Privacy Policy
Last updated: November 12, 2026
KIPLI SAS places great importance on the protection of your personal data. This Privacy Policy explains what data we collect when you visit https://kipli.com/en-ie (the “Website”), place an order, contact us, or receive our communications; why and on what legal basis we process it; how long we retain it; with whom we share it; and what rights you have. It is prepared in accordance with Regulation (EU) 2016/679 (the “GDPR”), the Data Protection Act 2018, and the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011).
1. Controller
The controller of your personal data is KIPLI SAS, a simplified joint-stock company under French law with a share capital of EUR 172,746.20, registered with the Paris Trade and Companies Register under number 841 674 302, whose registered office is located at 200 rue de la Croix Nivert, 75015 Paris, France.
If you have any questions about this Policy or your personal data, you may contact us at help@kipli.com or by mail at the address above, marking your letter “Data Protection.” KIPLI SAS has not appointed a data protection officer, as it is not required to do so; requests are handled by our Customer Service team under the supervision of management.
2. Scope
This Policy applies to the processing of personal data of Website visitors, customers, prospective customers, newsletter subscribers, and any person who contacts us (collectively, “you”). It does not apply to third-party websites to which the Website may link, nor to social media platforms on which KIPLI is present, which have their own privacy policies.
3. Data We Collect
We collect the data you provide to us and data generated by your use of the Website:
- Identity and contact information: title, first name, last name, mailing address, email address, phone number;
- Order data: products ordered, order number, invoices, shipping address and instructions, order and post-sale history, returns, warranty claims;
- Payment data: payment method used, transaction status and identifier, and the last four digits of your card. Full card numbers are collected directly by our payment service providers and are never stored by KIPLI SAS;
- Account data: login credentials and password (stored in hashed form), preferences, wish lists;
- Communication data: the content of your emails, chat conversations, phone calls, and reviews, as well as the information you include in them;
- Browsing and device data: IP address, device and browser type, pages visited, dates and times of connection, traffic source, interactions with our emails, and data collected by cookies and similar technologies (see Section 11);
- Marketing data: your subscription status, consent history, and your interests as inferred from your purchases and browsing activity.
Information marked as required on our forms is necessary to process your request or order; without it, we cannot provide the service in question. We do not knowingly collect special categories of data (such as health or religious information). If you voluntarily provide us with such information—for example, in a message—we use it solely to address your request.
4. Purposes and Legal Bases
| Purpose | Legal Basis (Article 6 of the GDPR) |
|---|---|
| Processing and fulfilling your orders, payment, invoicing, returns, customer service, and product warranties | Performance of the contract (6(1)(b)) |
| Creating and Managing Your Customer Account | Performance of the contract (6(1)(b)) |
| Responding to your questions, requests, and complaints | Performance of the contract or steps taken prior to entering into a contract (6(1)(b)); our legitimate interest in handling requests (6(1)(f)) |
| Managing the 30-night trial period and the right to cancel | Performance of the contract (6(1)(b)); legal obligation (6(1)(c)) |
| Maintaining accounting records, invoices, and tax documents | Legal obligation (6(1)(c)) |
| Preventing Fraud and Securing Payments | Our legitimate interest in protecting our business and our customers (6(1)(f)) |
| Sending our newsletter and promotional offers via email or text message | Your consent (6(1)(a)); or, for existing customers and similar products, our legitimate interest (6(1)(f)), with the right to object at any time (Section 12) |
| Personalizing our communications and the Website | Your consent where cookies are used (6(1)(a)); otherwise, our legitimate interest in understanding our customers (6(1)(f)) |
| Collecting and publishing product reviews | Your consent (6(1)(a)) |
| Measuring the Website's Audience and Improving It | Your consent for non-essential cookies (6(1)(a)); our legitimate interest for strictly necessary cookies or aggregated measurement (6(1)(f)) |
| Operating the Website and Ensuring Its Security | Our legitimate interest (6(1)(f)) |
| Establishing, exercising, or defending legal claims | Our legitimate interest (6(1)(f)) |
| Responding to requests from public authorities | Legal obligation (6(1)(c)) |
Where we rely on legitimate interest, we have determined that our interest is not overridden by your interests or fundamental rights; you may obtain further information about this determination and object by contacting us. Where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
5. Recipients
Your data is accessible to KIPLI SAS employees who need it for the purposes described above. It is also shared, to the extent necessary, with:
- Processors acting on our instructions: e-commerce platform and hosting (Shopify), payment service providers (Shopify Payments, PayPal, and the provider of installment payments where offered), carriers and logistics providers, email and SMS marketing providers, review platform, customer service and chat tools, analytics and advertising providers, IT and security providers, accountants and auditors;
- Independent data controllers: payment institutions and banks for the processing of payments; carriers with respect to their own delivery records; social networks and advertising platforms where you have consented to advertising cookies, for the purposes described in their own policies;
- Public authorities, courts, and legal advisors, where required by law or to establish, exercise, or defend legal claims;
- A purchaser or successor in the event of a merger, acquisition, or transfer of all or part of our business, subject to appropriate confidentiality agreements.
