Date: 2025-09-20
About This Policy
This Privacy Policy applies to all users of okiwam.store (“we”, “us”, “our”) and explains how we collect, use, store, protect, and share your personal data. We comply with the EU General Data Protection Regulation (GDPR) and other applicable regional data protection laws to safeguard your privacy rights and ensure responsible handling of your information.
“Personal data” refers to any information that can identify you directly or indirectly, such as your full name, email address, postal address, phone number, payment details, browsing history on our site, device information (e.g., IP address, browser type/version), and preferences (e.g., saved shipping addresses). This policy does not cover third-party websites or services linked from our site—we recommend reviewing those third parties’ privacy policies independently.
Data Controller & Contact
The data controller responsible for your personal data is the operator of okiwam.store. For privacy-related inquiries, requests (e.g., accessing your data, updating information, withdrawing consent), or complaints, contact our privacy team at:
- Email: service@okiwam.store (subject line: “Privacy Inquiry”)
We acknowledge privacy requests within 1 business day and resolve them within 30 days (extendable by 2 months for complex requests, with prior notification).
What Personal Data We Collect
We collect personal data only for specific, legitimate purposes and avoid unnecessary data collection. The types of data we gather depend on your interaction with our site:
1. Data Collected When Browsing (No Registration)
When you visit our site to view products (e.g., furniture, home decor) without creating an account or purchasing, we automatically collect technical data necessary for site functionality and security:
- IP address (to optimize performance, detect regional outages, and prevent fraud).
- Visit date/time (to analyze peak traffic and improve user experience during high-demand periods).
- Viewed pages/clicked links (to understand popular products and refine site navigation).
- Data transmission volume (to troubleshoot loading issues for users with limited bandwidth).
- Browser/OS/device model (to ensure site compatibility and responsive design).
This collection is based on Article 6(1)(f) GDPR (legitimate interest in maintaining a functional, secure website).
2. Data Collected for Account Registration
If you create an account to save preferences or track orders, we collect data you voluntarily provide:
- Full name (to personalize your account and verify order identity).
- Email address (for account confirmations, password resets, and order updates).
- Encrypted password (we never store raw passwords—industry-standard hashing is used).
- Optional phone number (for SMS delivery notifications, if you opt in).
- Communication preferences (e.g., opt-in for marketing emails about new products).
Account registration is optional—you can purchase as a guest, but an account streamlines future interactions.
3. Data Collected for Purchases
When placing an order, we collect data to process, fulfill, and track your purchase:
- Delivery address (including apartment numbers or special instructions for accurate shipping).
- Billing address (to verify payment details and comply with financial regulations).
- Order details (product name, model, quantity, price, and customizations, e.g., “Gray Fabric Sofa”).
- Payment method identifiers (e.g., last 4 digits of a credit card, PayPal ID—full payment data is processed by PCI DSS-compliant third-party providers; we never store full card details).
- Optional order notes (e.g., “Leave package at front door”).
This collection is based on Article 6(1)(b) GDPR (necessary to fulfill our contractual obligation to deliver your order).
4. Data Collected When Contacting Us
If you reach out to customer support via email or contact form, we collect:
- Your name and email address (to identify you and respond to your inquiry).
- Inquiry details (e.g., order number, product issue) (to resolve your request efficiently).
- Attachments (e.g., photos of damaged products, screenshots of site errors) (to verify concerns).
We retain this data only until your inquiry is resolved (typically 30 days post-communication) for follow-up support.
How We Use Your Personal Data
We use your data exclusively for the purposes it was collected, with no unstated use without your consent:
1. Fulfilling Orders & Services
- Process payments via trusted providers to complete your purchase.
- Share your name and delivery address with shipping carriers to ensure timely delivery.
- Send order updates (e.g., “Dispatched,” “Out for Delivery”) via email/SMS (if opted in).
- Resolve order issues (e.g., missing items) using your order history and communication.
2. Managing Your Account
- Maintain your profile (update preferences, store order history for easy reference).
- Secure your account (use IP/device data to detect unauthorized access, e.g., logins from new countries).
- Provide password reset functionality via your registered email.
3. Improving Our Site & Products
- Analyze aggregated, anonymized browsing/purchase data to identify trends (e.g., “60% of users view dining sets first”) and optimize site layout.
- Test new features (e.g., virtual room planners) with a subset of users to gather feedback.
