1. Data controller
The controller of personal data is:
Društvo osebne rasti Vega / Società per la Crescita Personale-Vega
Fazanska ulica 2
6320 Portorož – Portorose
Registration number: 2708906
Tax number: 40224694
E-mail: info@kimstones.com
Phone: +386 70 843 262
Hereinafter: the “controller” or “Kimstones”.
Kimstones processes personal data in accordance with the General Data Protection Regulation (GDPR), the Slovenian Personal Data Protection Act (ZVOP-2) and other applicable legislation.
2. Personal data we process
Depending on how you use our website, online store and services, we may process in particular:
- first and last name,
- delivery and billing address,
- e-mail address,
- telephone number,
- information about orders and purchased products or services,
- information required for invoicing,
- payment method and payment status information,
- delivery information,
- user account information,
- the content of communications with us,
- information submitted through contact forms or when booking a service,
- date, time and place of birth where required for the preparation of a natal chart, astrological consultation or personalised product,
- information voluntarily provided by an individual for the purpose of providing a requested service,
- technical information relating to the use of the website, such as IP address, device type, browser and cookie-related information.
Kimstones generally does not receive or store full payment card details where payment is processed by an external payment service provider.
3. Purposes and legal bases for processing
Orders and performance of contracts
We use personal data to receive and process orders, produce or prepare products, provide services, process payments, arrange delivery, communicate with customers and handle returns, withdrawals, complaints and personalised products.
The legal basis is the performance of a contract or taking steps at the request of the data subject prior to entering into a contract.
Invoicing and legal obligations
We process data in order to comply with accounting, tax and other statutory obligations.
User accounts
If a user creates an account, we use their data to provide account functionality, order history and easier use of the online store.
Enquiries and communication
If you contact us by e-mail, telephone or contact form, we use the information provided to respond to your enquiry and for further communication.
Personalised products and services
For natal charts, astrological consultations or personalised products, we may process the information required to fulfil the order, including date, time and place of birth.
Newsletters and marketing communications
If an individual voluntarily subscribes to newsletters or promotional communications, we use their contact information for this purpose on the basis of consent where consent is required.
Consent may be withdrawn at any time.
Protection of our rights and prevention of misuse
Certain data may also be processed on the basis of our legitimate interests in maintaining the security of the website, preventing misuse and establishing, exercising or defending legal claims.
4. Special categories of personal data
In connection with certain individual services, a person may voluntarily disclose information that constitutes a special category of personal data, such as health-related information.
Please do not provide such information unless it is necessary for the provision of the requested service.
Where the processing of special categories of personal data is necessary, such data will only be processed where an appropriate legal basis exists and, where required, on the basis of the individual’s explicit consent.
5. Recipients of personal data
Where necessary for the relevant purpose, personal data may be disclosed to the following categories of recipients:
- website hosting and technical service providers,
- software and IT service providers,
- payment service providers and banks,
- delivery and postal service providers,
- accounting service providers,
- e-mail and communication service providers,
- newsletter service providers, where used,
- analytics and other online service providers where an appropriate legal basis exists,
- legal, tax and other professional advisers,
- public authorities and other authorised recipients where required by law.
Our processors may process personal data only in accordance with our instructions, contractual arrangements and applicable legislation.
6. Payments
Where payment is made through an external payment service provider, the information necessary to carry out the transaction is provided to that service provider.
Kimstones generally does not have access to your full payment card details.
External payment service providers may also process certain information as independent controllers in accordance with their own privacy policies.
7. Transfers outside the European Economic Area
Some providers of IT, payment, communication or other services may process personal data outside the European Economic Area.
Where such a transfer occurs, personal data will only be transferred in accordance with the GDPR and subject to appropriate safeguards, such as an adequacy decision of the European Commission or Standard Contractual Clauses.
8. Data retention
We retain personal data only for as long as necessary for the purpose for which it was collected or for as long as required by applicable legislation.
Information relating to orders, invoices and business transactions is retained in accordance with applicable tax and accounting requirements.
Information required for the performance of a contract is retained for the duration of the contractual relationship and afterwards for as long as necessary to comply with legal obligations or establish, exercise or defend possible legal claims.
Personal data processed on the basis of consent for direct marketing purposes is retained until consent is withdrawn or the individual unsubscribes.
When the purpose of processing ceases and there is no other legal basis for retaining the data, it is deleted or anonymised.
9. Cookies
The website uses cookies and similar technologies.
More detailed information about the cookies we use, their purposes, duration and how users can manage their preferences is available on the separate Cookies page.
10. Data security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.
Access to personal data is limited to persons and service providers who require it in order to perform their duties.
11. Your rights
Subject to the conditions laid down in the GDPR, you have the right to:
- access your personal data,
- have inaccurate or incomplete data corrected,
- request erasure of your personal data,
- request restriction of processing,
- object to processing,
- data portability,
- withdraw your consent at any time where processing is based on consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
12. Exercising your rights
Requests concerning your personal data may be sent to:
or by post to:
Društvo osebne rasti Vega / Società per la Crescita Personale-Vega
Fazanska ulica 2
6320 Portorož – Portorose
We will respond without undue delay and generally within one month of receiving the request. This period may be extended where permitted by the GDPR.
13. Right to lodge a complaint
If you believe that your personal data is being processed in breach of applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority:
Informacijski pooblaščenec Republike Slovenije – Information Commissioner of the Republic of Slovenia.
You may also contact us first at info@kimstones.com so that we can attempt to resolve the matter directly.
14. Automated decision-making
Kimstones does not use personal data for solely automated decision-making, including profiling, that produces legal effects concerning an individual or similarly significantly affects them.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time due to changes in legislation, our services or the way we process personal data.
Last updated: 1 June 2026