Privacy Policy

This policy explains what personal data we collect when you visit get-kisora.com or buy from us, why we use it, who receives it, and what rights you have.

1. Who is responsible

The controller of your personal data is ELFMEDIA - FZCO, trading as Kisora, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. Email: [email protected].

2. What we collect, why, and on what legal basis

Why we use it	What we use	Legal basis
To take, process and deliver your order, add-ons included	Name, email address, phone number, delivery address, items, prices, order number	Our contract with you (Art. 6(1)(b) GDPR)
To take payment, make refunds and charge the one-click add-ons you accept	Payment status and basic payment details, such as payment method, amount and currency. Whop handles your card details and saves your payment method for one-click add-ons; we don’t receive your full card number.	Our contract with you (Art. 6(1)(b))
To send order, shipping, withdrawal and refund emails	Name, email address, order details	Our contract with you (Art. 6(1)(b))
To send you offers and news by email, if you tick the box under the email field at checkout (the same tick covers the reminder of an order you didn’t finish)	Name, email address, country and language, what you picked or bought (so we can tailor the emails to you)	Your consent (Art. 6(1)(a)). You can withdraw it at any time, with effect for the future, with the unsubscribe link in every email or by writing to us.
To remind you of an order you started but didn’t finish (at most two emails, about an hour and a day after you stopped), and to fill your details in again when you come back from a reminder	What you typed at checkout before paying: email address, name, phone number, delivery address and country, the package you picked and the checkout page. Never your card details.	Outside the US: your consent, given with the tick under the email field (Art. 6(1)(a)). For a US delivery address: our legitimate interest in helping you finish the order you started (Art. 6(1)(f)). Every reminder has an unsubscribe link; if you untick the box before paying, we delete what we received.
To answer your messages and handle withdrawals, returns and guarantee claims	Your messages, photos you send us, order details	Our contract with you (Art. 6(1)(b)); legal obligation (Art. 6(1)(c))
To keep tax and accounting records	Order, invoice and payment records	Legal obligation (Art. 6(1)(c))
To prevent fraud and payment abuse, and to defend legal claims and payment disputes	Order details, payment status, IP address, device and browser data, our correspondence with you	Our legitimate interest in protecting our business and defending claims (Art. 6(1)(f))
To run the website securely and reliably, and to show it as designed	IP address, device and browser data, pages requested, date and time	Our legitimate interest in a secure, working website that looks the same on every device (Art. 6(1)(f))
To contact you about a product safety issue or recall	Name, contact details, items bought	Legal obligation (Art. 6(1)(c)); our legitimate interest in your safety (Art. 6(1)(f))
To measure which of our ads lead to sales	The click ID in the link of the ad you came from, the order value, the currency and a payment reference. Not your name, email address or delivery address.	Our legitimate interest in knowing which ads work (Art. 6(1)(f))

To buy from us, you need to give us your contact and delivery details. Without them, we can’t process or deliver your order.

3. Who receives your data

We share personal data only where it’s needed for the purposes above.

• Payment processor: Whop processes payments for us and receives the details needed for each payment. For some purposes, such as fraud prevention and its own legal obligations, Whop may act as a separate controller under its own privacy policy. If you pay with PayPal, Apple Pay or Google Pay, that provider also receives the data needed for the payment, under its own privacy policy.
• Fulfilment partner: receives your name, delivery address, phone number and the items, to pack and ship your order.
• Delivery companies and customs: carriers receive your name, delivery address and phone number, and your email address where they need it for delivery notices. Because we ship duties paid, customs authorities receive the information that customs declarations require.
• Email provider: sends our emails to you.
• Hosting, content delivery and security providers: process technical data, such as your IP address, to deliver the website and to check that a person, not a bot, is using the checkout and the withdrawal form.
• Ad tracking: if you came to us through one of our ads and then buy, our ad-tracking provider, and through it the ad network that showed the ad, receive the click ID, the order value and a payment reference.
• Advisers and authorities: our tax advisers, auditors and lawyers, and authorities or courts where the law requires it or we need to defend a claim.

4. International transfers

We are based in the United Arab Emirates. Some of our service providers, such as Whop (payments) and Cloudflare (hosting and security), are in the United States. Your data can therefore go to the United Arab Emirates, the United States and the country your order ships from.

