Privacy and Cookie Policy
Last updated: July 2026
The Kintsugi Labo JAPAN restores ceramics by hand in Japan and sends them to collectors around the world. To do that, we need a small amount of information about you. This policy explains exactly what we collect, why we collect it, who else sees it, how long we keep it, and what you can ask us to do with it.
If anything here is unclear, please write to us at info@isono-revitalizing-office.jp. We answer every enquiry personally.
1. Who is responsible for your personal data
The data controller is:
Isono Revitalizing Office LLC, trading as The Kintsugi Labo JAPAN
Room 202, 521 Nojiri, Ritto City, Shiga Prefecture, Japan 520-3027
Email: info@isono-revitalizing-office.jp
Telephone: +81-77-515-2918
We are a small company. There is no data protection officer, and none is required for the scale and nature of our processing. Enquiries about your personal data are handled directly by our Managing Partners, Ken Isono and Michie Isono.
2. The personal data we collect
Information you give us
- Identity and contact details — your name, email address, delivery address, billing address and telephone number.
- Order details — the pieces you buy, order number, order value, currency, and any message or instruction you add at checkout (for example a hotel name and check-in date for hotel delivery, or a gift recipient's details).
- Correspondence — the content of emails, contact form messages and messages sent to us through social media.
- Newsletter preferences — your email address and whether you have subscribed or unsubscribed.
- Customs documentation — occasionally, customs authorities in your country request identification or supporting documents for a high-value import. If you choose to send such a document to us so that we can assist with clearance, we handle it as described in section 6.
Information we receive from others
- Payment confirmation — our payment providers tell us whether a payment succeeded, the payment method type and the last four digits of a card. We never receive or store your full card number, expiry date or security code.
- Delivery status — DHL Express and Japan Post provide tracking and delivery confirmation.
Information collected automatically
- Device and usage data — IP address, browser type and version, operating system, referring page, pages viewed, and the time and duration of your visit.
- Cookie data — see section 9.
We do not seek or knowingly collect special category data (health, religion, political opinions, biometric data and so on). Please do not send us such information.
3. Why we use your data, and our legal basis
Under the GDPR we must have a lawful basis for every use of your personal data. Ours are set out below.
| What we do | Data used | Legal basis |
|---|---|---|
| Take, confirm and fulfil your order; arrange restoration handover and packing | Identity, contact, order details | Performance of a contract (Art. 6(1)(b)) |
| Ship your order and prepare export and customs declarations | Identity, contact, order details | Performance of a contract, and legal obligation for export documentation (Art. 6(1)(b), 6(1)(c)) |
| Take payment and prevent fraudulent transactions | Contact, order, payment confirmation | Performance of a contract, and our legitimate interest in preventing fraud and chargeback loss (Art. 6(1)(b), 6(1)(f)) |
| Handle returns, withdrawals, refunds and warranty restorations | Identity, contact, order details, correspondence | Performance of a contract, and legal obligation under consumer law (Art. 6(1)(b), 6(1)(c)) |
| Answer your questions and provide aftercare advice | Contact, correspondence | Legitimate interest in responding to people who contact us (Art. 6(1)(f)) |
| Keep accounting, tax and invoice records | Identity, contact, order details | Legal obligation under Japanese tax and corporate law (Art. 6(1)(c)) |
| Send our newsletter about new works | Email address, newsletter preferences | Consent (Art. 6(1)(a)) |
| Assist with customs clearance when you ask us to | Customs documentation | Consent, and performance of a contract (Art. 6(1)(a), 6(1)(b)) |
| Measure how the site is used and improve it, using Google Analytics | Device and usage data, analytics cookies | Consent (Art. 6(1)(a)) |
| Measure the performance of our advertising and show relevant works to people who have visited our site, using Google Ads | Device and usage data, marketing cookies | Consent (Art. 6(1)(a)) |
| Keep the site and our systems secure | Device and usage data | Legitimate interest in protecting our business and customers (Art. 6(1)(f)) |
| Establish, exercise or defend legal claims | Any of the above, as relevant | Legitimate interest in protecting our legal position (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and freedoms, and concluded that it is not. You may object to any of this processing — see section 8.
Where we rely on consent, you may withdraw it at any time, without affecting anything we did before you withdrew it. Use the unsubscribe link in any newsletter, change your cookie choices through the banner, or simply email us.
4. Who we share your data with
We do not sell your personal data, and we do not share it for anyone else's marketing purposes.
We share it only with the following recipients, and only as far as each of them needs it:
- E-commerce platform — Shopify Inc. and its affiliates host our store, process orders and provide our newsletter tool.
- Payment providers — the provider you choose at checkout, from among Shopify Payments, PayPal, Amazon Pay, Apple Pay, Google Pay and Shop Pay. They act as independent controllers for the payment itself and have their own privacy policies.
