Privacy Policy
Last updated: 15 June 2026
This Privacy Policy explains how Kinvart d.o.o. collects, uses, stores and protects your personal data when you visit our website, create an account, place an order, subscribe to our newsletter or contact us.
1. Data Controller
The controller of your personal data is:
Kinvart d.o.o.
Ellerjeva 53
1000 Ljubljana
Slovenia
VAT number: SI88852903
Email: hello@leafandspice.com
Website: www.leafandspice.com
2. Personal Data We Collect
We may collect and process the following personal data:
Order and delivery data: name, surname, billing address, delivery address, email address, phone number, ordered products, payment status, delivery method and order history.
Account data: username, password, saved addresses, order history and account preferences.
Payment data: payment status and limited payment-related information. Full card details are processed by the selected payment provider and are not stored by us.
Communication data: messages you send us by email, contact form, social media or customer support channels.
Newsletter data: email address, subscription status, consent record and newsletter interaction data such as opens and clicks, where applicable.
Technical and website usage data: IP address, browser type, device type, operating system, pages visited, referral source, approximate location, cookie identifiers and website behaviour, depending on your cookie choices.
3. Why We Process Your Personal Data
We process your personal data for the following purposes:
To process and deliver your orders
To issue invoices and comply with accounting and tax obligations
To communicate with you about your order, delivery, returns, complaints or questions
To manage your user account
To send newsletters and marketing messages when you have subscribed or where otherwise permitted by law
To improve our website, products, customer experience and marketing
To prevent fraud, misuse, security incidents and technical problems
To comply with legal obligations
To establish, exercise or defend legal claims
4. Legal Bases for Processing
We process personal data based on the following legal bases:
Performance of a contract: when we process your order, payment, delivery, user account, returns or customer support requests.
Legal obligation: when we process and store invoices, accounting records, tax data and legally required business documentation.
Consent: when you subscribe to our newsletter, accept non-essential cookies or agree to specific optional processing.
Legitimate interest: when we ensure website security, prevent fraud, improve our services, respond to general enquiries and protect our legal rights.
You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
5. Newsletter and Marketing Communication
If you subscribe to our newsletter, we may send you updates about teas, spices, gift sets, offers, recipes, product launches and website content.
You can unsubscribe at any time by clicking the unsubscribe link in any newsletter or by contacting us at [add email].
We do not sell your personal data to third parties.
6. Cookies and Tracking Technologies
We use cookies and similar technologies. Some cookies are necessary for the website and webshop to function. Other cookies, such as analytics and marketing cookies, are used only with your consent where required.
More information is available in our Cookie Policy.
7. Who We Share Your Data With
We may share your personal data with trusted service providers who help us operate our webshop, including:
Website hosting providers
WooCommerce/WordPress service providers
Payment processors
Delivery and fulfilment partners
Accounting service providers
Email marketing platforms
IT support and security providers
Analytics and advertising platforms, where you have given consent
Legal, tax or business advisors
Public authorities, courts or regulators where required by law
All service providers may only process your data for agreed purposes and must protect it appropriately.
8. International Data Transfers
Some service providers may process personal data outside the European Economic Area. Where this happens, we ensure that appropriate safeguards are used, such as European Commission adequacy decisions, standard contractual clauses or other legally recognised transfer mechanisms.
9. How Long We Store Your Data
We keep personal data only for as long as necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.
Typical retention periods:
Order, invoice and accounting data: according to applicable tax and accounting laws
Customer account data: until the account is deleted, unless longer storage is required
Customer support communication: as long as necessary to resolve the matter and protect legal rights
Newsletter data: until you unsubscribe or withdraw consent
Cookie consent records: for the period necessary to demonstrate consent
Technical/security logs: for a limited period necessary for security and troubleshooting
10. Your Rights
Under applicable data protection law, you may have the right to:
Access your personal data
Request correction of inaccurate or incomplete data
Request deletion of your personal data
Request restriction of processing
Object to processing based on legitimate interests
Request data portability
Withdraw consent at any time
Lodge a complaint with a supervisory authority
In Slovenia, the supervisory authority is:
Informacijski pooblaščenec Republike Slovenije
Dunajska cesta 22
1000 Ljubljana
Slovenia
Website: www.ip-rs.si
To exercise your rights, contact us at [add email].
11. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, disclosure, alteration or destruction. However, no website, system or online transmission is completely secure.
12. Children
Our webshop is not intended for children under the age of 16. We do not knowingly collect personal data from children without appropriate parental or legal guardian consent.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The latest version will always be published on this page with the updated date.