CEDARGRAIN · DATA PROTECTION & PRIVACY

GDPR Privacy Policy

Understanding Your Personal Data, Privacy Rights, and Data Protection Choices.

At Cedargrain, we recognize the importance of protecting personal data and providing transparent information about how it may be collected, used, stored, and shared. This GDPR Privacy Policy explains our approach to personal data processing and the rights available to individuals where the European Union General Data Protection Regulation (GDPR), or corresponding applicable data protection requirements, governs our activities. This policy should be read together with our general Privacy Policy and Cookie Policy.

1. Purpose of This Policy

This policy explains how Cedargrain addresses personal data protection obligations where GDPR requirements apply.

It is intended to provide information about:

• The types of personal data that may be processed.
• The purposes of processing personal data.
• The legal bases for processing where GDPR applies.
• Potential recipients of personal data.
• International data transfers.
• Data retention and security.
• Individual data protection rights.
• How to submit a privacy request or complaint.

This policy does not expand or restrict the territorial application of GDPR, which is determined by the relevant law and the circumstances of the processing.

2. Scope and Applicability

The GDPR may apply to certain processing activities carried out by organizations established in the European Economic Area or, in specified circumstances, by organizations outside the EEA.

For an organization outside the EEA, relevant circumstances may include offering goods or services to individuals in the EEA or monitoring their behavior within the EEA.

Cedargrain's online store currently focuses on customers in the United States.

The ability to access a website from another country does not, by itself, establish that the website is targeting customers in that country.

Where GDPR or other applicable data protection laws govern particular processing activities, Cedargrain is responsible for meeting the obligations applicable to those activities.

3. Data Controller Information

For personal data processing activities in which Cedargrain determines the purposes and means of processing, Cedargrain acts as the data controller.

The contact details associated with Cedargrain are:

If another organization independently determines how personal data is processed through its own services, that organization may act as a separate controller for the relevant processing.

4. What Is Personal Data?

Under GDPR, personal data means information relating to an identified or identifiable natural person.

Depending on the circumstances, personal data may include:

• Names and contact details.
• Billing or delivery addresses.
• Email addresses and telephone numbers.
• Order and transaction information.
• Online identifiers.
• IP addresses and device information.
• Customer communications.
• Other information that can reasonably be linked to an individual.

Whether information qualifies as personal data depends on the relevant circumstances and applicable legal definitions.

5. Categories of Personal Data

Depending on your interactions with Cedargrain and the website's enabled functions, the following categories of information may be processed.

The exact categories processed depend on the information provided and the website's actual technical configuration.

6. How Personal Data May Be Collected

Personal data may be collected through different interactions with our online store.

Potential sources include:

• Information entered during checkout.
• Customer service inquiries.
• Requests concerning orders or returns.
• Information submitted through available website features.
• Technical information generated when visiting the website.
• Cookies and similar technologies where enabled.
• Information provided by service providers involved in fulfilling an order.

The source and nature of information collected depend on the activity and the systems used.

7. Purposes of Personal Data Processing

Personal data may be processed for legitimate business activities associated with operating an online store.

Depending on the circumstances, these purposes may include:

• Receiving and processing orders.
• Supporting payment transactions.
• Arranging delivery of purchased products.
• Providing order-related communications.
• Responding to customer inquiries.
• Handling returns, refunds, and complaints.
• Maintaining website security.
• Meeting applicable legal obligations.
• Improving website performance where permitted.
• Conducting optional marketing activities where lawful.

Personal data should be processed only for specified, explicit, and legitimate purposes and in accordance with the applicable legal requirements.

8. Legal Bases for Processing Personal Data

Where GDPR applies, each processing activity must have an appropriate legal basis under Article 6 of the GDPR.

Depending on the activity, possible legal bases include:

The correct legal basis must be determined for each actual processing purpose. A legal basis should not be assumed merely because it appears in this table.

9. Processing Necessary for Orders

When customers place orders, certain personal data may be necessary to process the transaction and provide the purchased products.

