1) Introduction and Contact Details of the Controller
1.1 Thank you for visiting our website and for your interest. In the following, we explain how your personal data is handled when you use our website. Personal data means any information that can be used to identify you personally.
1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is AS ECOM LLC, 1309 Coffeen Avenue, STE 1200, Sheridan, WY 82801, United States of America (USA), email: yamiaoffice@gmail.com. The controller responsible for processing personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
2) Data Collection When Visiting Our Website
2.1 When you use our website purely for informational purposes, i.e., when you do not register or otherwise provide information to us, we collect only the data transmitted by your browser to the website server (so-called “server log files”). When you access our website, we collect the following data that is technically necessary for us to display the website to you:
- The website of ours that you visited
- Date and time of access
- Amount of data transmitted in bytes
- Source/referrer from which you accessed the page
- Browser used
- Operating system used
- IP address used (possibly in anonymized form)
Processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or used for any other purpose. However, we reserve the right to review the server log files retrospectively if there are specific indications of unlawful use.
2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries addressed to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by “https://” and the padlock symbol in your browser's address bar.
3) Hosting & Content Delivery Network
Shopify
All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
An adequate level of data protection for transfers to Canada is ensured by an adequacy decision of the European Commission.
4) Cookies
To make visiting our website attractive and to enable the use of certain functions, we use cookies, which are small text files stored on your device. Some of these cookies are automatically deleted after you close your browser (so-called “session cookies”), while others remain on your device for longer and enable website settings to be saved (so-called “persistent cookies”). In the latter case, you can find the storage duration in your web browser's cookie settings overview.
If individual cookies used by us also process personal data, processing takes place in accordance with Article 6(1)(b) GDPR for the performance of a contract, Article 6(1)(a) GDPR where consent has been given, or Article 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and in a customer-friendly and effective design of the website visit.
You can configure your browser to notify you when cookies are set and to decide individually whether to accept them, or to exclude the acceptance of cookies in certain cases or generally.
Please note that if you do not accept cookies, the functionality of our website may be restricted.
5) Contacting Us
When you contact us (e.g., via a contact form or email), personal data is processed solely for the purpose of handling and responding to your inquiry and only to the extent necessary for this purpose.
The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Article 6(1)(f) GDPR. If your contact is aimed at entering into a contract, Article 6(1)(b) GDPR provides an additional legal basis for processing. Your data will be deleted when the circumstances indicate that the matter in question has been conclusively resolved, provided that no statutory retention obligations prevent deletion.
6) Use of Customer Data for Direct Advertising
Subscription to our email newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required to receive the newsletter is your email address. Providing additional data is voluntary and is used to address you personally. We use the double opt-in procedure for newsletter subscriptions. This ensures that you only receive newsletters once you have expressly confirmed your consent to receive them by clicking a verification link sent to the email address provided.
By activating the confirmation link, you consent to the use of your personal data in accordance with Article 6(1)(a) GDPR. We store your IP address recorded by your internet service provider (ISP) as well as the date and time of registration to be able to trace any possible misuse of your email address at a later date. The data collected during newsletter registration is used strictly for this specific purpose.
You may unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the controller named above. Once you have unsubscribed, your email address will be immediately deleted from our newsletter distribution list unless you have expressly consented to further use of your data or we reserve the right to use data beyond this scope where permitted by law and disclosed in this policy.
7) Data Processing for Order Fulfillment
7.1 To the extent necessary for contract performance, delivery and payment, the personal data collected by us will be passed on to the commissioned transport company and financial institution in accordance with Article 6(1)(b) GDPR.
If, under a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact details you provided when ordering in order to inform you personally as part of our statutory information obligations pursuant to Article 6(1)(c) GDPR. Your contact details are used strictly for communications concerning updates that we owe you and are processed by us for this purpose only to the extent necessary for the respective notification.
To process your order, we also work with the service providers listed below, who assist us in whole or in part with the performance of contracts. Certain personal data is transferred to these service providers in accordance with the following information.
7.2 In order to fulfill our contractual obligations to customers, we work with external shipping partners. We provide your name, delivery address and, where required for delivery, telephone number to a shipping partner selected by us, solely for the purpose of delivering the goods, pursuant to Article 6(1)(b) GDPR.
