Data Protection (Privacy Policy)

Privacy Policy

Last updated: July 15, 2026

This Privacy Policy informs you about the nature, scope, and purpose of the processing of personal data by Western Limex GmbH (hereinafter referred to as "we" or "Controller") in connection with the operation of the website minijapanshop.eu and its associated services. The processing of your data is carried out in accordance with the provisions of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and other applicable data protection regulations.

I. Name and Address of the Controller

The Controller within the meaning of Article 4(7) GDPR and other national data protection laws is:

Western Limex GmbH
Südtiroler Platz 8/2
1040 Vienna
Austria

Contact:
Email: [email protected]
Website: https://minijapanshop.eu

II. Name and Address of the Data Protection Officer

The Data Protection Officer of the Controller is:

Luis Santacruz
Western Limex GmbH
Südtiroler Platz 8/2
1040 Vienna
Austria

Contact for Data Protection Inquiries:
Email: [email protected]

III. General Information on Data Processing

1. Scope of Processing of Personal Data

In principle, you can visit our website without disclosing your identity. However, when you visit our website, your browser automatically transmits certain data to our system (see Section IV. Provision of the Website and Creation of Log Files). This information is evaluated for statistical purposes only. Our services are reserved for adult visitors.

Personal data is only collected on our website if you voluntarily provide it to us (e.g., during registration, purchase or sale of goods, or when contacting us via the contact form). We use this data exclusively for the purposes stated in the following sections.

External service providers that process personal data on our behalf (processors) are contractually bound in accordance with Article 28 GDPR. For the transfer of personal data to third countries (outside the EU/EEA), we rely on:

• Adequacy decisions of the EU (e.g., for the USA: EU-US Data Privacy Framework, valid since July 10, 2023), provided the recipient is certified there.

• EU Standard Contractual Clauses (SCCs) in combination with additional measures (e.g., pseudonymization, encryption) in accordance with Implementing Decision (EU) 2021/914.

We maintain current technical and organizational measures to protect your personal data, which are regularly updated in line with the state of the art.

2. Legal Basis for the Processing of Personal Data

To the extent that we obtain your consent for processing operations involving personal data, Article 6(1)(a) GDPR serves as the legal basis.

For the processing of personal data necessary for the performance of a contract (e.g., purchase or sale of goods), Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures (e.g., registration).

If the processing is necessary to safeguard legitimate interests (e.g., security of the website, analysis of user behavior) and your interests or fundamental rights and freedoms do not override these, Article 6(1)(f) GDPR serves as the legal basis.

3. Data Deletion and Storage Period

Your personal data will be deleted or blocked as soon as the purpose for which it was stored no longer applies. Storage may continue beyond this if required by legal provisions (e.g., commercial or tax retention obligations). In Austria, the statutory retention periods for invoices and contract data are, for example, 10 years (§ 132 BAO).

Data will also be deleted or blocked when a statutory retention period expires, unless further storage is necessary for contract fulfillment or legal obligations.

IV. Provision of the Website and Creation of Log Files

1. Description and Scope of Data Processing

Each time our website minijapanshop.eu is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected:

1. Information about the browser type and version used

2. The operating system of the user

3. The IP address of the user (anonymized, see below)

4. Date and time/time zone of access

5. Content of the request (specific page)

6. Access status/HTTP status code

7. Websites from which the user's system reached our website (referrer)

8. Websites accessed by the user's system via our website

This data is also stored in the log files of our system. Storage of this data together with other personal data (e.g., registration data) does not occur.

2. Legal Basis for Data Processing

The legal basis for the collection and storage of data in log files is Article 6(1)(f) GDPR (legitimate interest in the provision and security of the website).

3. Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to enable the delivery of the website to your device. For this purpose, the IP address must be stored for the duration of the session. Additionally, recording the IP address makes it more difficult to automatically read the website (scraping).

Storing the data in log files serves to ensure the functionality of the website and to ward off attacks (e.g., DDoS attacks).