Relevant information may include:

• Customer name.
• Contact information.
• Delivery address.
• Billing information.
• Order details.
• Payment-related transaction information.

Where GDPR applies, processing necessary for performance of a contract may rely on Article 6(1)(b).

Information necessary to complete an order may need to be provided for the transaction to proceed.

10. Customer Service and Communications

When customers contact Cedargrain, we may process the information included in their communications.

This may involve:

• Responding to product questions.
• Investigating delivery concerns.
• Handling order changes or cancellations.
• Reviewing return and refund requests.
• Addressing complaints.
• Maintaining relevant correspondence records.

The applicable legal basis depends on the nature of the request, the contractual relationship, and any relevant legal obligations or legitimate interests.

11. Payment-Related Personal Data

Payment transactions may involve the processing of personal data by payment service providers or other organizations involved in completing a purchase.

The information processed and the responsibilities of each organization depend on the payment methods and systems actually used.

Relevant processing may include:

• Payment authorization.
• Transaction confirmation.
• Fraud prevention.
• Refund processing.
• Compliance with payment-related legal requirements.

Customers should review any applicable payment provider privacy information where that provider processes data as an independent controller.

12. Cookies and Similar Technologies

Cookies and similar technologies may process information about website visits and interactions.

Depending on the configuration, these technologies may support:

• Essential website functionality.
• Shopping cart sessions.
• Security and technical operations.
• Optional preferences.
• Website analytics.
• Optional advertising activities.

Where applicable law requires consent for non-essential cookies, the relevant consent requirements must be met before those technologies are used.

For further explanations, please consult our Cookie Policy.

13. Marketing Communications

Where marketing communications are offered, personal data used for those activities must be processed in accordance with applicable privacy and electronic marketing laws.

Depending on the circumstances, this may involve:

• Obtaining consent where required.
• Providing information about marketing purposes.
• Respecting applicable objections or opt-outs.
• Maintaining appropriate preference records.
• Stopping direct marketing processing when a valid objection applies.

Where GDPR applies, individuals have the right to object at any time to the processing of their personal data for direct marketing, including related profiling.

14. Data Minimization

GDPR requires personal data to be adequate, relevant, and limited to what is necessary for the purposes for which it is processed.

For an online store, this principle means that information should be collected and used according to the actual requirements of the relevant activity.

For example, fulfilling a delivery may require a recipient's name and address, while unrelated personal details may not be necessary.

Cedargrain's processing activities must be evaluated against this principle wherever GDPR applies.

15. Data Accuracy

GDPR requires reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date.

Customers are encouraged to provide accurate contact, billing, and delivery information when placing orders.

If information is incorrect, please contact Cedargrain to request an appropriate correction.

Where a valid rectification request is made under applicable law, it will be assessed according to the relevant legal requirements.

16. Data Sharing and Service Providers

Operating an online store may require personal data to be disclosed to organizations that provide relevant services.

Depending on the actual arrangements, recipients may include:

• E-commerce infrastructure providers.
• Payment service providers.
• Order fulfillment and delivery-related service providers.
• Technical support providers.
• Security and fraud prevention providers.
• Professional advisers where necessary.
• Public authorities where disclosure is legally required.

Where a service provider acts as a data processor under GDPR, the relationship must be governed by an appropriate data processing arrangement where required by Article 28.

Disclosure must be supported by an appropriate purpose, legal basis, and applicable safeguards.

17. International Transfers of Personal Data

Cedargrain's contact address is located in Japan, and the online store serves customers in the United States.

Depending on the actual systems and service providers involved, personal data may be processed in more than one country.

Where GDPR applies and personal data is transferred outside the EEA in circumstances governed by Chapter V of the GDPR, the transfer must comply with the applicable requirements.

Potential lawful transfer mechanisms may include:

• An applicable European Commission adequacy decision.
• Appropriate safeguards, such as valid standard contractual clauses, where relevant.
• Other lawful mechanisms or derogations where their conditions are satisfied.

