Privacy policy
Last updated: 23 July 2025
Japan Essence operates this shop and website, including all related information, content, features, tools, products and services, to provide you—our customer—with a personalised shopping experience (the “Services”). Japan Essence is built on Shopify, which enables us to provide the Services.
This Privacy Policy explains how we collect, use and disclose personal data when you visit or use the website, make a purchase or other transaction through the Services, or otherwise communicate with us.
If any provision of our Terms and Conditions conflicts with this Privacy Policy, the Privacy Policy prevails for all matters relating to the collection, processing and disclosure of your personal data.
Please read this Privacy Policy carefully. By accessing or using any of the Services you confirm that you have read it and consent to the collection, use and disclosure of your information as described below.
What personal data do we collect or process?
“Personal data” means information that identifies you or can be directly linked to you. It does not include data collected anonymously or anonymised so that you cannot be identified. Depending on how you interact with the Services, where you live and what applicable law permits or requires, we may collect or process the following categories of personal data (including inferences drawn from them):
| Category | Examples |
|---|---|
| Contact data | Name, postal address, billing address, shipping address, phone number, e‑mail address |
| Financial data | Credit, debit and bank‑account numbers; payment‑card details; account information; transaction details; payment method and confirmation |
| Account data | Username, password, security questions, configurations and settings |
| Transaction data | Items viewed, added to cart, wish‑listed, purchased, returned, exchanged or cancelled; past transactions |
| Communications | Information provided when you contact us—for example, in customer‑support requests |
| Device data | Device, browser and network information, IP address, other unique identifiers |
| Usage data | How and when you browse or interact with the Services |
Sources of personal data
| Source | Description |
|---|---|
| Directly from you | When you create an account, access or use the Services, communicate with us, or otherwise provide data |
| Automatically via the Services | From your device, via cookies and similar technologies, or when you use our products, Services or website |
| From service providers | When providers collect or process personal data on our behalf (e.g. payment processors, analytics, hosting) |
| From partners & other third parties | Business or marketing partners who share information in accordance with their privacy notices |
How do we use your personal data?
| Purpose | Details |
|---|---|
| Provide, tailor & improve the Services | Fulfilling contracts, processing payments, executing orders, storing configurations and items of interest, sending account‑related notifications, managing accounts, arranging shipping, handling returns/exchanges, enabling reviews and creating a personalised shopping experience (e.g. product recommendations) |
| Marketing & advertising | Sending marketing and promotional messages via e‑mail, SMS or post; showing ads for products or services on our site or others, including based on past purchases, cart contents or other activity |
| Security & fraud prevention | Authenticating accounts; providing secure payment and shopping; detecting, investigating and acting on potential fraud, illegal or malicious activity; protecting public safety and securing the Services |
| Communication | Providing customer support, responding promptly to enquiries, maintaining our business relationship |
| Legal compliance | Fulfilling legal obligations, responding to lawful requests, investigating or participating in legal proceedings, enforcing our terms and policies |
How do we disclose personal data?
We may share personal data for legitimate purposes under this Privacy Policy, including:
-
Service providers (e.g. IT, payment processing, analytics, customer support, cloud storage, fulfilment, shipping) acting on our behalf.
-
Business & marketing partners that deliver marketing services and display advertising. Shopify, for example, supports personalised ads with third‑party tools based on your activity across merchants and websites. These partners use data under their own privacy policies. Depending on your location, you may have the right to opt out of such sharing for targeted advertising.
-
At your request or with your consent (e.g. to deliver products, use social‑media widgets or login integrations).
-
Affiliates / corporate group members.
-
In business transactions (e.g. merger, bankruptcy), to comply with legal obligations, enforce terms or protect rights and safety.
