Privacy Policy

1. Who is responsible for your data?

The controller responsible for processing personal data through the Kaizgai online shop is:

Kaizgai
Berlin, Germany
Email: admin@kaizgai.com

You can contact us using these details with any questions about this policy or your personal data.

2. What we collect and why

We process personal data for the following purposes:

• Orders, delivery and returns: Your name, billing and delivery addresses, email address and order details help us process purchases, arrange delivery, handle returns and provide refunds. The legal basis is performance of a contract or steps taken before entering into a contract, under Art. 6(1)(b) GDPR.
• Customer accounts: We process your email address, account details and authentication information to provide account registration, secure sign-in and access to your orders. The legal basis is Art. 6(1)(b) GDPR.
• Payments: Our payment provider processes the information needed to complete your payment. We receive transaction information needed to confirm and manage your purchase. We do not store full payment-card numbers. The legal basis for our payment processing is Art. 6(1)(b) GDPR.
• Customer communications: We use your contact details and relevant order information to send order confirmations, delivery updates and responses to purchase-related enquiries under Art. 6(1)(b) GDPR. For other enquiries, we rely on our legitimate interest in responding to communications under Art. 6(1)(f) GDPR.
• Website operation and security: Technical information, including your IP address, request time and requested resources, is processed to deliver the website, investigate errors and protect against misuse. The legal basis is our legitimate interest in maintaining a secure and reliable online shop under Art. 6(1)(f) GDPR.
• Website analytics: With your consent, we use Google Analytics to understand how visitors use the site — for example, pages viewed, device type and approximate location derived from a truncated IP address — so we can improve it. Analytics cookies are set only after you accept them in our cookie banner. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time.
• Legal obligations: We retain and process relevant transaction records to meet applicable accounting and tax requirements under Art. 6(1)(c) GDPR.

Information necessary to process your purchase must be provided for us to fulfil your order.

3. Cookies and similar technologies

We use cookies and similar technologies to support essential functions, such as maintaining your shopping cart and managing secure sign-in sessions.

Where storage or access is strictly necessary to provide a service you expressly request, we rely on the exemption in §25(2) no. 2 TDDDG. Any associated personal-data processing is based on the relevant legal basis described in this policy.

Our payment integration may also use cookies or similar technologies. Any technologies requiring consent will only be activated after that consent has been obtained.

With your consent, we use Google Analytics (a service provided by Google) to measure and analyse how our website is used. These analytics cookies are set only after you select “Accept all” in our cookie banner; if you choose “Necessary only”, no analytics cookies are set. The legal basis is your consent under Art. 6(1)(a) GDPR and §25(1) TDDDG. You can review or withdraw your consent at any time via the “Cookie preferences” link in the footer; withdrawal does not affect processing carried out beforehand. We do not use cookies for advertising.

The cookies and similar technologies we rely on:

• ory_session_* (provider: Ory) — keeps you securely signed in to your account. Duration: for the session / as configured by the sign-in provider.
• kaizgai_cart (first-party) — remembers the contents of your shopping cart. Stored httpOnly; persists until your order is completed or the cart is cleared.
• __stripe_mid, __stripe_sid (provider: Stripe) — set during checkout for payment fraud prevention. Duration: up to 1 year (__stripe_mid) and around 30 minutes (__stripe_sid).
• _ga, _ga_<id> (provider: Google Analytics) — set only with your consent to distinguish visitors and sessions for aggregate usage statistics. Duration: up to 2 years.

You can manage cookies through your browser settings. Blocking essential cookies may affect account, cart or checkout functions.

4. Service providers and other recipients

We share relevant personal data with providers involved in operating the shop and fulfilling your purchase.

We also share the delivery details necessary to fulfil your order with our shipping providers.

Where providers process personal data on our behalf, we enter into data processing agreements as required by Art. 28 GDPR. Some providers, including Stripe for certain activities, also process data as independent controllers under their own privacy notices.

5. International data transfers

Some providers or their subcontractors may process personal data outside the European Economic Area (EEA). Hosting the website in the EU does not necessarily mean that all related processing takes place within the EEA.

Where required, transfers rely on an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and any necessary supplementary measures.

You can contact us for further information about the safeguards used and how to obtain a copy.

6. How long we keep your data

We retain personal data for the period needed for its stated purpose, subject to applicable legal requirements.

• Invoices and accounting vouchers: Generally eight years, calculated from the end of the relevant calendar year.
• Other statutory records: Applicable retention periods may be six or ten years, depending on the record.
• Account data: For the duration of your account, followed by deletion when no longer required. Records subject to legal retention obligations are retained separately.
• Customer enquiries: Until the enquiry is resolved and any applicable retention or legal-claims period has expired.
• Technical logs: up to 14 days, unless longer retention is necessary to investigate a security incident or establish, exercise or defend legal claims.

After the applicable period expires, personal data is deleted or anonymised.

7. Your rights

Subject to the conditions set out in the GDPR, you have the right to:

• access your personal data and obtain a copy;
• correct inaccurate or incomplete data;
• request deletion of your data;
• request restriction of processing;
• receive certain data in a portable format;
• withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right to object: Where we process personal data based on legitimate interests, you may object on grounds relating to your particular situation under Art. 21 GDPR. We will stop that processing unless a statutory exception permits us to continue.

To exercise your rights, contact admin@kaizgai.com.

You also have the right to lodge a complaint with a data protection supervisory authority, particularly in the EU Member State where you habitually live, work or where you believe an infringement has occurred.