Privacy and Cookies Policy

Last updated: August 8, 2026

1. Personal data controller

The personal data controller is X5 Brands spółka z ograniczoną odpowiedzialnością with its registered office at ul. Hoża 29, 00-521 Warsaw, entered into the register of entrepreneurs of the National Court Register under KRS number 0000888195, NIP 7011024054, hereinafter referred to as "Controller" or "Kinora".

Contact regarding personal data protection is possible via e-mail: hello@kinora.video.

This policy applies to the website available at kinora.video, communication conducted via WhatsApp Business, and the fulfillment of orders for individual animated films.

2. What data we process

Depending on how you use the service and the scope of the order, we may process:

  1. contact details, in particular first name, last name, telephone number and e-mail address;

  2. billing data and data necessary for issuing an invoice;

  3. the content of correspondence conducted via WhatsApp, e-mail or other agreed channels;

  4. information about the order, payment, delivery date and selected film version;

  5. photographs, video recordings, voice messages and other materials provided for the purpose of creating the film;

  6. names, descriptions of appearance, relationships, events and memories regarding the film's characters;

  7. technical data related to the use of the website, such as IP address, device type, internet identifiers, browser information and activity on the service;

  8. in the case of voluntarily provided opinions or reactions – the content of the opinion, image and voice of the client.

The Controller does not use provided photographs for automatic identity recognition or the creation of biometric databases.

3. Special categories of data

The client should not provide information regarding health, ethnic origin, religion, political views, sexual life or other special categories of data if they are not necessary for the production of the film.

If the use of such information is necessary, the client should first obtain explicit consent from the person concerned and inform the Controller about the nature of the data provided.

The Controller may refuse to use materials that are excessive, illegal, violate the privacy of another person or are not necessary to fulfill the order.

4. Purposes and legal bases of processing

Data may be processed for the following purposes:

  1. to answer a question and prepare an offer – based on Article 6(1)(b) of the GDPR;

  2. to conclude and perform a contract for the preparation of the film – based on Article 6(1)(b) of the GDPR;

  3. to create a film based on provided photographs, recordings and information – based on Article 6(1)(b) of the GDPR in relation to the client and Article 6(1)(f) of the GDPR in relation to other persons depicted in the materials;

  4. to handle payments and accounting documentation – based on Article 6(1)(b) and (c) of the GDPR;

  5. to consider complaints, establish, assert or defend against claims – based on Article 6(1)(f) of the GDPR;

  6. to ensure website security, prevent abuses and maintain basic technical documentation – based on Article 6(1)(f) of the GDPR;

  7. to conduct marketing measurements, remarketing and personalization of advertisements – only after obtaining consent, based on Article 6(1)(a) of the GDPR and Article 399 of the Electronic Communications Law;

  8. to publish opinions, reactions, image or film fragments – solely based on separate authorization or an agreement concluded with the person whose materials are concerned.

The Controller's legitimate interest is the proper fulfillment of the order, ensuring the security of services, handling correspondence, and protection against claims.

5. Materials concerning other persons

The client may provide photographs, recordings and information about other persons only if they are authorized to do so.

The client should, in particular:

  1. ensure that they can legally provide the materials to the Controller;

  2. inform the depicted persons about the planned use of their data, unless the nature of the gift justifies providing this information later;

  3. not provide materials obtained illegally or violating privacy;

  4. have appropriate authorization for materials depicting children;

  5. upon request of the Controller, confirm possession of the required consents or authorizations.

Materials provided for the purpose of preparing a gift are not published by the Controller and are used solely for the fulfillment of a specific order.

A person depicted in the materials may contact the Controller at hello@kinora.video and request information, restriction of processing or deletion of their data.

6. Children's data

Orders can only be placed by adults.

Materials depicting children may be used only to the extent necessary for the fulfillment of the order and provided that the client is a parent, legal guardian or has appropriate permission from the authorized person.

The Controller exercises increased caution when processing images of children and may refuse to use the material if there are doubts regarding its origin, nature or the client's authorization.

7. Use of artificial intelligence tools

When creating the film, the Controller and authorized contractors may use specialized tools for generating or transforming images, animations, text and sound.

These may include, in particular, services provided by OpenAI, Google and other providers of professional generative artificial intelligence tools selected for the implementation of a given project.

Only the scope of materials necessary for a specific stage of the film is transferred to AI tools. Where possible, materials are limited, pseudonymized or stripped of direct contact details.

The Controller cannot use a tool that by default publishes client materials without first enabling appropriate privacy settings and checking the data processing principles of the provider.

Information about current providers of tools used for a specific order can be obtained by the client at hello@kinora.video.

8. Data recipients

Data may be transferred only to the extent necessary to:

  1. employees and associates producing the film;

  2. entities providing editing, animation, graphics and video production services;

  3. hosting, domain, security and website infrastructure providers, in particular Shopify and Cloudflare;

  4. email, drive, spreadsheet and collaboration tool providers within Google Workspace;

  5. WhatsApp Business messenger provider and Meta group entities;

  6. payment operators, in particular Stripe and PayPro/Przelewy24, as well as Apple Pay and Google Pay method providers;

  7. the company providing accounting services to the Controller;

  8. providers of generative artificial intelligence tools;

  9. law firms, insurers and competent authorities, when necessary to protect the Controller's rights or fulfill a legal obligation.