Key third‑party providers & tools
| Tool | Provider & Purpose | Legal basis, retention, opt‑out |
|---|---|---|
| Cloudflare | Cloudflare Inc., USA – security & performance (e.g. faster loading) | Legitimate interest (Art. 6 (1)(f) GDPR); processing agreement in place |
| Meta Pixel | Meta Platforms Ireland Ltd. – conversion tracking, audience building, ad optimisation | Consent (Art. 6 (1)(a) GDPR; § 165(3) TKG 2021); data stored up to 2 years; opt‑out via cookie banner or Facebook ad settings |
| Meta Custom Audiences | Meta Platforms Ireland Ltd. – remarketing to customers/visitors, look‑alike audiences | Same legal basis as above; customer lists deleted after 180 days or on withdrawal |
| Google Analytics 4 | Google Ireland Ltd. – reach & performance analysis | Consent; IP anonymisation active; standard retention 14 months; opt‑out via cookie banner or browser add‑on |
| Google Tag Manager | Google Ireland Ltd. – tag management (itself stores no personal data) | Legitimate interest; disabling tracking tools in cookie banner also blocks Tag Manager where technically possible |
| PayPal | PayPal (Europe) S.à r.l. et Cie, Luxembourg – payment processing | Contract fulfilment (Art. 6 (1)(b) GDPR) |
| Shopify Payments | Shopify International Ltd., Ireland – payment; may involve Klarna, Stripe etc. | Contract fulfilment (Art. 6 (1)(b) GDPR) |
Relationship with Shopify
The Services are hosted by Shopify, which collects and processes personal data about your access to and use of the Services to provide and improve them. Data you submit may be transferred to Shopify and to third parties in countries other than your own.
We also use certain advanced Shopify features that draw on data from your interactions with our shop, other merchants and Shopify itself. For these purposes, Shopify is responsible for processing your personal data, including responding to requests to exercise your rights.
For more on how Shopify uses your data and your rights, please see Shopify’s Consumer Privacy Policy and the Shopify Privacy Portal.
Third‑party websites & links
The Services may contain links to websites or online platforms operated by third parties. When following such links you should review their privacy, security policies and terms. We are not responsible for the privacy or security of these sites, nor for the accuracy, completeness or reliability of information on them.
Information you provide in public or semi‑public areas—including social‑network platforms—may be viewed by others without limitation. Our inclusion of links does not imply endorsement unless expressly stated.
Children’s data
The Services are not intended for children, and we do not knowingly collect personal data from anyone who is not of legal age in their country. If you are a parent or guardian of a child who has provided personal data, please contact us to request deletion. To our knowledge, we do not “sell” or “share” personal data of persons under 16 years as those terms are defined by applicable law.
Security & retention
While we employ appropriate safeguards, no security measures are perfect and we cannot guarantee “perfect security.” Data transmission also carries inherent risks.
How long we retain personal data depends on factors such as account management, service provision, legal obligations, dispute resolution and enforcement of contracts and policies.
Your rights & choices
Depending on where you reside, you may have some or all of the following rights (subject to legal exceptions and limitations):
-
Access – request to see the personal data we hold about you.
-
Deletion – request deletion of personal data we hold.
-
Rectification – request correction of inaccurate personal data.
-
Data portability – receive a copy of your personal data and, in certain cases, have it transmitted to a third party.
-
Manage communications – opt out of marketing e‑mails at any time via the unsubscribe link (non‑marketing e‑mails, e.g. about orders, may still be sent).
If you reside in the UK or EEA you may also have:
-
Right to object / restrict processing for certain purposes.
-
Withdrawal of consent – where processing relies on consent, you may withdraw it; this does not affect prior lawful processing.
You can exercise these rights within the Services where indicated or by contacting us (see “Contact” below). Exercising rights will not disadvantage you. We may need to verify your identity before acting on a request. You may authorise an agent to act for you; we will seek proof of authorisation and may require direct confirmation from you. We will respond promptly as required by law.
Complaints
If you have concerns about how we process your personal data, please contact us first (see below). Depending on your location, you may have the right to appeal our decision or lodge a complaint with the relevant data‑protection authority (a list of EEA supervisory authorities is available online).
International transfers
We may transfer, store and process your personal data outside your country of residence.
For transfers from the EEA or UK we rely on recognised mechanisms such as the EU Standard Contractual Clauses or equivalent UK contracts, unless the destination country has an approved adequate level of protection.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time—for example, to reflect changes in our practices or for operational, legal or regulatory reasons. We will post the revised policy on this site, update the “Last updated” date and provide any notices required by law.
Contact
If you have questions about our privacy practices or this Privacy Policy, or wish to exercise any of your rights, please contact us:
-
E‑mail: office@japan‑essence.com
-
Post: Schalkham 12, 5202 Neumarkt, Austria
For the purposes of applicable data‑protection laws, Japan Essence is the data controller for your personal data.