GDPR Privacy & Data Protection Policy
HEARTHLIN · DATA PROTECTION
GDPR Privacy & Data Protection Policy
Your Personal Information. Your Rights. Our Commitment.
Learn how hearthlin collects, uses, stores and protects personal information and how individuals can exercise their data protection rights under applicable privacy laws.
1. Introduction
At hearthlin, we respect the privacy of our customers and website visitors. We recognize that personal information is important and that individuals should have meaningful control over how their information is collected, used and shared.
This GDPR Privacy & Data Protection Policy explains how hearthlin handles personal information in connection with our website, online store, product purchases, customer service communications and related services.
Where the General Data Protection Regulation (GDPR) applies, we aim to process personal information in accordance with its principles and applicable data protection requirements.
This policy also explains the rights that may be available to individuals located in the European Economic Area (EEA) and other jurisdictions where equivalent data protection laws apply.
2. Who Is Responsible for Your Personal Information?
For the purposes of this policy, the business operating the hearthlin online store is responsible for handling personal information in connection with the relevant website and customer transactions, where it acts as a data controller under applicable data protection law.
Brand:
hearthlin
Business Address:
4-1-15-311 Higashinakajima,
Higashiyodogawa-ku, Osaka-shi,
Osaka 533-0033, Japan
Privacy Contact:
gloqora@hearthlin.com
Phone:
+81 (708) 926 98 36
If you have questions about personal information, privacy rights or data protection requests, you may contact us using the information above.
A formal EU representative or Data Protection Officer will be identified separately if required under applicable law. No representative appointment or DPO designation is implied by this policy.
3. What Personal Information May We Collect?
The information we collect depends on how you interact with our website and services.
3.1 Identity and Contact Information
Information may include your name, email address, telephone number, billing address and delivery address.
3.2 Order and Transaction Information
Information may include purchased products, quantities, order references, transaction status, shipping details, return requests and refund-related records.
3.3 Payment-Related Information
Payment-related information may be processed by payment service providers to complete transactions and support payment verification. The information available to us depends on the payment method and provider.
3.4 Customer Service Communications
Information may include emails, customer inquiries, complaints, product questions, return requests, photographs and other information voluntarily provided during communications.
3.5 Technical and Device Information
Depending on website technologies and your privacy choices, information may include IP addresses, browser types, device characteristics, operating systems, approximate location data and website interaction information.
3.6 Cookie and Usage Information
Where permitted, we may collect information through cookies, pixels, local storage and similar technologies to support website functionality, analytics and marketing activities.
4. Why Do We Process Personal Information?
We process personal information for purposes connected with operating our online store and providing customer services.
Order Processing and Fulfillment
To receive orders, process purchases, arrange delivery, manage transactions and provide order-related information.
Customer Support
To respond to questions, resolve complaints, review product concerns and assist with returns, refunds and other requests.
Website Operation and Improvement
To maintain website functionality, improve navigation, understand visitor interactions and identify technical issues.
Security and Fraud Prevention
To help detect suspicious activity, protect transactions, maintain website security and safeguard legitimate business interests.
Marketing and Communication
Where permitted and based on an appropriate legal basis, to provide promotional communications, measure marketing activities and understand customer preferences.
Legal and Regulatory Obligations
To maintain appropriate records, respond to lawful requests and meet applicable legal or regulatory requirements.
5. Legal Bases for Processing Under GDPR
Where GDPR applies, we process personal information only when an appropriate legal basis is available under applicable law. Depending on the circumstances, these legal bases may include:
5.1 Performance of a Contract
Processing may be necessary to fulfill an order, complete a purchase, arrange delivery, provide customer support or take steps requested before entering into a contract.
5.2 Legal Obligations
Processing may be necessary to comply with legal requirements, including applicable accounting, tax, consumer protection and regulatory obligations.
5.3 Legitimate Interests
Processing may be necessary for legitimate business interests, such as website security, fraud prevention, service improvement and defending legal claims, provided that these interests do not override applicable individual rights and freedoms.
5.4 Consent
Where required, we rely on your consent for certain activities, such as non-essential cookies, certain analytics technologies and direct electronic marketing.
5.5 Other Applicable Legal Bases
Where applicable, processing may also be permitted under other legal grounds recognized by relevant data protection laws.
The applicable legal basis depends on the specific processing activity and circumstances. We do not rely on every legal basis for every category of information.
6. When Is Providing Personal Information Necessary?
Certain personal information is necessary to provide specific services, while other information may be optional.
For example, accurate contact, billing and delivery information may be required to process and fulfill an order. If required information is not provided, we may be unable to complete the relevant transaction or provide the requested service.