- Carriers and customs — DHL Express for international delivery, Japan Post for domestic delivery, and the customs authorities of Japan and your destination country. Export and import declarations require your name and address by law.
- Analytics and advertising — Google Ireland Limited and Google LLC, which provide Google Analytics and Google Ads. They receive device and usage data only where you have consented to analytics or marketing cookies. We do not use any other analytics or advertising network.
- Professional advisers — our accountant and, if ever needed, our lawyers, under a duty of confidentiality.
- Authorities — where we are required to disclose information by law, or where disclosure is necessary to prevent fraud or to establish or defend a legal claim.
Where these parties act as our processors, they are bound by a written contract requiring them to process your data only on our instructions and to keep it secure.
5. International transfers
We are established in Japan, so your personal data is transferred to Japan and stored there.
For customers in the European Economic Area and the United Kingdom, this transfer is protected as follows:
- Japan — the European Commission adopted an adequacy decision for Japan in January 2019, confirming that Japan provides a level of protection essentially equivalent to that of the EU. The United Kingdom recognises Japan on the same basis. No further safeguard is required for transfers to us.
- Shopify — some data is stored or accessed outside Japan and the EEA, including in Canada, the United States and Ireland. These transfers are covered by the Standard Contractual Clauses approved by the European Commission, and the UK International Data Transfer Addendum where relevant, incorporated into our data processing agreement with Shopify.
- Google — for visitors in the EEA and the UK, Google Analytics and Google Ads are provided by Google Ireland Limited. Where data is transferred onward to Google LLC in the United States, that transfer relies on the EU–US Data Privacy Framework, under which Google LLC is certified, together with the Standard Contractual Clauses and the supplementary measures set out in Google's own data transfer documentation.
- Carriers and customs authorities — where your parcel is sent to a country without an adequacy decision, the transfer of your name and address to the carrier and to that country's customs authority is necessary for the performance of your contract with us (Art. 49(1)(b)).
You may request a copy of the safeguards we rely on by emailing us.
6. How long we keep your data
| Category | Retention period |
|---|---|
| Order, invoice and accounting records | 7 years from the end of the relevant financial year, as required by Japanese tax and corporate law (extended to 10 years where a loss carry-forward applies) |
| Delivery and customs records | 5 years from shipment, in line with export record-keeping requirements |
| Warranty and conformity records | 6 years from delivery, reflecting the longest statutory guarantee period that may apply to customers in the United Kingdom, plus the period of any open claim |
| Customs identification documents you send us | Deleted as soon as clearance is complete, and in any event within 30 days |
| Newsletter subscription | Until you unsubscribe, plus a minimal suppression record so that we do not contact you again |
| General correspondence | 3 years from our last exchange |
| Google Analytics data | 14 months from your last visit, after which it is deleted automatically |
| Google Ads audience data | 13 months at most, after which it expires automatically |
When a retention period ends, we delete the data or irreversibly anonymise it.
7. Is providing your data required?
Providing your name, delivery address, billing address and email address is a contractual requirement: without it we cannot accept your order, ship a piece to you, or issue a customs declaration. If you do not provide it, we cannot enter into a contract with you.
Everything else — your telephone number, newsletter subscription, and any non-essential cookies — is entirely optional. Declining has no effect on your order.
8. Your rights
If you are in the EEA or the UK, you have the following rights. They are free to exercise, and we will respond within one month (extendable by two further months for complex requests, in which case we will tell you why).
- Access — to be told whether we hold data about you and to receive a copy of it.
- Rectification — to have inaccurate data corrected and incomplete data completed.
- Erasure — to have your data deleted where we no longer need it, where you withdraw consent, or where you successfully object. This right does not extend to records we must keep for tax or legal reasons.
- Restriction — to have us pause our use of your data while a dispute about its accuracy or our legal basis is resolved.
- Objection — to object at any time to processing based on legitimate interests. You may object to direct marketing at any time, and we will stop immediately and unconditionally.
- Portability — to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible.
- Withdrawal of consent — at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these, email info@isono-revitalizing-office.jp. We may ask you to confirm your identity — usually by writing from the email address used for your order — so that we do not disclose your data to someone else.
Complaints. If you believe we have handled your data unlawfully, we would like the chance to put it right, so please contact us first. You also have the right to lodge a complaint with a supervisory authority — in the EEA, the authority in the country where you live, work, or where the alleged infringement took place (a list is maintained by the European Data Protection Board at edpb.europa.eu); in the UK, the Information Commissioner's Office at ico.org.uk. Residents of Japan may contact the Personal Information Protection Commission at ppc.go.jp.
9. Cookies and similar technologies
A cookie is a small text file placed on your device when you visit a website. We use them in three categories.