When we transfer your data outside the EEA, Switzerland or the UK, we rely on:

• an adequacy decision of the European Commission, or its UK or Swiss equivalent, where one exists for the country, or
• the European Commission’s Standard Contractual Clauses, with the UK Addendum or the Swiss adjustments where needed, or
• where no other safeguard applies, the exception for transfers that are necessary to perform our contract with you (Art. 49(1)(b) GDPR), for example sending your delivery address to our fulfilment centre so we can ship your order.

You can ask us for a copy of the safeguards we use.

5. How long we keep your data

• Orders, invoices and payment records: as long as tax and accounting laws require. This can be up to 10 years.
• Records for payment disputes and fraud prevention: tracking and delivery records, what you ordered and accepted at checkout, and the technical data of your order, such as IP address and device. We keep them as long as a payment can still be disputed or a claim brought, which for card payments is at least about 18 months after the purchase, and longer while a dispute or claim is open.
• Messages, withdrawals, returns and guarantee claims: until the matter is settled and any related claims can no longer be brought.
• Ad click ID: with your order records.
• Website logs: for a limited time, as long as we need them to run and protect the website.
• Unfinished checkouts: what you typed for reminders, until 30 days after our last reminder (or after you started, if we sent none), or earlier if you ask us. If you unsubscribe, we keep only your email address, so we can honour your wish.
• Email offers: your name, email address, country and language, for as long as you’re subscribed. If you unsubscribe or withdraw your consent, we keep only your email address and the date, so we can honour your wish.
• Cookies and session storage: see section 8.
• Backups: data we have deleted can stay in our backups until they are replaced in the normal backup cycle.

After that, we delete your data or make it anonymous.

6. Your rights

You have the right to:

• access your data and get a copy of it,
• correct data that is wrong or incomplete,
• delete your data,
• restrict how we use it,
• receive the data you gave us in a common, machine-readable format, or have it sent to someone else (data portability),
• object to our use of your data (see below).

Your right to object: where we use your data based on our legitimate interests (for example fraud prevention and payment disputes, website security and ad measurement), you can object at any time on grounds relating to your particular situation. You can object to direct marketing at any time, without giving a reason, and we then stop sending it.

To use your rights, email [email protected]. It is free. We reply within one month, and may ask you to confirm your identity, for example by writing from the email address you ordered with.

You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work, or where you think the problem happened. We would appreciate the chance to sort it out with you first.

Automated decisions: we don’t make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Our payment processor may screen payments automatically to prevent fraud; see its privacy policy.

7. Children

Our shop is not meant for children under 16. We don’t knowingly collect their data.

8. Cookies and similar technologies

Cookies are small files stored on your device. Session storage is a similar space in your browser that is emptied when you close the tab. We only use them where the shop needs them to work: to keep your order together while you check out and see the offers after it, to protect the checkout against fraud and bots, and to take your payment. If you came to us through one of our ads, your order details in session storage also include the ad’s click ID (see section 2).

The cookies and storage the shop needs to work don’t need your consent. We don’t use analytics or advertising cookies, so there is nothing to accept or reject. If we add them, we will ask for your consent first and update this page. How to delete or block cookies is explained in our Cookie Policy.

9. Changes to this policy

We update this policy when our services or the law change. The date at the top shows the current version.

Regional differences

The policy above follows the EU General Data Protection Regulation (GDPR), which also applies in Norway. Where something is different for your country, you’ll find it below.

United Kingdom

• The UK GDPR and the Data Protection Act 2018 apply, and the Privacy and Electronic Communications Regulations (PECR) for cookies.
• For transfers outside the UK, we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses.
• You can complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Switzerland

• The Swiss Federal Act on Data Protection (FADP) applies. Your rights are much the same as described above.
• You can complain to the Federal Data Protection and Information Commissioner (FDPIC).

United States

• The GDPR legal bases above describe EU law. We use your data for the same purposes.
• You can ask to see or correct the personal data we hold about you by emailing [email protected].
• Reminder emails: if you start an order with a US delivery address and don’t finish it, we may email you up to two reminders about it. Every reminder has an unsubscribe link.
• Do Not Track: we don’t track you across other websites, so our site works the same whether or not your browser sends a Do Not Track signal. Apart from our payment providers’ fraud prevention and the ad measurement described in section 2, we don’t allow third parties to collect data about your activity on our site over time and across other websites.
• When we change this policy, we update this page and the date at the top.