We do not sell your personal data.
6. Transfers outside the European Economic Area
Your data is hosted in the European Union. Some of our service providers (in particular our e-commerce platform, email, analytics, and advertising providers) are located, or have subprocessors, outside the European Economic Area, notably in Canada and the United States. In such cases, we ensure that the transfer is covered by an adequacy decision from the European Commission (such as the decision regarding Canada or the EU-U.S. Data Privacy Framework for certified U.S. companies) or, failing that, by the European Commission’s standard contractual clauses, supplemented where necessary by additional safeguards. You may obtain a copy of the safeguards in place by contacting us.
7. Retention periods
We retain your data only for as long as necessary for the purposes for which it was collected, and then for the periods required by law:
- Customer account and order data: for the duration of the business relationship, and then for six (6) years after the last order, which corresponds to the statute of limitations for contractual claims under Irish law and to the duration of our commercial warranties and statutory rights; data covered by the ten-year warranty on mattresses is retained until the end of that warranty;
- Invoices and accounting records: ten (10) years from the end of the fiscal year, as required by French commercial and tax law applicable to KIPLI SAS;
- Prospective customer data and marketing consents: three (3) years from your last contact with us (clicking on an email, submitting a request, etc.) or until you unsubscribe; proof of consent is retained for the duration of the processing plus the statute of limitations;
- Customer service and chat records: three (3) years from the date the request is closed;
- Cookies and identifiers: up to thirteen (13) months for the cookie itself and twenty-five (25) months for the data collected through it (see Section 11); consent and opt-out choices are retained for six (6) months;
- Payment data: the time required to complete the transaction; the last four digits of the card and transaction identifiers are retained with the order for fraud prevention and evidentiary purposes for thirteen (13) months after the debit;
- Data related to a dispute: until the dispute is finally resolved and the applicable statutes of limitations have expired.
At the end of these periods, the data is deleted or anonymized. An inactive account (no login or order for five years) is notified and then closed.
8. Security
We implement appropriate technical and organizational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, including: connection encryption (TLS), password hashing, access controls and logging, restriction of access to authorized staff bound by confidentiality obligations, selection of service providers that offer sufficient safeguards and are bound by data processing agreements, and regular backups. Payments are processed by PCI-DSS-certified providers. In the event of a personal data breach likely to result in a high risk to your rights, we will notify you in accordance with Article 34 of the GDPR.
9. Your rights
Under the GDPR and the Data Protection Act 2018, you have the following rights:
- Access: to obtain confirmation that we process your data and a copy of it, along with the information set forth in Article 15 of the GDPR;
- Correction: to have inaccurate data corrected and incomplete data filled in;
- Erasure: to have your data deleted in the cases provided for in Article 17 of the GDPR (for example, when it is no longer necessary or you withdraw your consent), subject to our legal retention obligations;
- Restriction: to obtain a restriction on processing in the cases provided for in Article 18 of the GDPR;
- Portability: to receive the data you have provided to us in a structured, commonly used, and machine-readable format, and to have it transferred to another controller where technically feasible;
- Objection: to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, and, without any justification, to processing for direct marketing purposes, including profiling related to such marketing;
- Withdrawal of consent: at any time, for processing based on consent, without affecting the lawfulness of prior processing;
- Automated decisions: You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. We do not make such decisions; fraud screening of payments may involve automated analysis, but any refusal of an order is reviewed by a member of our team upon request.