Strictly necessary cookies keep the site working. They remember what is in your basket, keep you signed in during checkout, secure your session, and record your cookie preferences. The site cannot function without them, so they are set without consent.
Analytics cookies are set by Google Analytics and tell us how many people visit, which pages they read, and where they arrived from, so that we can improve the site. Google Analytics collects your IP address in order to determine your approximate location, but does not store it. These cookies are set only if you consent.
Marketing cookies are set by Google Ads. They allow us to measure whether an advertisement led to a visit or an order, and to show our works again to people who have already visited the site. These cookies are set only if you consent.
The main cookies used on this site are as follows. Expiry periods are those documented by the provider and may change.
| Cookie | Set by | Purpose | Category | Expires |
|---|---|---|---|---|
cart, cart_ts, cart_sig
|
Shopify | Remembers the contents of your basket | Strictly necessary | Up to 2 weeks |
_secure_session_id |
Shopify | Secures your checkout session | Strictly necessary | 24 hours |
_shopify_y, _shopify_s
|
Shopify | Distinguishes visitors and sessions for essential store functions | Strictly necessary | Up to 1 year |
| Cookie consent record | Shopify | Remembers whether you accepted or declined non-essential cookies | Strictly necessary | Up to 1 year |
_ga |
Distinguishes visitors | Analytics | Up to 2 years | |
_ga_<container-id> |
Retains session state for Google Analytics | Analytics | Up to 2 years | |
_gcl_au |
Links a visit to an advertisement click, so conversions can be measured | Marketing | 90 days | |
IDE, test_cookie
|
Google (doubleclick.net) | Measures advertising performance and shows relevant advertisements | Marketing | Up to 13 months |
Your choices. When you first visit, our banner lets you accept or decline non-essential cookies. Until you accept, no analytics or marketing cookies are set and no data is sent to Google. Declining does not limit your ability to browse or buy. You can change your mind at any time by clearing the cookies for this site in your browser and reloading the page, which will bring the banner back. Most browsers also let you block or delete cookies entirely through their settings, though blocking strictly necessary cookies will prevent checkout from working.
You can additionally opt out of Google Analytics on every website by installing Google's browser add-on at tools.google.com/dlpage/gaoptout, and manage the advertising Google shows you at myadcenter.google.com.
10. Automated decision-making
We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you.
Our platform does apply an automated fraud-risk indicator to incoming orders. It never cancels an order by itself: it only flags an order for a human to review, and any decision to decline an order is taken by us personally. If an order of yours is declined, you may ask us why, express your point of view, and ask us to reconsider.
11. Security
Your data is held on Shopify's platform, which is PCI DSS compliant, and in our own email and accounting systems, which are protected by strong authentication. All pages of this site are served over an encrypted connection (TLS). Access is limited to the two Managing Partners and to service providers bound by confidentiality obligations. We never see or store full payment card details.
No system is perfectly secure. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, and notify the relevant supervisory authority within 72 hours as required.
12. Children
Our store is intended for adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us their data, please contact us and we will delete it.
13. Information for customers in Japan
For the purposes of Japan's Act on the Protection of Personal Information, the business handling your personal information is Isono Revitalizing Office LLC, at the address in section 1. Our purposes of use are those set out in section 3. We do not provide personal data to third parties without your consent except where the Act permits, and except for entrustment to the service providers listed in section 4 and joint use for delivery and customs purposes. Requests for disclosure, correction, suspension of use or deletion, and any complaints, should be sent to info@isono-revitalizing-office.jp.
Transfers outside Japan
We provide personal data to third parties located outside Japan, namely Shopify Inc. (Canada, the United States and Ireland), Google Ireland Limited and Google LLC (Ireland and the United States), and DHL group companies in the destination country of your parcel, and the payment provider you select at checkout. We do so on the basis that each recipient has established a system conforming to the standards prescribed under Article 28 of the Act and the Rules thereunder. Information on the personal data protection regimes of the countries concerned, and on the measures taken by each recipient, is available on request at info@isono-revitalizing-office.jp.
14. External links
Our site links to third-party sites, including carriers and customs authorities. This policy does not apply to them. Please read their own privacy policies before providing them with any information.
15. Changes to this policy
We may update this policy as our practices or the law change. The date at the top shows when it was last revised. Where a change materially affects how we use your data, we will tell subscribers by email and post a notice on this page. Changes apply going forward and are not retroactive.
16. Contact
Isono Revitalizing Office LLC (The Kintsugi Labo JAPAN)
Room 202, 521 Nojiri, Ritto City, Shiga Prefecture, Japan 520-3027
info@isono-revitalizing-office.jp
+81-77-515-2918
We reply to every message within 24 business hours.