The appropriate mechanism depends on the destination, recipient, nature of the transfer, and relevant legal requirements.

The existence of a possible transfer mechanism does not mean that Cedargrain has implemented every mechanism listed above.

18. Data Retention

Personal data should not be retained in an identifiable form for longer than necessary for the purposes for which it is processed, unless a longer period is permitted or required by law.

Retention considerations may include:

• The need to fulfill an order.
• Customer service requirements.
• Applicable tax or accounting obligations.
• Handling returns and refunds.
• Resolving disputes.
• Security and fraud prevention needs.
• Other applicable legal obligations.

Different categories of personal data may require different retention periods.

Specific retention periods or the criteria used to determine them must be established from the actual processing activities and applicable legal obligations.

19. Data Security

GDPR requires appropriate technical and organizational measures to protect personal data, taking into account the risks involved in the processing.

Depending on the circumstances, relevant measures may include:

• Appropriate access controls.
• Secure handling of customer information.
• Measures to protect systems against unauthorized access.
• Appropriate management of service providers.
• Processes for identifying and responding to security incidents.
• Reviewing security measures in light of relevant risks.

No online system can guarantee absolute security.

Where GDPR applies, Cedargrain must implement measures appropriate to the actual processing risks and legal requirements.

20. Personal Data Breaches

A personal data breach may involve accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

Where GDPR applies, certain breaches must be reported to the competent supervisory authority unless the legal conditions for an exception are met.

Where notification is required under Article 33, it must generally be made without undue delay and, where feasible, within 72 hours after the controller becomes aware of the breach.

In circumstances involving a high risk to individuals' rights and freedoms, Article 34 may also require communication to affected individuals, subject to applicable exceptions.

Notification requirements depend on the nature of the incident and the relevant legal assessment.

21. Your Rights Under GDPR

Where GDPR applies to the processing of your personal data, you may have the following rights, subject to the conditions and exceptions established by law.

Additional rights may include withdrawing consent and lodging a complaint with a competent supervisory authority.

22. Right of Access

Under Article 15 of the GDPR, eligible individuals may request confirmation of whether their personal data is being processed.

Where processing occurs, they may have the right to access the relevant personal data and receive information about matters such as:

• Processing purposes.
• Categories of personal data.
• Recipients or categories of recipients.
• Applicable retention information.
• Available data protection rights.
• Other information required by Article 15.

Requests will be assessed in accordance with applicable legal requirements, including protections for the rights and freedoms of others.

23. Right to Rectification

Under Article 16 of the GDPR, individuals may request the correction of inaccurate personal data.

Depending on the purposes of processing, individuals may also have the right to have incomplete personal data completed.

For example, a customer may wish to correct an inaccurate contact detail associated with an order.

Please contact Cedargrain with sufficient information to identify the relevant data and explain the requested correction.

24. Right to Erasure

Under Article 17 of the GDPR, individuals may request the erasure of personal data in specified circumstances.

These circumstances may include situations where:

• Personal data is no longer necessary for the original purpose.
• Valid consent has been withdrawn and no other legal basis applies.
• A valid objection applies and the relevant legal conditions are satisfied.
• Personal data has been unlawfully processed.
• Erasure is necessary to comply with an applicable legal obligation.

The right to erasure is not absolute. Certain information may need to be retained to comply with legal obligations or for other reasons permitted by Article 17.

Requests will be evaluated according to the applicable circumstances and legal requirements.

25. Right to Restrict Processing

Article 18 of the GDPR provides a right to restrict processing in certain circumstances.

Examples may include situations where:

• The accuracy of personal data is contested.
• Processing is unlawful and restriction is requested instead of erasure.
• Data is needed for legal claims even though it is no longer needed for the original processing purpose.
• An objection is being assessed under the relevant legal conditions.

The availability and consequences of restriction depend on the requirements of Article 18 and related GDPR provisions.

