At Japan Avenue, we respect your privacy and are committed to protecting your personal data. This policy describes how your personal information is collected, used, stored and shared when you visit our website or make a purchase. Japan Avenue is operated by a company established in France, and we process all personal data in accordance with the EU General Data Protection Regulation (GDPR), regardless of where you are located. Section 11 provides additional information for customers outside the European Union.
1. DATA CONTROLLER
The controller of your personal data is Ecom Vibe SAS, registered in France under number SIREN 883 427 767, with its registered office at 66 avenue des Champs-Élysées, 75008 Paris, France.
For any question regarding your personal data: contact@japan-avenue.com
2. DATA WE COLLECT
When you place an order, we collect the data required to process it: first name, last name, postal address, email address, phone number and order history.
When you create a customer account, we keep the same information together with your login credentials.
When you subscribe to our newsletter or VIP list, we collect your email address and, where applicable, your phone number.
When you contact our customer service, we keep the correspondence and the information needed to handle your request.
When you browse our website, we automatically receive certain technical data (IP address, browser type, operating system, pages visited) through the cookies described in Section 8.
We never collect your payment card details: they are processed directly by our PCI-DSS certified payment providers.
3. PURPOSES AND LEGAL BASES
We use your data for the following purposes:
- Processing and delivering your orders, handling returns and customer service. Legal basis: performance of a contract.
- Managing your customer account. Legal basis: performance of a contract.
- Complying with our accounting and tax obligations. Legal basis: legal obligation.
- Marketing communications by email, SMS and WhatsApp (see Section 4). Legal basis: your consent.
- Fraud prevention and website security. Legal basis: legitimate interest.
- Audience measurement and improvement of our website. Legal basis: consent (cookies) or legitimate interest for strictly necessary measurements.
4. MARKETING COMMUNICATIONS
We may send you marketing communications (promotional offers, new products, information about our store) by email, SMS and WhatsApp.
We only send marketing communications with your express consent, which we collect for example when you subscribe to our newsletter or VIP list, or when you tick the marketing option at checkout. Consent for SMS and WhatsApp messages is collected separately from consent for email.
Unsubscribing: you can withdraw your consent at any time and free of charge by clicking the unsubscribe link in any email, by replying STOP to any SMS or WhatsApp message, or by writing to contact@japan-avenue.com. Your request is processed within 48 hours. Messages relating to your order (confirmation, shipping, delivery) are not affected and will continue to be sent to you.
Every marketing message identifies Japan Avenue as the sender and includes a way to unsubscribe. Marketing SMS messages are sent only between 8am and 8pm in your local time zone, Monday to Saturday.
5. DATA RETENTION
- Order and invoicing data: 10 years from the end of the relevant financial year, in accordance with our legal accounting obligations.
- Customer account and purchase history: for the duration of our commercial relationship, then 5 years from your last order or last login, corresponding to the applicable limitation period for contractual claims. You can request the deletion of your account at any time.
- Marketing data: 3 years from your last order or your last active contact with us (opening an email, clicking a link, contacting customer service), or until you withdraw your consent. At the end of this period, we may contact you once to ask whether you wish to keep receiving our communications.
- Customer service correspondence and disputes: 5 years from the closure of the request, corresponding to the applicable limitation period.
- Fraud prevention and unpaid order data: 5 years from the incident.
- Records of data subject requests: 6 years from the request, to demonstrate how it was handled.
- Connection logs and technical data: 1 year.
- Cookies and trackers: 13 months maximum from the date they are set; data collected through them is kept for 25 months maximum.
At the end of these periods, your data is deleted or anonymised. Some data may be kept longer in restricted-access archives where the law requires it or to preserve evidence in the event of a dispute, until the applicable limitation periods expire.
6. RECIPIENTS OF YOUR DATA
Your data is accessible to authorised members of our team, within the scope of their duties.
It is also shared with our service providers, only to the extent necessary for them to perform their services: e-commerce platform and hosting, payment providers, carriers and shipping management services, email, SMS and WhatsApp sending services, customer service tools, audience measurement providers. These providers are contractually bound to protect your data and may not use it for any other purpose.
We may also disclose your data where required by law, at the request of a competent authority, or in the event of a breach of our Terms of Service.
If our store is sold or merged with another company, your data may be transferred to the new owner, who will be bound by this policy.
7. INTERNATIONAL DATA TRANSFERS
Your data is primarily processed within the European Union. Some of our service providers may be located outside the EU or host data there, and your data may be transferred to the country from which you place your order for delivery purposes. In each case, we ensure that the transfer is covered by an adequacy decision of the European Commission or by the Standard Contractual Clauses approved by the Commission, so as to guarantee a level of protection equivalent to that applicable in the EU.
8. COOKIES
Our website uses cookies, small files stored on your device when you visit.
Strictly necessary cookies (set without consent): they allow the website to function and manage your session, your cart and your login. For example: _session_id, _secure_session_id, cart, storefront_digest.
Analytics and personalisation cookies (subject to your consent): they allow us to measure website traffic, analyse your browsing and tailor our advertising. For example: _shopify_visit, _shopify_uniq, and cookies set by our analytics and advertising tools.
You can accept or decline non-essential cookies through the banner displayed on your first visit, change your choice at any time via the "Manage cookies" link at the bottom of the page, or configure your browser to block them. Declining non-essential cookies does not prevent you from using the website.
9. SECURITY
We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access, disclosure, alteration or destruction: encryption of data in transit (SSL/TLS), secure hosting, access controls, and PCI-DSS compliance for payments. As no method of transmission or storage is completely secure, we cannot guarantee absolute security, but we are committed to applying industry best practices.
10. YOUR RIGHTS
Under the GDPR, you have the following rights regarding your data:
- Right of access: to obtain confirmation that your data is being processed and to receive a copy of it.
- Right to rectification: to have inaccurate or incomplete data corrected.
- Right to erasure: to request the deletion of your data, within the limits of our legal retention obligations.
- Right to restriction: to request the temporary suspension of a processing activity.
- Right to object: to object at any time to processing based on our legitimate interest, and in particular to marketing communications.
- Right to data portability: to receive your data in a structured, machine-readable format.
- Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise these rights, write to us at contact@japan-avenue.com describing your request. We may ask for proof of identity where we have reasonable doubts about your identity. We will respond within one month, which may be extended by two months for complex requests.
If you believe your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with the data protection authority of your country of residence.
11. ADDITIONAL INFORMATION FOR CUSTOMERS OUTSIDE THE EUROPEAN UNION
This policy applies to all our customers worldwide. Because we are established in France, the GDPR governs all our processing of your personal data wherever you are located. In addition, depending on your country of residence, you may have further rights under your local legislation, including the UK GDPR and Data Protection Act 2018 (United Kingdom), PIPEDA (Canada), the Privacy Act 1988 (Australia), and applicable state privacy laws such as the California Consumer Privacy Act (United States). These rights can be exercised through the same contact address indicated in Section 10. We do not sell your personal data and we do not share it for cross-context behavioural advertising within the meaning of US state privacy laws.
12. MINORS
Our website is intended for adults. We do not knowingly collect data from persons under 16 years of age without the consent of their legal guardians. If you believe a minor has provided us with data without authorisation, please contact us so that we can delete it.
13. CHANGES TO THIS POLICY
We may update this policy at any time, in particular to reflect legal developments or changes in our practices. The applicable version is the one published on the website, with its update date. In the event of a material change, we will inform you by email or by a notice on the website.
Last updated: October 2026