Privacy

Who is responsible

The data controller for this shop is:

Trading as

Tsuri Neko

Contact for privacy matters

hello@tsurineko.org

The controller is the Belgian company trading under this name. Its registration details are available on request from hello@tsurineko.org, and are provided to a supervisory authority on demand.

What we collect

We only collect what we need to take an order, deliver a parcel, comply with Belgian tax law, and run the website.

When you place an order

• Your name and delivery address
• Your email address (for the order confirmation and tracking link)
• Your phone number, if your carrier requires it for delivery
• What you ordered and the price you paid
• Stripe's payment reference (we do not see your card number; Stripe handles payment data directly)
• The campaign tags and the website you arrived from, if your visit carried any, kept with the order for the same period as the order
• Your answer to the optional 'How did you hear about us?' question

When you visit the site

• Server logs containing your IP address, browser, and the pages you requested (kept short-term for security and debugging)
• A session cookie that holds your language preference and links you to your cart. If your visit carried campaign tags or came from another website, it also remembers which; we use them for up to 30 days or until you close the browser
• Aggregate page-visit counts from Simple Analytics — it collects no IP address, sets no cookie, and cannot identify you
• Error reports when a script on a page fails: the error text, the address of the page and of the page you came from (stripped of query strings and order-link tokens), your browser and your IP address, sent to Honeybadger in the EU

If you write to us

When you email us, we keep that correspondence so we can follow up. We do not run a mailing list and we do not send marketing email.

Why we are allowed to process this

• Performance of a contract (Art. 6(1)(b) GDPR): processing your order and delivering it
• Legal obligation (Art. 6(1)(c) GDPR): keeping invoices and accounting records as required by Belgian law
• Legitimate interest (Art. 6(1)(f) GDPR): preventing fraud, securing the site, answering questions you send us, and learning which links and sites lead to orders
• Consent (Art. 6(1)(a) GDPR): for any non-essential cookies, where we ask before they load

Who else sees the data

We share the minimum needed with the processors that make the shop work. Each acts under a written data-processing agreement and is bound by the GDPR.

• Stripe (payment processing)
• Sendcloud and the carrier you choose at checkout (shipping label and tracking)
• Postmark (transactional email delivery)
• Render.com (hosting), Hetzner (object storage), Honeybadger (error tracking)
• Simple Analytics (aggregate visit statistics; collects no personal data)

We do not sell or rent your data. We do not transfer personal data outside the EU/EEA except where Stripe or Honeybadger route limited operational data under Standard Contractual Clauses.

How long we keep it

Invoices and order records are kept for 10 years after the year of the transaction, as required by Article 60 of the Belgian VAT Code.

Your cart (products and quantities, no name or address) is kept on our server and deleted 30 days after it last changed. The session cookie that links you to it expires when you close the browser.

If you ask us to delete your data sooner, we will. The exception is the invoice records the law requires us to keep.

Your rights

Under the GDPR you have the right to:

• Access the data we hold about you (Art. 15)
• Have inaccurate data corrected (Art. 16)
• Have your data deleted, within the limits set by law (Art. 17)
• Restrict or object to processing (Art. 18 and 21)
• Receive your data in a portable format (Art. 20)
• Withdraw consent at any time, where consent is the legal basis

To exercise any of these rights, write to hello@tsurineko.org. We will reply within one month.

Right to lodge a complaint

If you believe we are mishandling your data, you have the right to complain to the Belgian Data Protection Authority:

Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) · www.dataprotectionauthority.be

Cookies

We use a small number of strictly necessary cookies for the cart, the language switcher, and CSRF protection. When you look up your orders, a separate cookie keeps the email address you typed for up to ten minutes so the confirmation page can show it. It is deleted as soon as that page opens. We also run Simple Analytics for aggregate visit statistics — it sets no cookie, collects no IP address, and cannot identify you, so it needs no consent banner either. Beyond what the cart needs, the session cookie also remembers the campaign tags and referring website of your visit, which we use for up to 30 days or until you close the browser; we copy them onto your order to learn which links and sites bring in orders. We do not use advertising cookies and do not profile you across websites.