26. Right to Data Portability

Article 20 of the GDPR provides a right to data portability where its specific conditions are met.

This right generally concerns personal data provided by an individual when processing is based on consent or contract and is carried out by automated means.

Where applicable, the individual may receive the relevant data in a structured, commonly used, machine-readable format.

The right does not automatically apply to all information held by a business or to every type of processing activity.

27. Right to Object

Under Article 21 of the GDPR, individuals may object to certain processing activities.

The conditions depend on the processing purpose and legal basis.

In particular, individuals have the right to object at any time to the processing of personal data for direct marketing purposes, including related profiling.

When a valid direct marketing objection is made, the relevant personal data must no longer be processed for that purpose.

Other objections will be assessed according to the requirements and exceptions provided by Article 21.

28. Withdrawal of Consent

Where personal data processing relies on consent, individuals have the right to withdraw that consent at any time.

Withdrawal must be as easy as giving consent, as required by applicable law.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

It also does not automatically prevent processing that is supported by another valid legal basis.

For questions about consent-based processing, please contact Cedargrain using the details provided below.

29. Automated Decision-Making and Profiling

Article 22 of the GDPR provides protections concerning certain decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

Where such processing is undertaken, its legality and any applicable safeguards must be assessed under the relevant GDPR provisions.

Not every automated website function or routine technical process constitutes a decision covered by Article 22.

Questions about automated processing involving your personal data may be directed to Cedargrain.

30. How to Exercise Your Data Protection Rights

To submit a request concerning personal data, please contact Cedargrain by email.

To help us understand your request, please explain the right you wish to exercise and provide relevant details about your interaction with Cedargrain.

We may request information reasonably necessary to verify identity where permitted or required by law.

We will not request more information than is reasonably necessary for the verification and handling of the request.

31. Response Time for GDPR Requests

Under Article 12 of the GDPR, a controller must generally provide information about action taken on a valid rights request without undue delay and, in any event, within one month of receiving the request.

Where necessary, this period may be extended by a further two months, taking into account the complexity and number of requests.

If an extension is used, the individual must be informed within one month of receiving the request, together with the reasons for the delay.

If no action is taken on a request, the controller must provide the information required by Article 12, including relevant reasons and complaint options.

These timelines apply where the relevant GDPR provisions govern the request.

32. Fees for Data Protection Requests

Under GDPR, information and actions provided in response to relevant data subject rights requests are generally free of charge.

Where a request is manifestly unfounded or excessive, particularly because of its repetitive character, Article 12 may permit a reasonable fee or refusal to act, subject to the applicable conditions.

The controller bears the burden of demonstrating that a request is manifestly unfounded or excessive.

Cedargrain will assess any applicable request fee or refusal only in accordance with the relevant legal requirements.

33. Complaints to a Supervisory Authority

Where GDPR applies, individuals have the right to lodge a complaint with a competent data protection supervisory authority if they consider that the processing of their personal data infringes GDPR.

Under Article 77, a complaint may generally be lodged in the Member State of the individual's habitual residence, place of work, or the place of the alleged infringement.

Individuals may also have rights to judicial remedies under the relevant GDPR provisions.

You may contact Cedargrain directly with a privacy concern, but doing so is not a prerequisite for exercising your right to complain to a competent supervisory authority.

34. Children's Personal Data

Cedargrain's online store offers home and lifestyle products and is not specifically directed toward children.

Where personal data relating to children is processed, applicable data protection requirements must be considered.

Special rules may apply to consent for information society services offered directly to children, depending on the relevant law and circumstances.

If you have concerns about personal data relating to a child, please contact Cedargrain.

35. Special Categories of Personal Data

GDPR provides additional protections for special categories of personal data under Article 9.

These categories include certain information concerning health, biometric identification, religious beliefs, and other legally specified characteristics.

Such information is not ordinarily necessary for purchasing general home and lifestyle products.

We encourage customers not to include unnecessary sensitive personal information in routine order inquiries.

If special category data is processed, the relevant legal conditions and safeguards must be satisfied.