To exercise these rights, write to help@kipli.com or to KIPLI SAS, 200 rue de la Croix Nivert, 75015 Paris, France, stating your name and the email address used for your orders. If we have reasonable doubts about your identity, we may ask you for additional information. We will respond within one (1) month of receiving your request; this period may be extended by two (2) additional months for complex or numerous requests, in which case we will notify you. Exercising your rights is free of charge, unless the requests are manifestly unfounded or excessive.
10. Complaints to the supervisory authority
If you believe that the processing of your data violates applicable rules, you have the right to file a complaint with the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland – www.dataprotection.ie – or with the supervisory authority of the Member State where you habitually reside or work. Since KIPLI SAS is based in France, the French authority, the Commission Nationale de l’Informatique et des Libertés (CNIL, www.cnil.fr), acts as the lead supervisory authority for cross-border processing and cooperates with the Data Protection Commission. We would nevertheless appreciate it if you would contact us first so that we can try to resolve your concern.
11. Cookies and Similar Technologies
Cookies are small text files placed on your device when you visit the Website. We also use similar technologies (pixels, local storage, SDKs). In accordance with Regulation 5 of S.I. No. 336 of 2011 and the guidance of the Data Protection Commission, cookies that are not strictly necessary for the operation of the Website are placed only with your prior consent, which you can grant or deny via the banner displayed on your first visit and may change at any time via the “Cookie settings” link at the bottom of each page. Refusing cookies is just as easy as accepting them, and your choice is retained for six (6) months. The Website uses the following categories:
- Strictly necessary cookies (no consent required): session, shopping cart, authentication, security and fraud prevention, language and country selection, and recording of your cookie preferences. Without them, the Website cannot function.
- Functional cookies (consent): remembering your preferences, live chat, and displaying product reviews.
- Analytics cookies (consent): audience measurement and statistics on the use of the Website (for example, Google Analytics, Shopify Analytics), which help us improve it.
- Advertising and social media cookies (consent): measurement and personalization of our advertising on third-party platforms (such as Meta, Google Ads, and Microsoft Advertising), which may combine this data with data they hold in accordance with their own policies.
A detailed list of cookies, including their provider, purpose, and duration, is available in the cookie settings panel. Cookies are stored for a maximum of thirteen (13) months, and the data collected is retained for a maximum of twenty-five (25) months. You may also configure your browser to block or delete cookies, keeping in mind that this may affect the Website’s functionality.
12. Marketing Communications
We send our newsletter and promotional offers by email or text message only if you have given your consent (for example, by checking the box when creating your account or subscribing to the newsletter) or, in accordance with Regulation 13 of S.I. No. 336 of 2011, if you are an existing customer; in this case, our communications are limited to our own similar products and are sent for no more than twelve (12) months after your last purchase, unless you have renewed your consent. You may opt out of receiving such communications at any time and free of charge by clicking the unsubscribe link in each email, replying “STOP” to an SMS, or writing to help@kipli.com. We may continue to send you service messages related to your orders (confirmation, delivery, after-sales), which are not marketing communications.
13. Children
The Website and its services are intended for adults. We do not knowingly collect personal data from children under sixteen (16) years of age—the age of digital consent in Ireland under Section 31 of the Data Protection Act 2018—without the consent of the holder of parental responsibility. If you become aware that a child has provided us with data without such consent, please contact us and we will delete it.
14. Changes to This Policy
We may update this Policy to reflect changes in our practices, our services, or applicable law. The date of the latest version appears at the top of this page. In the event of a substantial change that affects your rights, we will notify you by any appropriate means (notice on the Website, email) before it takes effect. We encourage you to review this Policy regularly.
15. Contact
For any questions about this Policy or to exercise your rights: KIPLI SAS – Data Protection, 200 rue de la Croix Nivert, 75015 Paris, France – help@kipli.com – +33 1 76 42 11 72.
Privacy Policy – KIPLI SAS – version dated November 12, 2026.