Privacy Policy

The controller of your personal data is [TO CONFIRM: legal entity name], trading as KTN, [TO CONFIRM: registered address (Shopify currently shows: Rakez Business Center, Bangkok 10150, Thailand)] ("we", "us"). You can contact us about privacy at [TO CONFIRM: customer service email (Shopify currently shows contact@vinylacy.com)].

The seller details shown at checkout give an address in Thailand. Because we offer our products to people in the European Union and the United Kingdom, the EU General Data Protection Regulation (GDPR), the UK GDPR and the Thai Personal Data Protection Act B.E. 2562 (PDPA) may apply to our processing, together with other privacy laws where you live. Your katana is made and shipped from China, so the data our forge processes there is also subject to the Personal Information Protection Law of the People's Republic of China (PIPL).

Representative in the European Union: [TO CONFIRM: GDPR Article 27 representative in the EU, if required]. Representative in the United Kingdom: [TO CONFIRM: UK GDPR representative, if required].

This policy applies to the KTN online store at ktn-2949.myshopify.com, including the 3D configurator, the checkout, your customer account, our emails and newsletter, and the messages you send us. It does not cover third party websites you reach through links on the store.

• Identity and contact: name, email address, phone number, billing and delivery addresses.
• Order data: products and configurations, prices, order history, delivery and tracking information, returns, and the customs information needed for export and import.
• Age, identity and permit checks: the confirmation you tick in the configurator that you are of age and may lawfully buy and own a katana, and, where required for your country or where we have a doubt about your age, a copy of an identity document or of a permit or authorisation (for example an import permit). We ask for these only where needed and do not use them for anything else.
• Payment data: payment method, transaction reference, status and amount. Card numbers are entered directly with our payment providers; we do not receive or store your full card details.
• Account data: login email, encrypted password and preferences, if you create an account.
• Communications: the content of your messages, emails and contact form submissions, and our replies.
• Newsletter: your email address and the record of your consent, if you subscribe.
• Technical and usage data: IP address, approximate location derived from it, device and browser type, pages viewed, interactions with the store and the configurator, and data collected by cookies and similar technologies (Article 8).

Most of this data comes from you. Some comes from our providers, such as our payment providers (payment status, fraud signals) and carriers (delivery status).

Under the GDPR and the UK GDPR we must have a legal basis for each use of your data. The table below sets out our purposes, the data involved, the legal basis and how long we keep it.

We do not use your data for automated decisions that produce legal effects for you.

A katana is a regulated item in many countries. Before shipping we may need to confirm that you are of age and, in some countries, that you hold an import or possession permit. We ask only for what is needed, we limit access to the people handling your order, we do not use these documents for marketing, and we delete them [TO CONFIRM: how long ID and permit copies are kept]. For every order, you confirm your age by ticking a box in the configurator before adding a katana to your cart.

An identity document can include data you do not need to show us, such as an ID number or a photograph that is not needed for the check. You may mask that data before sending it, as long as your name, date of birth and the validity of the document remain visible.

We share your data only with recipients who need it, and we require our processors to protect it:

• Shopify, which hosts the store, the checkout and our customer data and provides store analytics. Shopify acts as our processor and, for some features, as an independent controller; see the Shopify Privacy Policy and the Shopify Privacy Portal.
• Payment providers, which process your payment and carry out fraud checks: [TO CONFIRM: accepted payment methods (the footer currently shows PayPal)].
• Carriers and customs brokers, which transport the parcel and clear it through customs: [TO CONFIRM: carrier or forwarder that accepts katanas shipped from China].
• Customs and tax authorities of China, which receive the export declaration, and of your country, which receive the import declaration.
• Content delivery networks that deliver fonts and scripts to your browser, including Google Fonts and jsDelivr. They receive your IP address when your browser loads these files.
• Analytics or advertising tools: [TO CONFIRM: analytics or advertising tools beyond Shopify (the Shopify custom pixel content is unknown)].
• Our forge in China, which makes, packs and ships your katana. It receives the configuration of your order, your name, delivery address, phone number and email, and, where your country requires one, the permit details that must travel with the parcel. It uses them only to produce your katana, prepare the export declaration and hand the parcel to the carrier.
• Professional advisers (lawyers, accountants) and public authorities, when the law requires it or to establish, exercise or defend legal claims.
• A buyer or successor, if our business is sold or restructured, under the same protections.