- Fix technical bugs (use browser/device data to resolve issues like “Safari 16.1 cart errors”).
4. Communicating With You
- Send transactional emails (account confirmations, receipts, delivery alerts)—these are non-marketing and required for contract fulfillment.
- Send marketing communications (e.g., sale alerts) only if you opt in. Unsubscribe anytime via email links or account settings.
- Respond to customer support inquiries promptly.
5. Ensuring Security & Compliance
- Detect fraud (e.g., flag duplicate orders with mismatched billing/shipping addresses).
- Retain order/payment records for tax/accounting compliance.
- Respond to legal requests (e.g., court orders) when required by law.
How We Share Your Personal Data
We never sell your data to third parties for marketing. We only share data with trusted partners who assist our services, bound by strict contractual obligations to protect your information:
1. Payment Service Providers
We share your billing address, order amount, and payment identifiers with PCI DSS-compliant providers (e.g., PayPal, Stripe) to process payments securely. These providers use data only for transaction processing.
2. Shipping & Logistics Partners
We share your name, delivery address, and order number with carriers (e.g., DHL, UPS) to deliver your order. Carriers may receive your email/phone number for delivery updates (with your consent).
3. Technical Service Providers
Anonymized browsing data (e.g., pages viewed, device type) is shared with hosting, security, and analytics partners (e.g., Google Analytics) to maintain site performance, detect cyber threats, and improve user experience. Partners cannot identify individual users with this data.
4. Legal & Regulatory Authorities
We disclose data if required by law (e.g., tax audits, anti-fraud investigations) or to protect our legitimate interests (e.g., investigating fraudulent orders).
Data Retention & Erasure
We retain your data only as long as necessary for its intended purpose, plus legal retention periods:
- Account data: Retained while your account is active. Upon account closure, data is deleted within 30 days (unless legal obligations require longer retention).
- Order data: Retained for 7 years to comply with tax/accounting laws. After 7 years, data is anonymized (identifiers removed) to prevent linkage to you.
- Browsing data: Anonymized or deleted within 3 months of your last visit.
- Support data: Deleted 30 days after inquiry resolution.
If you request erasure (via the “Right to Erasure”), we delete/anonymize data within 14 business days—unless legal retention applies, in which case data is “blocked” (access restricted to authorized staff) until the legal period ends.
Data Security
We use technical and organizational measures to protect your data from unauthorized access or disclosure:
- Encryption: All data transmitted (e.g., account registration, payment details) uses SSL/TLS encryption.
- Secure Storage: Sensitive data (e.g., encrypted passwords) is stored on servers with restricted physical/digital access.
- Regular Audits: Quarterly security audits and penetration testing identify and fix vulnerabilities.
- Employee Training: Annual data protection training ensures staff understand their responsibilities.
In the event of a data breach posing risks to your rights, we notify you and relevant authorities within 72 hours of discovery.
Your Privacy Rights
Under GDPR and regional laws, you have the following rights. To exercise them, email service@okiwam.store with proof of identity (e.g., order confirmation):
1. Right to Access
Request a copy of the data we hold about you (including collection/use/sharing details) in a machine-readable format (e.g., CSV).
2. Right to Rectification
Correct inaccurate/incomplete data (e.g., outdated delivery addresses) within 7 business days of verification.
3. Right to Erasure (“Right to Be Forgotten”)
Request deletion if data is no longer needed, consent is withdrawn, or processing is unlawful. We confirm deletion within 14 business days (unless legal retention applies).
4. Right to Restriction of Processing
Limit data use if you dispute accuracy (until verified), processing is unlawful (but you don’t want deletion), or data is needed for legal claims.
5. Right to Data Portability
Receive your data in a structured format to transfer to another service provider (e.g., another online store) within 14 business days.
6. Right to Object
Object to processing for marketing (we stop immediately) or legitimate interests (we review and stop if your rights override our interests).
7. Right to Withdraw Consent
Withdraw consent for non-essential processing (e.g., marketing) anytime—this does not affect prior lawful processing.
You may also lodge a complaint with a local data protection supervisory authority if you believe we violated your rights.
Changes to This Policy
We update this policy to reflect legal changes, site features, or data practices. Revised policies are posted on our site with a new “Last Updated” date. We notify account holders of material changes via email. Continued use of okiwam.store after updates constitutes acceptance of the revised policy.