Privacy & Cookie Policy
Rare Kid respects your privacy. This policy explains what personal data we collect, why, how long we keep it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018 and the ePrivacy Regulations (S.I. No. 336 of 2011).
Short version: we collect only what we need to tell you about drops and to deliver your order. We never sell your data. We don't use tracking or advertising cookies unless you say yes.
1. Who we are
Rare Kid is run by YOUR FULL NAME, trading as Rare Kid, in Ireland. We are the data controller for the personal data described here.
- Email: thefew@rarekid.store
- Phone: 089 972 1947
We are a small business and are not required to appoint a Data Protection Officer. Any privacy question goes straight to us at the email above.
2. What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Email address and first name (sign-up form) | To send you news about upcoming drops | Your consent (Art. 6(1)(a) GDPR) |
| Name, delivery address, phone, email, notes, size and colour (orders sent via WhatsApp) | To confirm your order, calculate An Post shipping, arrange payment and deliver it | Performing our contract with you (Art. 6(1)(b)) |
| Order and payment records | Accounting and tax | Legal obligation (Art. 6(1)(c)) |
| Messages you send us (email, phone, Facebook) | To reply to you | Our legitimate interest in answering you (Art. 6(1)(f)) |
| Basic technical data (IP address, browser) in server logs | To deliver and secure the website | Legitimate interest (Art. 6(1)(f)) |
We don't collect special category data, and we don't make automated decisions or profiles about you.
3. Who we share it with
We only share your data with services that help us run Rare Kid, and only what they need:
- WhatsApp (WhatsApp Ireland Limited, part of Meta): when you place an order, your order details go to us as a WhatsApp message from your own account. WhatsApp's privacy policy applies to its service.
- Formspree (Formspree, Inc., USA): receives sign-up form entries, stores them securely and forwards them to our inbox.
- GitHub Pages (GitHub, Inc.): hosts this website and keeps basic server logs.
- Our email provider: stores the emails we send and receive.
- An Post: receives your name, address and contact details to deliver your order.
- PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.): processes payments made through our PayPal payment links. We never see your card details.
- Our bank: receives bank transfers and the payer name and reference that come with them.
- Meta (Facebook): only if you choose to message us there. Meta's own privacy policy applies.
- Revenue or other authorities: only where the law requires it.
We never sell or rent your personal data.
4. Transfers outside the EU
Some of these services may process data outside the European Economic Area, including in the United States. Where that happens, we rely on the safeguards the GDPR allows, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
5. How long we keep it
- Sign-up list: until you unsubscribe or ask us to delete it. If we haven't emailed you about a drop in 24 months, we delete your details.
- Orders: for 6 years after the end of the tax year, as Irish tax law requires.
- Messages and WhatsApp chats: up to 12 months after the conversation ends, unless they relate to an order. Order chats are kept with our order records.
- Server logs: kept by our host for a short period for security.
6. Your rights
Under the GDPR you can, free of charge:
- Get a copy of the personal data we hold about you (access).
- Have it corrected if it's wrong (rectification).
- Have it deleted (erasure, "right to be forgotten").
- Limit how we use it (restriction).
- Get it in a portable format (portability).
- Object to us using it, including for direct marketing at any time (objection).
- Withdraw your consent at any time, for example by clicking "unsubscribe" in any email or replying "stop". This doesn't affect anything done before you withdrew.
Email us at thefew@rarekid.store and we'll reply within one month. We may ask you to confirm your identity first.
If you're unhappy with how we handle your data, you can complain to the Irish Data Protection Commission at dataprotection.ie. We'd appreciate the chance to fix it first.
7. Cookies
Cookies and similar technologies (like your browser's local storage) are small files that let a website remember things. Under Irish and EU law, we may only use non-essential ones with your consent.
| Name | Type | Purpose | Kept for |
|---|---|---|---|
| rk_consent | Strictly necessary (local storage) | Remembers your cookie choice so we don't ask on every page | 6 months |
| rk_cart | Strictly necessary (local storage) | Keeps the tees you added in your cart while you browse. Emptied when you send your order | Until you order or clear your browser |
| rk_last_order | Strictly necessary (local storage) | Shows your order number again if you come back from WhatsApp, so you can finish sending it | 30 minutes, or until you confirm it was sent |
That's all we use, and they all stay in your own browser. We don't use analytics, advertising or social media tracking cookies. Our fonts are hosted on our own site, so visiting doesn't send your data to Google.
If we add analytics or advertising tools in the future, they will stay off until you choose to allow them, and we'll list them in this table.
8. Children
Our sign-up list isn't intended for anyone under 16. If you're under 16, please don't send us your details. If we learn we hold a child's data without a parent's consent, we'll delete it.
9. Keeping your data safe
We use secure, password-protected accounts with two-step sign-in, HTTPS on this website, and we limit access to your data to the people who need it to fulfil your order.
10. Changes to this policy
If we change this policy, we'll update the date at the top. If the change is significant, we'll let our subscribers know by email.