4. Duration of Storage

• The IP address is anonymized immediately after the end of the session (truncated), so that it can no longer be associated with a person.

• The log files are automatically deleted after 180 days.

5. Right to Object and Remove

The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Therefore, objection is not possible.

V. Use of Cookies

1. Description and Scope of Data Processing

Our website uses cookies to make our offer more user-friendly and secure. Cookies are small text files that are stored on your device and transmitted by your browser to our system.

We distinguish between:

• Technically necessary cookies: Enable basic functions of the website (e.g., login, shopping cart).

• Functional/analytical cookies: Improve the user experience (e.g., language settings).

• Marketing/tracking cookies: Enable analysis of user behavior and targeted advertising (e.g., Google Analytics).

2. Legal Basis for Data Processing

3. Purpose of Data Processing

• Technically necessary cookies enable the use of basic functions of the website (e.g., shopping cart, login). Without these cookies, certain services cannot be used.

• Functional cookies serve to improve the user experience (e.g., remembering language settings).

• Marketing/tracking cookies allow us to analyze user behavior, improve the quality of our website, and display targeted advertising.

4. Duration of Storage

Cookies are stored on your device and transmitted by it to our website. You have full control over the use of cookies:

• Technically necessary cookies: Are deleted after the session ends (session cookies) or have a limited lifespan (e.g., 1 year for login cookies).

• Marketing/tracking cookies: Are only set with your consent and remain until revocation or manual deletion by you.

You can disable or restrict the storage of cookies in your browser settings. You can also delete cookies at any time. However, without cookies, not all functions of our website may be fully usable.

5. Right to Object and Remove

• Withdraw consent: You can withdraw your consent for marketing/tracking cookies at any time via the cookie banner or in your browser settings.

• Browser settings: Disable cookie acceptance in your browser settings (e.g., Chrome, Firefox, Safari).

• Opt-out tools: Use the opt-out options of the individual providers (see below).

Note: The objection applies per browser and device. If you use our website from multiple devices or browsers, you must separately object for each device/browser.

6. Cookies and Third-Party Providers Used

We use the following third-party providers that use cookies or similar technologies:

a) Google Analytics (Web Analysis)

Special Features:

• We use Google Analytics with IP anonymization enabled (_anonymizeIp()). Your IP address is truncated before storage (IP masking).

• Google processes the data on our behalf (processing under Article 28 GDPR).

b) Google reCAPTCHA (Spam Protection)

Special Features:

• reCAPTCHA is used without consent, as it serves the security of the website.

• Data processing is automated and serves solely to prevent abuse.

c) Cloudflare (DDoS Protection & CDN)

Special Features:

• Cloudflare acts as a processor (Article 28 GDPR).

• The IP address is processed for the duration of the session and not permanently stored.

VI. Registration

1. Description and Scope of Data Processing

Our website offers users the opportunity to register by providing personal data. The data is entered into an input form and transmitted to us. No disclosure to third parties takes place, except to the processors mentioned in this policy.

The following data is collected during registration:

The following data is automatically stored:

• Date and time of registration

• Registration source (Web, iOS App, Android App)

2. Legal Basis for Data Processing

The legal basis for data processing is:

• Article 6(1)(a) GDPR (Consent) for optional data (e.g., phone number).

• Article 6(1)(b) GDPR (Contract fulfillment) for mandatory data (e.g., name, email, address).

3. Purpose of Data Processing

Registration is required to:

• Create a user account,

• Buy or sell goods,

• Process orders (e.g., shipping, invoicing).

4. Duration of Storage

Your data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. This is the case when:

• Your user account is deleted and no legal retention obligations (e.g., 10 years for invoices) exist.

• After the completion of a contract (e.g., purchase/sale), the data is no longer needed for contract fulfillment or legal obligations.

5. Right to Object and Remove

You can delete your registration or correct your data at any time by:

• Sending an email to [email protected] or

• Using the contact form on our website.

Note: If the data is necessary for the fulfillment of a contract or for pre-contractual measures, early deletion is only possible to the extent that no contractual or legal obligations (e.g., retention obligations) prevent it.