We do not sell your personal data. We do not share it for cross context behavioural advertising unless you have given your consent where it is required.

Your data is processed in several countries: China, where our forge makes and ships your katana; Thailand, the address in our seller details; and Canada, the United States and the European Union, where our platform and providers operate.

Transfer to China. To make and ship your order, we send your order and delivery details to our forge in China (Article 6). China has no adequacy decision from the European Commission or the United Kingdom. Under Articles 44 to 49 of the GDPR and the UK GDPR, we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) and, for data from the United Kingdom, the UK International Data Transfer Addendum, signed with the forge. [TO CONFIRM: Standard Contractual Clauses signed with the forge in China, and the transfer risk assessment]. The forge must use the data only for your order, protect it and delete it when it is no longer needed. In China it is also bound by the PIPL. Public authorities in China, as in other countries, may have powers to request access to data held there.

Other transfers. When we transfer personal data from the European Economic Area or the United Kingdom to any other country without an adequacy decision, we rely on the same safeguards, or on another mechanism permitted by law.

You can ask us for a copy of the relevant safeguards at [TO CONFIRM: customer service email (Shopify currently shows contact@vinylacy.com)].

Cookies are small files placed on your device. We also use your browser's local storage for some preferences. Where the law requires it, for example in the European Union and the United Kingdom, we ask for your consent before using non essential cookies, through the cookie banner shown on your first visit. You can change your choice at any time through that banner or in your browser settings.

If your browser sends a Global Privacy Control signal, Shopify treats it as a request to opt out of the sale or sharing of your data for targeted advertising, where the law of your place of residence provides for it.

We keep personal data only for as long as needed for the purposes in Article 4, then we delete or anonymise it. Order records: [TO CONFIRM: how long order records are kept]. Copies of identity documents and permits: [TO CONFIRM: how long ID and permit copies are kept]. Accounting records: for the period required by law. Newsletter: until you unsubscribe. Messages: for as long as needed to handle your request and any follow up.

Depending on where you live, you have some or all of the following rights:

• Access: obtain a copy of the personal data we hold about you.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted, unless we must keep it, for example for tax law.
• Restriction: ask us to limit the use of your data in certain cases.
• Portability: receive the data you gave us in a structured, machine readable format, or have it sent to another controller.
• Objection: object at any time to processing based on our legitimate interest, and to direct marketing without having to give a reason.
• Withdrawal of consent: withdraw your consent at any time, without affecting processing carried out before.
• Complaint: lodge a complaint with a supervisory authority (Article 13).

Residents of some US states, such as California, have similar rights to know, delete and correct their data and to opt out of its sale or sharing; we do not sell personal data. The Thai PDPA gives comparable rights to people in Thailand.

To exercise a right, write to [TO CONFIRM: customer service email (Shopify currently shows contact@vinylacy.com)]. We may need to verify your identity. We reply within one month, which can be extended by two further months for complex requests, as the GDPR allows. Exercising your rights is free, and we will never treat you differently for doing so.

Our store is for adults only. We do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.

We use the security measures of our platform and providers, including encrypted connections (HTTPS), access controls and payment processing that meets card industry standards, and we limit access to personal data to the people who need it. No system is completely secure: if a breach affects your data and creates a risk for you, we will inform you and the authorities as the law requires.

We would like to hear from you first at [TO CONFIRM: customer service email (Shopify currently shows contact@vinylacy.com)]. You also have the right to complain to a data protection authority, in particular:

• in the European Economic Area, the authority of the country where you live or work, or where the issue arose (list on the European Data Protection Board website);
• in the United Kingdom, the Information Commissioner's Office (ico.org.uk);
• in Thailand, the Personal Data Protection Committee (pdpc.or.th).

We may update this policy to reflect changes in our services, our providers or the law. The date of the latest update is shown at the top of this page. If a change is significant, we will tell you by email or on the store before it takes effect.

This page replaces the standard privacy policy generated by our platform. [TO CONFIRM: align or replace the Shopify privacy policy at /policies/privacy-policy, which still lists contact@vinylacy.com]