Collaborators are only granted access to the folder pertaining to a specific order. Before allowing a contractor access to the data, the Controller enters into an appropriate confidentiality and data processing agreement.

9. Transfer of data outside the European Economic Area

Some technology service providers and contractors may operate outside the European Economic Area, in particular in the United States or Ukraine.

Data transfer outside the EEA may only take place after ensuring the required legal basis, for example:

  1. on the basis of an adequacy decision by the European Commission;

  2. on the basis of standard contractual clauses approved by the European Commission;

  3. using other mechanisms provided for by the GDPR.

The scope of data transferred is limited to the minimum necessary to perform a specific task.

10. Data retention period

We store data for the following periods:

  1. correspondence regarding an inquiry that did not result in an order – up to 12 months from the last contact;

  2. photographs, recordings, voice messages and source materials – up to 30 days from the delivery of the finished film;

  3. the finished film – for 30 days from its delivery, to allow re-downloading;

  4. materials in backup copies – no longer than 90 days from their deletion from active systems;

  5. correspondence and documentation regarding a fulfilled order – until the expiration of the limitation periods for possible claims;

  6. accounting and tax documentation – for the period required by applicable regulations;

  7. data processed based on consent – until its withdrawal or earlier cessation of the processing purpose.

Materials may be retained longer if necessary for the consideration of a complaint, performance of a legal obligation or establishment, exercise or defense of claims.

11. Reviews, reactions and promotional materials

The finished film and client materials are private by default.

The Controller does not publish the film, photographs or information about the characters on the website, social media, portfolio or advertisements without separate permission or agreement.

The terms of use for opinions, video reactions or film fragments, including publication channels, period of use and any remuneration or reciprocal consideration, are always determined separately.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Upon receipt of an effective request, the Controller ceases new use of the materials and removes them from channels controlled by them, taking into account the time technically needed to fulfill the request.

12. Payments

Payments can be made via bank transfer or through Stripe or Przelewy24, including using BLIK, Apple Pay or Google Pay, if the respective method is available.

The payment operator receives the data necessary for authorization and settlement of the transaction. The Controller does not receive full payment card data of the client.

The payment operator may process some data as an independent controller in accordance with its own privacy policy.

13. Contact via WhatsApp Business

Contact with Kinora can be made via WhatsApp Business. By using this channel, the user provides at least their phone number, profile name, message content, and uploaded files.

WhatsApp and Meta group entities may also process technical data related to the use of the messenger in accordance with their own terms and privacy policy.

Voice calls made with Kinora are not recorded. If a call were to be recorded in the future, the client would be informed before recording begins.

14. Cookies

The service uses cookies and similar technologies.

Cookies can be divided into:

  1. essential – necessary for the website to function, ensure security, remember settings and support basic Shopify functions;

  2. functional – used to remember additional preferences;

  3. analytical – used to measure how the website is used;

  4. advertising – used to measure ad effectiveness, remarketing and customize advertising messages.

Essential cookies may be used without consent if they are necessary to provide a service requested by the user.

Analytical and advertising cookies are activated only after obtaining user consent. Closing the banner without making a selection does not imply consent.

15. Meta Pixel

After obtaining consent, the service may use Meta Pixel provided by Meta Platforms Ireland Limited.

Meta Pixel allows measuring ad effectiveness, creating statistics, and targeting ads to people who have visited the site or performed specific actions.

In connection with the use of Meta Pixel, Meta may receive information such as IP address, device ID, browser information, visited subpages, and performed actions.

Meta may use this data in accordance with its own rules and combine it with information it holds in connection with the user's account in Meta services.

Lack of consent for advertising cookies does not limit the ability to view the offer or contact Kinora.

16. Managing cookie consent

Upon first visit, the user can:

  1. accept all optional cookies;

  2. reject all optional cookies;

  3. configure selected categories.

Consent can be changed or withdrawn at any time using the "Cookie Settings" link available in the footer of the page.

Withdrawal of consent does not affect the lawfulness of actions performed before its withdrawal.

The Controller will update this policy and settings panel before launching further analytical or advertising tools, such as Google Analytics, TikTok Pixel or Hotjar.

17. Rights of individuals

The data subject may have the following rights:

  1. access to data and obtaining a copy thereof;

  2. rectification of data;

  3. erasure of data;

  4. restriction of processing;

  5. data portability;

  6. to object to processing based on legitimate interest;

  7. to withdraw consent at any time;

  8. to lodge a complaint with the President of the Personal Data Protection Office.

Requests can be sent to hello@kinora.video.

Before fulfilling the request, the Controller may ask for additional information necessary to confirm the identity of the applicant.

18. Profiling and automated decisions

After granting consent, data on website activity may be used to create audience groups and personalize ads.

The Controller does not make decisions regarding the client based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them.

19. Security

The Controller applies organizational and technical measures appropriate to the nature of the processed data.

In particular, contractor access is limited to the specific client's folder, and finished materials are made available via links with restricted access.

Individuals granted access to data are obliged to maintain confidentiality. The Administrator regularly reviews access scopes and revokes them upon termination of cooperation or completion of an order.

20. Policy Changes

The policy may be updated due to changes in service delivery methods, implementation of new tools, commencement of operations in new countries, or changes in applicable regulations.

The current version is always published on kinora.video.