VII. Sale of Goods

1. Description and Scope of Data Processing

Our website offers users the opportunity to buy or sell goods. In the course of the purchase or sale process, the following data is collected and processed:

2. Payment Processing

Your payment data is transmitted to the respective payment service provider depending on the selected payment method. The payment service provider is responsible for your payment data. For some payment methods, providers may perform a credit check (scoring). We have no influence on the assessment and do not receive any results.

We work with the following payment service providers:

3. Shipping Processing

For the delivery of goods, we pass on the following data to our shipping partners:

• Name and address

• Phone number (if required for delivery)

• Email address (for shipment tracking)

We work with the following shipping service providers:

4. Legal Basis for Data Processing

The legal basis for data processing is:

• Article 6(1)(b) GDPR (Contract fulfillment) for the processing of purchase and sale contracts.

• Article 6(1)(a) GDPR (Consent) for optional data (e.g., phone number).

5. Purpose of Data Processing

The processing of data serves the execution of purchase and sale contracts, in particular:

• Delivery of goods,

• Payment processing,

• Communication with you (e.g., order confirmation, shipping status).

6. Duration of Storage

Your data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. This is the case when:

• The order is completed and no legal retention obligations (e.g., 10 years for invoices) exist.

7. Right to Object and Remove

You can view, correct, or delete your order data at any time by:

• Sending an email to [email protected] or

• Using the contact form on our website.

Note: If the data is necessary for the fulfillment of a contract or for pre-contractual measures, early deletion is only possible to the extent that no contractual or legal obligations prevent it.

VIII. Contact Form and Email Contact

1. Description and Scope of Data Processing

Our website contains a contact form that can be used for electronic contact. If you use this form, the data you enter will be transmitted to us and stored.

The following data is collected:

Alternatively, you can contact us by email. In this case, the personal data transmitted with the email will be stored.

2. Legal Basis for Data Processing

The legal basis for data processing is:

• Article 6(1)(a) GDPR (Consent) if you use the contact form.

• Article 6(1)(b) GDPR (Contract fulfillment) if the email contact is aimed at concluding a contract.

• Article 6(1)(f) GDPR (Legitimate interest) if the contact is for responding to an inquiry.

3. Purpose of Data Processing

The processing of personal data from the contact form or email serves solely to handle your inquiry.

4. Duration of Storage

Your data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. This is the case when:

• The respective conversation with you is completed and no further legal obligations (e.g., retention obligations) exist.

5. Right to Object and Remove

You can withdraw your consent to the processing of personal data at any time. To do so:

• Send an email to [email protected] or

• Use the contact form on our website.

Note: If you object to the storage of your data, the conversation cannot be continued.

IX. Rights of the Data Subject

If your personal data is processed, you have the following rights as a data subject under the GDPR against the Controller:

1. Right of Access (Article 15 GDPR)

You have the right to request confirmation from us as to whether personal data concerning you is being processed.

If such processing is taking place, you can request the following information:

• The purposes of the processing;

• The categories of personal data being processed;

• The recipients or categories of recipients to whom your data has been or will be disclosed;

• The planned duration of the storage of your data or, if this is not possible, the criteria for determining the storage period;

• The existence of a right to rectification, erasure, or restriction of processing by the Controller;

• The existence of a right to lodge a complaint with a supervisory authority;

• All available information about the source of the data, if the data was not collected from you;

• The existence of automated decision-making, including profiling (Article 22 GDPR), and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing;

• Whether your data is transferred to a third country or an international organization and what appropriate safeguards (e.g., SCCs) are in place.

2. Right to Rectification (Article 16 GDPR)

You have the right to request immediate rectification of inaccurate personal data concerning you or completion of incomplete data.

