before the change takes effect, and by email where we consider it appropriate. Where a change affects which cookies or tracking technologies are used, our Cookie Policy explains how your consent is refreshed. We encourage you to review this Policy periodically.

Please read this Privacy Policy carefully. If you do not agree with its terms, please discontinue use of the Site.

1. Identity of the Data Controller

The data controller responsible for your personal data is:

Legal name: KOW Lifestyle Europe B.V.

Address: Althof 27, 5831 DZ Boxmeer, The Netherlands

Email: hello@kingdomofwow.com

KvK (Chamber of Commerce): 69408300

For questions, requests or concerns relating to your personal data, please contact us at hello@kingdomofwow.com.

2. Information We Collect

2.1 Information you provide directly

We collect personal data you provide when you:

  • Create an account or place an order (name, email address, postal address, telephone number, payment information)
  • Contact us by email or through our contact form (name, email address, message content)
  • Subscribe to our newsletter (email address, name)
  • Submit a product review or other user content (name, content submitted)
  • Request a shipping quotation for non-standard destinations (name, email address, delivery address)

You may place an order as a guest, without creating an account. Where you do, we collect and retain the order data described above and make it retrievable without an account login so that you can manage your order and exercise your statutory rights, including your right of withdrawal. We process this guest-checkout data on the same legal bases set out in Section 3 and retain it in accordance with Section 7.

2.2 Information collected automatically

When you visit the Site, we automatically collect certain information about your device and browsing behaviour, including:

  • IP address, browser type, operating system and device identifiers
  • Pages visited, time spent on pages, referring URLs and clickstream data
  • Cookie identifiers and similar tracking technologies, see our Cookie Policy.

2.3 Information from third parties

We may receive information about you from third-party sources including:

  • Payment providers (transaction confirmation, fraud screening results)
  • Shipping and logistics partners (delivery status, address verification)
  • Analytics providers (aggregated and pseudonymized browsing data)
  • Social media platforms, if you interact with our social media content

2.4 Special categories of personal data

We do not intentionally collect special categories of personal data (such as data concerning health, biometric data, racial or ethnic origin, or similar sensitive categories as defined in Article 9 GDPR). If you voluntarily provide such data in a free-text field, we will treat it with the additional protections required by Article 9 GDPR and will not process it beyond what is strictly necessary to respond to your communication.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 of the General Data Protection Regulation (GDPR):

  • Performance of a contract (Art. 6(1)(b) GDPR): Processing your order, managing delivery, processing returns and refunds, managing your customer account, and responding to order-related queries.
  • Legal obligation (Art. 6(1)(c) GDPR): Retaining financial and transaction records to comply with Dutch and EU tax and accounting law (minimum 7 years under Art. 52 Algemene wet inzake rijksbelastingen); fraud prevention obligations; product safety incident reporting under Regulation (EU) 2023/988 (GPSR).
  • Legitimate interests (Art. 6(1)(f) GDPR): Website analytics to improve the Site's performance and user experience; fraud prevention and security monitoring; maintaining suppression lists to honour unsubscribe requests. Our legitimate interests in these activities do not override your fundamental rights and freedoms.
  • Consent (Art. 6(1)(a) GDPR): Sending marketing communications by email (newsletter); deploying non-essential cookies and tracking technologies. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. How We Use Your Information

We use the information we collect for the following purposes:

  • To process and fulfil your orders, including payment processing, shipping, returns and refunds
  • To manage your customer account
  • To communicate with you about your order, including order confirmation, dispatch notifications and delivery updates
  • To respond to your enquiries and provide customer support
  • To send you marketing communications, where you have consented to receive them
  • To improve the Site, our products and our services through analytics and user feedback
  • To detect, prevent and investigate fraud, security incidents and other harmful activity
  • To comply with our legal and regulatory obligations
  • To exercise or defend legal claims

5. Disclosure of Your Information

5.1 Service providers and data processors

We share your personal data with trusted third-party service providers who process data on our behalf. These include:

  • Shopify Payments (to process card payments securely; operated by Shopify Inc. and using Stripe Inc. as a sub-processor)
  • Shipping and logistics providers (to deliver your order)
  • Shopify Inc. (our ecommerce platform provider)
  • Email marketing platform MailerLite (to send newsletters and transactional emails, and to track on-site behaviour to inform email marketing and reporting)
  • Cookiebot (Usercentrics A/S) (to record and manage your cookie consent choices)
  • Analytics providers, including Google Analytics and Ahrefs (to analyse Site usage)
  • Customer support tools

All service providers are bound by data processing agreements and are permitted to use your personal data only to provide the services we have contracted them to perform.

5.2 Affiliates and group companies

We may share your information with companies within the KOW group, including KOW Lifestyle Manufacturing Co. Ltd (Cambodia), where necessary for the purposes described in this Policy. All group companies are bound by equivalent data protection obligations.

5.3 Business transfers

If Kingdom of Wow is involved in a merger, acquisition, reorganisation or sale of assets, your personal data may be transferred as part of that transaction. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.