36. Data Protection by Design and by Default

Article 25 of the GDPR requires appropriate data protection measures to be considered in the design and operation of relevant processing activities.

Where applicable, this includes considering:

• The amount of personal data collected.
• The extent of processing.
• Retention periods.
• Accessibility of personal data.
• Risks to individuals' rights and freedoms.

Appropriate implementation depends on the nature, scope, context, purposes, and risks of the actual processing.

37. Data Protection Representatives and Officers

Under certain circumstances, GDPR may require an organization outside the EEA to designate a representative within the EEA under Article 27.

Separate rules under Articles 37 to 39 may require the designation of a data protection officer in specified circumstances.

These obligations depend on the organization's actual activities and the applicable legal criteria.

This policy does not identify an EEA representative or a data protection officer because no such appointment information has been established for publication here.

If a designation is legally required, the relevant appointment and disclosure obligations must be fulfilled.

38. Changes to This GDPR Privacy Policy

Cedargrain may update this policy when relevant processing activities, technical arrangements, or applicable legal requirements change.

Updates may relate to:

• Changes in personal data processing purposes.
• New categories of personal data.
• Changes to service providers.
• International data transfer arrangements.
• Privacy rights procedures.
• Applicable legal obligations.

Where additional notice or consent is required by law, the relevant requirements must be observed.

We encourage customers to review this policy when seeking information about personal data protection.

39. Frequently Asked Questions

What does GDPR mean?

GDPR stands for General Data Protection Regulation, a European Union regulation governing the processing of personal data within its scope.

Does GDPR apply to every online store?

No. Its application depends on the circumstances, including establishment, offering goods or services to individuals in the EEA, or monitoring behavior within the EEA.

Can I request access to my personal data?

Where GDPR applies, you may have the right to request access under Article 15, subject to the applicable legal conditions.

Can I request deletion of my information?

You may request erasure where Article 17 applies. Certain information may need to be retained where a lawful exception applies.

Can I correct inaccurate personal information?

Where GDPR applies, Article 16 provides a right to request rectification of inaccurate personal data.

Can I withdraw consent?

Yes, where processing is based on consent. Withdrawal does not affect processing that was lawful before the withdrawal.

Can I object to direct marketing?

Where GDPR applies, individuals have the right to object at any time to processing of their personal data for direct marketing purposes.

How long does a GDPR request take?

The general response period is one month, subject to applicable extensions and legal requirements.

Can my personal data be processed outside Europe?

International processing may occur, but transfers governed by GDPR must satisfy the applicable legal requirements.

Does GDPR apply to cookies?

Personal data processed through cookies may fall within GDPR. Separate electronic privacy rules may also apply to storing or accessing information on a user's device.

Can I complain to a data protection authority?

Where GDPR applies, Article 77 provides a right to lodge a complaint with a competent supervisory authority.

How do I contact Cedargrain about privacy?

Email lumaria@cedargrain.com and describe your privacy question or request.

40. Relationship to Other Policies

This GDPR Privacy Policy addresses personal data processing and data subject rights where GDPR applies.

Other Cedargrain policies provide additional information about specific activities:

• Privacy Policy: General personal information practices.
• Cookie Policy: Cookies and similar online technologies.
• Terms of Service: General conditions governing website use and purchases.
• Returns & Refunds Policy: Product return and refund procedures.
• Shipping & Delivery Policy: Order processing and delivery information.

These policies should be read together where relevant.

Nothing in this policy is intended to exclude or restrict rights that cannot lawfully be waived under applicable data protection law.

41. Contact Cedargrain

If you have questions about this GDPR Privacy Policy, personal data processing, or an applicable data protection right, please contact Cedargrain using the information below.

When submitting a request, please describe the nature of your concern and provide sufficient information to help us identify the relevant processing activity.

Cedargrain — Inspired by Home. Designed for Everyday Living.

Thoughtful home and lifestyle products, supported by transparent information and respect for personal data.