Information used for optional marketing or non-essential website personalization is generally not required to complete a standard purchase.
Where consent is the legal basis, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
7. How We Share Personal Information
We may share relevant personal information with third parties when necessary to operate our online store, fulfill orders, provide services or meet legal obligations.
E-Commerce and Website Service Providers
Service providers may process information to support website hosting, online store functionality, checkout and technical maintenance.
Payment Service Providers
Payment providers may receive relevant transaction information to process payments, verify transactions and support payment security.
Delivery and Fulfillment Service Providers
Relevant customer and order details may be shared with service providers involved in order preparation, delivery coordination and fulfillment.
Analytics and Marketing Providers
Where permitted, certain information may be shared with analytics and advertising providers to measure website activity and marketing performance.
Professional Advisers
Information may be disclosed to professional advisers where reasonably necessary for accounting, legal, compliance or business administration purposes.
Authorities and Legal Recipients
Information may be disclosed where required or permitted by law, court orders, regulatory requests or to protect legal rights.
Where third parties process information on our behalf, we aim to use appropriate contractual and organizational arrangements consistent with applicable data protection requirements.
8. International Data Transfers
hearthlin is associated with a business address in Japan. Depending on the service providers used and how our website operates, personal information collected from individuals in the EEA may be transferred to or accessed from countries outside the EEA.
Where GDPR applies, transfers of personal information to countries without an applicable adequacy decision will be made only when an appropriate transfer mechanism or other lawful transfer condition is available.
Depending on the circumstances, appropriate safeguards may include:
- Standard Contractual Clauses approved by the European Commission.
- Applicable adequacy decisions.
- Additional technical or organizational safeguards where necessary.
- Other lawful transfer mechanisms recognized under applicable data protection law.
You may contact us to request information about the relevant safeguards applicable to a particular transfer, subject to applicable legal limitations.
9. How Long Do We Keep Personal Information?
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal requirements.
Retention periods may depend on:
- The nature and sensitivity of the information.
- The purpose for which the information was collected.
- The duration of the customer relationship.
- Applicable accounting, tax and recordkeeping requirements.
- The need to resolve disputes or establish legal claims.
- Applicable data protection obligations.
When information is no longer necessary, we aim to delete it, anonymize it or otherwise handle it in accordance with applicable retention and data protection requirements.
10. Your Rights Under GDPR
Where GDPR applies, you may have the following rights in relation to your personal information, subject to applicable legal conditions and exceptions.
10.1 Right of Access
You may request confirmation of whether we process your personal information and obtain access to relevant information about that processing.
10.2 Right to Rectification
You may request correction of inaccurate personal information or completion of incomplete information.
10.3 Right to Erasure
You may request deletion of personal information where the applicable legal conditions are met, subject to lawful retention exceptions.
10.4 Right to Restrict Processing
You may request restriction of certain processing activities in circumstances recognized under GDPR.
10.5 Right to Data Portability
Where applicable, you may request to receive certain personal information in a structured, commonly used and machine-readable format or request its transmission to another controller where technically feasible and legally required.
10.6 Right to Object
You may object to processing based on legitimate interests in circumstances recognized under GDPR. You have an unconditional right to object to the processing of personal information for direct marketing purposes.
10.7 Right to Withdraw Consent
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing carried out lawfully before withdrawal.
10.8 Right to Lodge a Complaint
You may lodge a complaint with the competent data protection supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the place of the alleged infringement, where applicable.
11. How to Exercise Your Data Protection Rights
If you wish to exercise a GDPR right or ask a question about your personal information, please contact us using the privacy contact details provided in this policy.
Step 1: Submit Your Request
Email us at gloqora@hearthlin.com and explain which privacy right you wish to exercise.
Step 2: Provide Relevant Information
Include enough information for us to understand and locate the relevant records. We may request additional information where reasonably necessary to verify your identity or authority.
Step 3: Request Review
We will review your request and determine the applicable legal requirements and any relevant exceptions.
Step 4: Receive a Response
Where GDPR applies, we generally respond to valid requests without undue delay and within one month of receipt. Where legally permitted, this period may be extended by up to two additional months for complex or numerous requests. We will inform you of any extension within the applicable period.
Exercising applicable data protection rights is generally free of charge. Reasonable fees or refusal may apply only in circumstances permitted by applicable law, such as manifestly unfounded or excessive requests.
12. Cookies and Similar Technologies
Our website may use cookies, pixels, local storage and similar technologies to support essential functions, remember preferences, analyze website activity and measure marketing performance.
Where required by applicable law, non-essential cookies and similar technologies will be activated only after the appropriate consent has been obtained.