5.4 Legal requirements

We may disclose your personal data where required by applicable law, court order, regulatory authority or governmental request, or where necessary to protect the rights, property or safety of Kingdom of Wow, our customers, or others.

5.5 With your consent

We will share your personal data with any other third party only where you have given your explicit consent to do so.

5.6 Independent controllers (PayPal)

Where you choose to pay using PayPal at checkout, your payment is handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., a company based in Luxembourg. PayPal acts as an independent data controller in respect of the personal data it processes to provide its payment services — it determines its own purposes and means of processing, and is not acting as our processor. PayPal's processing of your personal data, including any international transfers PayPal makes to its group companies or service providers outside the EEA, is governed by PayPal's own privacy statement and its own safeguards (Binding Corporate Rules and Standard Contractual Clauses). We encourage you to read PayPal's privacy statement.

6. International Transfers of Personal Data

Some of our service providers are located outside the European Economic Area (EEA). Where we transfer personal data to countries not covered by an EU adequacy decision, we ensure that appropriate safeguards are in place to protect your data, in accordance with Chapter V of the GDPR.

For transfers to the United States, our primary transfer mechanism is the EU-US Data Privacy Framework (DPF), the adequacy decision adopted by the European Commission on 10 July 2023, for those of our processors that are certified under it. As a precaution against any future change to the adequacy decision, we also maintain Standard Contractual Clauses (SCCs, 2021 version) as a contractual fallback with our US processors, so that transfers remain lawful even if the DPF is suspended, amended or repealed. For transfers to third countries that are not covered by the DPF, SCCs are the primary mechanism.

The following third-country processors are used by Kingdom of Wow. Where a processor is certified under the EU-US Data Privacy Framework (DPF), transfers are made primarily under that adequacy decision, with SCCs maintained as a fallback. Where no DPF certification exists, transfers are governed by Standard Contractual Clauses (SCCs, updated June 2021).

  • Shopify Inc. — United States | Ecommerce platform, order processing, customer accounts, Shop Pay, and card payment processing and fraud screening via Shopify Payments (which uses Stripe Inc. as a sub-processor). Transfer mechanism: EU-US Data Privacy Framework (DPF certified); SCCs maintained as fallback.
  • Google LLC (Google Analytics, Google Ads) — United States | Website analytics (GA4), ad conversion tracking. IP anonymisation is enabled. Transfer mechanism: EU-US Data Privacy Framework (DPF certified); SCCs maintained as fallback.
  • MailerLite — United States | Email marketing and newsletter platform. Transfer mechanism: EU-US Data Privacy Framework (DPF certified); SCCs maintained as fallback.
  • Meta Platforms Ireland Ltd (Facebook/Instagram) — Ireland (EEA) | Ad conversion attribution and retargeting via Meta Pixel. Transfer mechanism: As an EEA-based processor, no third-country transfer mechanism required.
  • Pinterest Inc. — United States | Ad conversion attribution via Pinterest tag. Transfer mechanism: EU-US Data Privacy Framework (DPF certified); SCCs maintained as fallback.
  • Cloudflare Inc. — United States | CDN, DDoS protection and bot management. Transfer mechanism: EU-US Data Privacy Framework (DPF certified); SCCs maintained as fallback.
  • Ahrefs Pte Ltd — Singapore | Website traffic and SEO/marketing analytics. Transfer mechanism: Standard Contractual Clauses (SCCs, 2021 version).
  • Usercentrics A/S (Cookiebot) — Denmark (EEA) | Cookie consent management and consent record-keeping. Transfer mechanism: As an EEA-based processor, no third-country transfer mechanism required.
  • GoAffPro — India (with data centres also in the EU, US and Singapore) | Affiliate programme tracking. Transfer mechanism: Standard Contractual Clauses (SCCs, 2021 version).
  • KOW Lifestyle Manufacturing Co. Ltd — Cambodia | Group company; delivery address data shared for order fulfilment. Transfer mechanism: Standard Contractual Clauses (SCCs).
  • Judge.me Ltd — United Kingdom | Product review collection, display, and moderation; review data may be used to build advertising audiences (e.g. Facebook) and is shared with Shopify/Shop app to display reviews alongside products. Transfer mechanism: Standard Contractual Clauses (SCCs, 2021 version) govern the transfer of your personal data to Judge.me's servers in the United States; the UK International Data Transfer Agreement is additionally in place to cover the transfer from Judge.me Ltd (UK) to those servers.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, and no longer than required by applicable law. The following retention periods apply:

  • Order and transaction data: Retained for 7 years from the date of the transaction, to comply with Dutch and EU tax and accounting obligations (Article 52 Algemene wet inzake rijksbelastingen). This applies equally to orders placed as a guest without an account, which remain retrievable without an account login so that guest customers can exercise their statutory rights, including the right of withdrawal.
  • Customer account data: Retained for as long as your account is active, and for 3 years after your last interaction with us, after which it will be deleted or anonymised.
  • Marketing consent and communications: Retained until you withdraw consent or unsubscribe. A suppression record of your opt-out is retained for 3 years to ensure we honour your preference.
  • Customer service correspondence: Retained for 3 years from the date of last correspondence.
  • Website analytics data: Aggregated analytics data is retained for 26 months. Raw IP addresses are anonymised and are not stored beyond the session.
  • Legal claims: Where personal data is processed in connection with a legal claim or dispute, we retain it for the duration of the claim plus the applicable statutory limitation period.