7.3 Use of Payment Service Providers
Amazon Pay
One or more online payment methods offered by the following provider are available on this website: Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg.
If you select a payment method offered by this provider for which you pay in advance (such as a credit card payment), the payment details you provide during the ordering process (including your name, address, bank and payment card details, currency and transaction number) as well as information about the content of your order will be transferred to this provider in accordance with Article 6(1)(b) GDPR. In this case, your data is transferred solely for the purpose of payment processing by the provider and only to the extent necessary for that purpose.
Google Pay
If you select the “Google Pay” payment method from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), the payment is processed via the Google Pay application on your mobile device running at least Android 4.4 (“KitKat”) and equipped with NFC functionality, by charging a payment card stored with Google Pay or a payment system verified there (e.g., PayPal). To authorize a payment via Google Pay exceeding EUR 25, you must first unlock your mobile device using the verification method configured on it (e.g., facial recognition, password, fingerprint or pattern).
For payment processing purposes, the information you provide during the ordering process, together with information about your order, is transferred to Google. Google then transmits the payment information stored in Google Pay to the originating website in the form of a one-time transaction number used to verify that payment has been made. This transaction number does not contain any information about the actual payment details of the payment methods stored in Google Pay; it is generated and transmitted as a numerical token valid for one use only. In all Google Pay transactions, Google merely acts as an intermediary for the payment process. The transaction is carried out exclusively between the user and the originating website by charging the payment method stored with Google Pay.
Where personal data is processed in the course of the transfers described above, processing takes place exclusively for payment processing purposes in accordance with Article 6(1)(b) GDPR.
Google reserves the right to collect, store and evaluate certain transaction-specific information for each transaction made via Google Pay. This includes the date, time and amount of the transaction, the merchant's location and description, a description of the purchased goods or services provided by the merchant, photographs you have attached to the transaction, the names and email addresses of the seller and buyer or sender and recipient, the payment method used, your description of the reason for the transaction and, where applicable, the offer associated with the transaction.
According to Google, this processing is carried out exclusively in accordance with Article 6(1)(f) GDPR on the basis of the legitimate interest in proper accounting, verification of transaction data and optimization and maintenance of the Google Pay service.
Google also reserves the right to combine the processed transaction data with other information collected and stored when other Google services are used.
The Google Pay terms of use can be found here:
Further information about Google Pay's privacy practices is available at:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de
PayPal
One or more online payment methods offered by the following provider are available on this website: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
If you select a payment method offered by this provider for which you pay in advance, the payment details you provide during the ordering process (including your name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be transferred to the provider in accordance with Article 6(1)(b) GDPR. In this case, your data is transferred solely for payment processing by the provider and only to the extent necessary for that purpose.
If you select a payment method where we provide services or goods in advance, you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number and, where applicable, information about an alternative payment method).
To safeguard our legitimate interest in determining your ability to pay in such cases, this data will be forwarded to the provider for a credit check in accordance with Article 6(1)(f) GDPR. On the basis of the personal data you provide and other data (such as shopping cart, invoice amount, order history and payment experience), the provider checks whether your chosen payment method can be offered with regard to payment and/or default risks.
The credit report may contain probability values (so-called “score values”). Where score values are included in the credit report, they are based on a scientifically recognized mathematical-statistical procedure. Address data, among other things, is taken into account when calculating the scores.
You may object to this processing of your data at any time by sending us a message or contacting the provider. However, the provider may still be entitled to process your personal data if this is necessary for contractual payment processing.
Shopify Payments
One or more online payment methods offered by the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland.
If you select a payment method offered by this provider for which you pay in advance (e.g., credit card payment), the payment details you provide during the ordering process (including your name, address, bank and payment card information, currency and transaction number), as well as information about the content of your order, will be transferred to the provider pursuant to Article 6(1)(b) GDPR. In this case, your data is transferred solely for the purpose of payment processing by the provider and only to the extent necessary for that purpose.
8) Retargeting / Remarketing and Conversion Tracking
Meta Pixel with Advanced Matching
As part of our online offering, we use the “Meta Pixel” service with advanced matching provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”).