You may manage your available cookie preferences through the website's consent management interface, where provided, or through your browser settings.
For further information, please review our separate Cookies Policy.
13. Marketing Communications
We may send information about products, offers or other promotional activities where permitted by applicable law and where an appropriate legal basis exists.
Where consent is required, we will seek your consent before sending the relevant marketing communications.
You may withdraw your consent or unsubscribe from marketing emails using an available unsubscribe mechanism or by contacting us directly.
Withdrawing marketing consent does not affect essential communications relating to purchases, payments, delivery arrangements, customer service or other transactional matters.
14. Automated Decision-Making and Profiling
Our website and related services may use automated technical processes for website functionality, transaction processing, security monitoring and analysis.
Where applicable, we do not intend to make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, unless a lawful basis and the required safeguards are in place.
If such processing is used in circumstances covered by GDPR Article 22, the relevant information and applicable rights will be provided as required by law.
15. Data Security
We take reasonable technical and organizational measures designed to protect personal information against accidental loss, unauthorized access, alteration, disclosure or destruction.
Depending on the services and systems involved, safeguards may include access controls, secure data transmission, service-provider arrangements and appropriate operational procedures.
We also seek to limit access to personal information to individuals and service providers who need it for legitimate operational purposes.
No method of electronic storage or transmission can be guaranteed to be completely secure. We review and improve our safeguards as appropriate.
16. Personal Data Breaches
If we become aware of a personal data breach involving information for which we are responsible, we will assess the incident and take appropriate steps in accordance with applicable data protection requirements.
Where GDPR applies, notification to the relevant supervisory authority will be made within the legally required period where the breach is likely to result in a risk to individuals' rights and freedoms.
Where a breach is likely to result in a high risk to individuals' rights and freedoms, affected individuals will be informed where required by applicable law.
17. Children's Privacy
Our website and products are intended for general consumers and are not designed to knowingly collect personal information from children in violation of applicable privacy laws.
Where GDPR applies, the rules concerning children's consent for information society services will be observed where relevant, including applicable national age thresholds and parental authorization requirements.
If you believe that a child's personal information has been collected improperly, please contact us so that we can review the matter and take appropriate steps where necessary.
18. Supervisory Authorities and Your Right to Complain
If you believe that our handling of your personal information does not comply with applicable data protection law, you may have the right to lodge a complaint with a competent supervisory authority.
For individuals protected by GDPR, this may include the supervisory authority in the EU Member State where you live, work or where the alleged infringement occurred.
You are not required to contact us before exercising your right to lodge a complaint with a supervisory authority.
You may also contact us directly if you would like us to review a privacy concern.
19. Additional Information for EEA Residents
If you are located in the EEA and GDPR applies to the processing of your personal information, you may benefit from additional protections under European data protection law.
These protections may include transparency about processing purposes, access to personal information, correction and deletion rights, restrictions on processing, objection rights and safeguards for international transfers.
Where applicable, we will provide information about the relevant processing activities and respond to valid data protection requests in accordance with the GDPR.
The availability and scope of specific rights depend on the applicable law and the circumstances of the processing.
20. Changes to This GDPR Policy
We may update this policy to reflect changes in our business operations, website functionality, service providers, privacy practices or applicable legal requirements.
Any revised version will be published on this page.
We encourage customers and website visitors to review this policy periodically to stay informed about how their personal information is handled.
21. Important Legal Disclaimer
This policy provides general information about our intended personal information handling practices and the data protection rights that may apply to individuals under GDPR and other applicable privacy laws.
The actual information collected, processing activities, service providers, legal bases and international transfer arrangements depend on the website configuration and business operations in effect.
This policy is not legal advice and does not guarantee compliance with every data protection law. The publication of this document does not replace the technical, contractual and organizational measures required for compliance.
Nothing in this policy is intended to exclude, restrict or waive any mandatory rights available under applicable data protection law. Where any provision conflicts with mandatory legal requirements, those requirements will prevail.
Contact Us About Data Protection
For questions about personal information, GDPR rights, data access, correction, deletion or other privacy matters, please contact hearthlin.
Brand:
hearthlin
Address:
4-1-15-311 Higashinakajima,
Higashiyodogawa-ku, Osaka-shi,
Osaka 533-0033, Japan
Privacy Email:
gloqora@hearthlin.com
Phone:
+81 (708) 926 98 36
Customer Service Hours:
Monday – Friday: 9:00 AM – 5:00 PM
Service Availability:
Our customer service team is available during the stated business hours. Emails received outside these hours will be reviewed during the next available business period.
hearthlin
Thoughtful Living. Comfortable Spaces.
Respecting your privacy. Protecting your information.