At the end of the applicable retention period, personal data is securely deleted or anonymised.

8. Tracking Technologies and Cookies

We use cookies and similar tracking technologies to enhance your experience on the Site, analyse usage patterns, and deliver relevant advertising content. A full description of the cookies we use and how to manage your preferences is set out in our Cookie Policy.

Most non-essential cookies are only activated after you have given your prior consent through our cookie consent banner. A small number of app-embed cookies (currently GoAffPro and Judge.me) are not yet routed through the banner and load regardless of your choice; our Cookie Policy lists these for transparency. You may withdraw or adjust your consent for banner-controlled cookies at any time by accessing the cookie settings on the Site.

For information about opting out of interest-based advertising, EU users may visit www.youronlinechoices.eu. US users may also visit the Network Advertising Initiative Opt-Out Tool or the Digital Advertising Alliance Opt-Out Tool.

Website Analytics

We use Google Analytics (GA4) to analyse how visitors interact with the Site. Google Analytics uses cookies to collect information about your use of the Site, which is transmitted to and stored by Google on servers in the United States. We have configured Google Analytics with IP anonymisation enabled. We also use Google Ads for conversion tracking, Meta Pixel for advertising attribution, Pinterest Tag for ad conversion tracking, Ahrefs for website traffic and SEO analytics, and MailerLite for email marketing analytics. A full list of analytics and marketing tools, their purposes and transfer mechanisms is set out in Section 6 above and in our Cookie Policy. Google's privacy policy.

9. Your Rights Under EU Data Protection Law

Under the GDPR, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at hello@kingdomofwow.com. There is no charge for making a request.

  • Right of access (Art. 15): You have the right to obtain a copy of the personal data we hold about you and information about how we process it.
  • Right to rectification (Art. 16): You have the right to have inaccurate personal data corrected and incomplete personal data completed.
  • Right to erasure / ‘right to be forgotten’ (Art. 17): You have the right to request deletion of your personal data in certain circumstances, including where it is no longer necessary for the purposes for which it was collected.
  • Right to restriction of processing (Art. 18): You have the right to request that we restrict processing of your personal data in certain circumstances, for example while a complaint is being investigated.
  • Right to data portability (Art. 20): Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format.
  • Right to object (Art. 21): You have the right to object to processing of your personal data based on our legitimate interests. You also have an unconditional right to object to processing for direct marketing purposes, in which case we will cease processing immediately.
  • Right to withdraw consent (Art. 7(3)): Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
  • Right not to be subject to automated decision-making (Art. 22): You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects on you.

We will respond to your request within one month of receipt. We may extend this period by a further two months where requests are complex or numerous, but will notify you of any extension within the first month. We may ask you to verify your identity before processing your request, but will not use identity verification as a barrier to exercising your rights.

10. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with applicable data protection law, you have the right to lodge a complaint with a supervisory authority. As KOW Lifestyle Europe B.V. is established in the Netherlands, the lead supervisory authority is:

Autoriteit Persoonsgegevens (AP)

Postbus 93374, 2509 AJ Den Haag

www.autoriteitpersoonsgegevens.nl

You also have the right to lodge a complaint with the supervisory authority in the EU Member State of your habitual residence or place of work. We would, however, welcome the opportunity to address your concerns directly before you approach a supervisory authority.

11. Security of Your Information

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include encryption of data in transit (SSL/TLS), access controls, and regular review of our security practices.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of the breach, and will notify you directly where the breach is likely to result in a high risk to your rights.

No method of transmission over the internet or electronic storage is completely secure. While we take all reasonable steps to protect your personal data, we cannot guarantee its absolute security.

12. Children's Privacy

Our Site is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at hello@kingdomofwow.com and we will take prompt steps to delete that information.

13. Do Not Track

Most web browsers include a Do-Not-Track (“DNT”) feature that allows you to signal your preference not to have your browsing activities tracked. There is currently no uniform legal standard in the EU governing how websites must respond to DNT signals. For information about how we use cookies and tracking technologies, and how to manage your preferences, please see our Cookie Policy.

14. Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or our processing of your personal data, please contact us:

Kingdom of Wow / KOW Lifestyle Europe B.V.

Althof 27, 5831 DZ Boxmeer, The Netherlands

Email: hello@kingdomofwow.com

We aim to acknowledge general privacy-related enquiries within 5 working days. Formal requests to exercise your rights under Section 9 are handled within the statutory deadline of one month set out in that Section.

Last updated: 8 September 2026

This Privacy Policy is published in English. Dutch and German versions will also be made available and apply to purchases made through the respective language versions of our website.