Privacy policy
This policy explains what personal data we collect when you visit or buy from kemptcare.com, why, who sees it, how long we keep it, and your rights. Last updated: 18 October 2026.
Who is responsible
The data controller is Pablo Badajoz, sole proprietorship (EI) registered in France, SIREN 934 766 114, trading as Kempt, France. Contact: support@kemptcare.com. We have no data protection officer; the law does not require one for a business of our size.
What we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, email, shipping and billing address, phone, items ordered, order history | Process, ship and track your order; handle returns, refunds and warranty claims; send order emails | Contract (art. 6(1)(b)) |
| Payment data (handled by Shopify Payments, Shop Pay, Apple Pay, PayPal, Klarna or your bank, depending on the method you pick; we never see or store card numbers) | Take payment, prevent fraud | Contract; legal obligation; legitimate interest (fraud prevention) |
| Order records and invoices | Accounting and tax obligations | Legal obligation (art. 6(1)(c)) |
| Email address, name, what you buy and how you interact with our emails | Newsletter and offers, only if you subscribed | Consent (art. 6(1)(a)), withdrawable anytime via the unsubscribe link |
| Account data (email, orders) | Run your account | Contract |
| Messages you send us (contact form, email) | Answer you | Legitimate interest (customer service) |
| Session recordings and heatmaps: pages viewed, clicks, scrolls, mouse movement, screen size, and a recording of your visit, with form fields and text masked by default | See where the store confuses people and fix it | Consent (art. 6(1)(a)), given through the cookie banner |
| Browsing data: pages and products viewed, cart, device, browser, IP address, approximate location, cookie identifiers | Make the store work; measure and improve it; measure our ads and show you relevant ads on Meta and Pinterest | Essential cookies: legitimate interest. Analytics and advertising cookies: consent, given through the cookie banner |
Providing the data marked as needed for an order is required to buy from us; without it we cannot ship to you. Everything else is optional. We make no decisions about you by automated means that have legal or similarly significant effects.
Who we share it with
Only providers who need it to do their job, under contracts that limit what they can do with it:
- Shopify (Shopify International Ltd, Ireland, and Shopify Inc., Canada): hosts the store, processes orders and payments, provides the cookie banner and the privacy opt-out page.
- Payment providers: Shopify Payments, PayPal, Klarna and the card networks shown at checkout.
- Shipping carriers and Parcel Panel (order tracking page).
- Microsoft Clarity (Microsoft Ireland Operations Ltd): session recordings and heatmaps, loaded only after you accept analytics cookies. Microsoft may use the data as described in its own privacy statement.
- Klaviyo (email marketing, order emails and our sign-up pop-up) and Pop Convert (pop-ups on the site).
- Zigpoll (a short survey after your order, only if you choose to answer) and Aftersell (offers shown right after checkout).
- Meta and Pinterest (advertising measurement and audiences), through cookies and pixels, only with your consent where the law requires it.
- Authorities, when the law requires it.
We do not sell your personal data for money. Sharing browsing data with advertising platforms may count as a "sale" or "sharing" under some US state laws; see "Your privacy choices" below.
Transfers outside the European Union
Some providers are in the United States or Canada. Transfers rely on an adequacy decision of the European Commission where one exists (Canada, and US companies certified under the EU-US Data Privacy Framework) and otherwise on the Commission's Standard Contractual Clauses. Write to us to get a copy of the safeguards used.
Cookies
Essential cookies keep the store and the cart working. Analytics and advertising cookies are set only after you accept them in the cookie banner shown to visitors from the EU, the UK and Switzerland; refusing is as easy as accepting and you can change your mind anytime through the banner or your browser settings. Consent is asked again after 6 months at most. Cookie data is kept for 13 months at most. Session recordings are kept for 30 days by Microsoft Clarity, then deleted.
Your privacy choices (United States)
Residents of California and other US states with a privacy law can opt out of the "sale" or "sharing" of their data for targeted advertising on our Your Privacy Choices page. We honour the Global Privacy Control signal from your browser as an opt-out for that browser. We do not discriminate against you for exercising your rights.
How long we keep it
- Order records and invoices: 10 years, the legal retention period for accounting documents in France.
- Account data: while the account is active, then 3 years after your last order.
- Marketing data: until you unsubscribe, or 3 years after your last interaction with us.
- Support messages: 3 years after the last exchange.
- Browsing and cookie data: 13 months at most.
Your rights
You can ask to access your data, correct it, delete it, receive a copy in a portable format, restrict or object to its use, and withdraw your consent at any time without affecting what was done before. Write to support@kemptcare.com; we answer within one month and may ask you to confirm your identity. You can also lodge a complaint with your data protection authority: in France the CNIL (cnil.fr); in the UK the ICO; elsewhere in the EU, the authority of your country. For data that Shopify processes for its own purposes, see the Shopify consumer privacy policy.
Your shade selfie
If you use our Right Shade Guarantee, you send us a selfie. We use it for one thing only: picking your shade. Only our support team sees it. We never use it for advertising or facial recognition, and we never share or sell it. We delete it within 30 days after your new shade ships, or right away if you ask.
Emails
If you sign up or place an order, we send you emails through Klaviyo: help with your order, how to use your concealer, a shade check, a review request and one reorder reminder. If you subscribed, we also send offers. Every email has an unsubscribe link, and one click is enough.
Reviews
If you leave a review, the name you choose to display, your review and any photo you add are public on our site. Email us and we'll take your review down.
Security
The store runs over HTTPS. Payments are processed by PCI-DSS certified providers. Access to order data is limited to the people who need it to serve you.
Children
This store is for adults. We do not knowingly collect data from anyone under 18; if you think we have, email us and we delete it.
Changes
We may update this policy. The date at the top is the date of the current version.
Contact
Pablo Badajoz, Kempt, France. Email: support@kemptcare.com.