3. Right to Erasure ("Right to be Forgotten", Article 17 GDPR)

You have the right to request that we erase your personal data without undue delay, and we are obligated to do so if one of the following reasons applies:

• Your data is no longer necessary for the purposes for which it was collected or processed;

• You withdraw your consent on which the processing was based, and there is no other legal basis for the processing;

• You object to the processing (Article 21 GDPR), and there are no overriding legitimate grounds for the processing;

• Your data has been processed unlawfully;

• The erasure of your data is required to comply with a legal obligation under EU or Member State law;

• Your data was collected in relation to information society services offered to a child (Article 8(1) GDPR).

Exceptions: The right to erasure does not apply to the extent that processing is necessary:

• For the exercise of the right to freedom of expression and information;

• For compliance with a legal obligation (e.g., retention obligations under commercial or tax law);

• For reasons of public interest in the area of public health (Article 9(2)(h) and (i) and Article 9(3) GDPR);

• For archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes (Article 89(1) GDPR);

• For the establishment, exercise, or defense of legal claims.

4. Right to Restriction of Processing (Article 18 GDPR)

You have the right to request the restriction of processing of your data if:

• You contest the accuracy of your data, and we need to verify its accuracy;

• The processing is unlawful, but you oppose erasure and request restriction instead;

• We no longer need your data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims;

• You have objected to the processing (Article 21(1) GDPR), and it is not yet clear whether our legitimate grounds override yours.

If processing has been restricted, your data may only be processed – apart from storage – with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

5. Right to Notification (Article 19 GDPR)

If you have exercised the right to rectification, erasure, or restriction of processing, we are obligated to notify all recipients to whom your data has been disclosed of this rectification, erasure, or restriction – unless this proves impossible or involves disproportionate effort.

You have the right to be informed about these recipients by us.

6. Right to Data Portability (Article 20 GDPR)

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format (e.g., CSV, JSON). You also have the right to request that we transmit this data directly to another controller, where technically feasible.

Prerequisites:

• The processing is based on consent (Article 6(1)(a) GDPR) or a contract (Article 6(1)(b) GDPR);

• The processing is carried out by automated means.

Exception: The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

7. Right to Object (Article 21 GDPR)

You have the right to object at any time to the processing of your personal data based on:

• Article 6(1)(e) GDPR (public interest) or

• Article 6(1)(f) GDPR (legitimate interest),

including profiling based on these provisions.

We will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

Special Case: Direct Marketing
If your data is processed for direct marketing purposes, you have the right to object at any time to this processing (Article 21(2) and (3) GDPR). This also applies to profiling in connection with such direct marketing.

Objection Form:
You can submit your objection informally by email to [email protected] or via the contact form on our website.

8. Right to Withdraw Consent (Article 7(3) GDPR)

You have the right to withdraw your consent to data processing at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

9. Automated Individual Decision-Making, Including Profiling (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Exceptions:
Such a decision is permissible if it is:

• Necessary for entering into or performing a contract between you and us;

• Authorized by EU or Member State law and provides for suitable measures to safeguard your rights and freedoms and legitimate interests;

• Based on your explicit consent.

Note: Automated decisions based on special categories of personal data (Article 9(1) GDPR, e.g., health data) are not permitted, unless the exceptions under Article 9(2)(a) or (g) GDPR apply and suitable measures to safeguard your rights have been taken.

10. Right to Lodge a Complaint with a Supervisory Authority (Article 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of:

• Your habitual residence,

• Your place of work, or

• The place of the alleged infringement,

if you consider that the processing of your personal data infringes the GDPR.

Competent Supervisory Authority in Austria:
Austrian Data Protection Authority (DSB)
Barichgasse 40-42
1030 Vienna
Austria

Website: https://www.dsb.gv.at/
Email: [email protected]

The supervisory authority with which the complaint is lodged will inform you of the status and outcome of the complaint, including the possibility of a judicial remedy (Article 78 GDPR).

X. Updates to This Privacy Policy

We reserve the right to update this Privacy Policy from time to time, in particular in the event of:

• Changes to legal frameworks (e.g., new laws or court rulings);

• Changes to our data processing procedures or the services used.

The current version of this Privacy Policy is always available on our website at https://minijapanshop.eu/en/content/8-data-protection.