When a user clicks on an advertisement we have placed on Facebook or Instagram, “Meta Pixel” adds a parameter to the URL of our linked page. After redirection, this URL parameter is stored in the user's browser by a cookie set by our linked page itself. In addition, this cookie records specific customer data such as email addresses that we collect on our website linked to the Facebook or Instagram ad during transactions such as purchases, account logins or registrations (advanced matching). The cookie is then read and enables the transfer of data, including specific customer data, to Meta.
We use “Meta Pixel” with advanced matching to make our advertising (so-called “ads”) on Facebook and/or Instagram more effective and to ensure that the ads match users' interests or certain characteristics (e.g., interest in specific topics or products determined from the websites visited), which we transmit to Meta (so-called “Custom Audiences”).
We also analyze the effectiveness of our advertisements by tracking whether users were redirected to our website after clicking on an ad (conversion). Compared with the standard Meta Pixel, the advanced matching feature helps us measure the effectiveness of our advertising campaigns more accurately by recording more attributable conversions.
All transferred data is stored and processed by Meta, making it possible to associate it with the relevant user profile. Meta may use the data for its own advertising purposes in accordance with Meta's data policy (https://www.facebook.com/about/privacy/). The data may enable Meta and its partners to display ads on and off Facebook.
All processing described above, particularly the placement of cookies to read information on the device used, takes place only if you have given us your express consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by disabling this service in the cookie consent tool provided on the website.
We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
The information generated by Meta is generally transmitted to and stored on a Meta server. In this context, data may also be transmitted to servers operated by Meta Platforms Inc. in the United States.
For data transfers to the United States, the provider has joined the EU–US Data Privacy Framework, which is based on an adequacy decision by the European Commission and ensures compliance with the European level of data protection.
9) Website Features
Endereco
To enable real-time checking of certain entries in the address form during our online store's checkout process for input errors, we use the services of Endereco UG, Balthasar-Neumann-Straße 4b, 97236 Randersacker, Germany.
The provider validates the address entered, verifies its spelling and, if necessary, adds missing information. If an address is ambiguous, correct alternatives are suggested. For this purpose, the address data you enter is transmitted to the provider, where it is stored and evaluated.
This processing is carried out pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in properly recording customers' correct address data to conscientiously fulfill our contractual delivery obligations and prevent problems with contract performance.
The provider processes the data separately and does not combine it with other databases, and deletes it as soon as its status or correctness has been confirmed, but no later than 30 days thereafter.
10) Rights of the Data Subject
10.1 Applicable data protection law grants you the following data subject rights (rights to information and intervention) against the controller in relation to the processing of your personal data. The legal provisions cited govern the respective requirements for exercising these rights:
- Right of access under Article 15 GDPR;
- Right to rectification under Article 16 GDPR;
- Right to erasure under Article 17 GDPR;
- Right to restriction of processing under Article 18 GDPR;
- Right to be informed under Article 19 GDPR;
- Right to data portability under Article 20 GDPR;
- Right to withdraw consent under Article 7(3) GDPR;
- Right to lodge a complaint under Article 77 GDPR.
10.2 RIGHT TO OBJECT
WHERE WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST FOLLOWING A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO SUCH PROCESSING AT ANY TIME, WITH EFFECT FOR THE FUTURE, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS.
IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. YOU MAY EXERCISE YOUR OBJECTION AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.
11) Duration of Storage of Personal Data
The duration for which personal data is stored is determined by the respective legal basis, the purpose of processing and, where applicable, the relevant statutory retention period (e.g., retention periods under commercial and tax law).
Where personal data is processed on the basis of express consent pursuant to Article 6(1)(a) GDPR, the data concerned will be stored until you withdraw your consent.
If statutory retention periods apply to data processed in the context of contractual or similar obligations on the basis of Article 6(1)(b) GDPR, such data will be routinely deleted after the retention periods have expired, provided that it is no longer necessary for the performance or initiation of a contract and/or we no longer have a legitimate interest in continuing to store it.
Where personal data is processed on the basis of Article 6(1)(f) GDPR, it will be stored until you exercise your right to object under Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Where personal data is processed for direct marketing purposes on the basis of Article 6(1)(f) GDPR, it will be stored until you exercise your right to object under Article 21(2) GDPR.
Unless otherwise indicated in the other information in this policy concerning specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.