Data Protection Policy (GDPR)

1. Scope and Legal Framework

This policy covers the processing of personal data in connection with the use of our online store and the sale of furniture and clothing, particularly for users located in Germany, France, Spain and Italy.

Personal data is processed in accordance with Regulation (EU) 2016/679 on the protection of personal data (GDPR), as well as applicable national data protection and electronic communications laws.

Our delivery area includes Germany, France, Spain and Italy. This commercial limitation does not restrict the rights of other individuals whose data is protected by applicable regulations.

2. Personal Data, Purposes and Legal Bases

Depending on the services used and the information provided, the data processed may include:

Identification and contact details: first name, last name, email address and telephone number.
Information needed to process an order: billing and delivery addresses, products purchased, selected sizes or dimensions, payment amount and payment status.
Communications with customer service about orders, deliveries, cancellations, returns and warranties.
Technical data needed to operate and secure the website, such as IP addresses and connection logs.
Marketing preferences and data from optional trackers, where these features are used and the required consent has been obtained.

Processing is based on the following legal grounds:

Performance of a contract or steps taken before entering into a contract: processing orders and payments, arranging delivery and handling returns and purchase-related requests.
Legal obligations: billing, accounting and compliance with obligations applicable to the seller.
Legitimate interests: fraud prevention, website security and protection of our rights, subject to respect for users’ rights and freedoms.
Consent: marketing communications and the use of optional cookies or trackers where required by law.

Information essential to processing an order is identified when it is collected. Without it, we may be unable to conclude the contract or deliver the order.

3. Fundamental Data Processing Principles

In accordance with Article 5 of the GDPR, we observe the following principles:

Lawfulness, fairness and transparency.
Collection for specified, explicit and legitimate purposes.
Limiting data to what is necessary.
Accuracy and keeping information up to date.
Limiting the retention period.
Protecting the confidentiality and integrity of data.

4. User Rights

Subject to the conditions set out in the GDPR, users have the following rights:

The right to access their personal data.
The right to have inaccurate or incomplete data rectified.
The right to erasure.
The right to restriction of processing.
The right to data portability where automated processing is based on consent or a contract.
The right to object, on grounds relating to their particular situation, to processing based on legitimate interests.
The right to object to direct marketing at any time.
The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
The right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them, subject to statutory exceptions.

Requests may be sent to warranty@soleniaroom.com. If there is reasonable doubt about the requester’s identity, we may ask for additional information strictly necessary to verify it.

We respond without undue delay and, in principle, within one month of receiving the request. This period may be extended by up to two additional months due to the complexity or number of requests. In that case, the user will be informed of the extension and the reasons for it within the first month.

Users may also lodge a complaint with the competent supervisory authority, including the authority in their habitual residence, place of work or the place of the alleged infringement: the CNIL in France, the competent data protection authority in Germany, the AEPD in Spain or the Garante per la protezione dei dati personali in Italy.

5. Security and Retention Periods

We implement technical and organisational measures appropriate to the risks to protect data against unauthorised access, disclosure, loss or alteration. Access is restricted to people who need the information to perform their duties.

Data is not retained indefinitely. Retention periods depend on the purpose:

Order and after-sales service data: for as long as needed to fulfil the order and handle returns, warranties and complaints, then, where necessary, in restricted archives for the applicable statutory limitation periods.
Invoices and accounting records: for the period required by the accounting and tax obligations that actually apply to our business.
Marketing data: until consent is withdrawn or an objection is made, subject to applicable retention limits. Information strictly necessary to honour an objection may be retained for that purpose alone.
Technical logs: for a period proportionate to security and diagnostic needs, with longer retention only where justified by an incident or legal obligation.
Cookies and trackers: for the periods stated in the cookie information and in the consent management tool, where applicable.

When the necessary retention periods expire, data is deleted or irreversibly anonymised unless we are legally required to retain it.

6. Recipients and International Transfers

To the extent necessary for their duties, data may be shared with providers involved in website hosting, payments, delivery, technical support and order management, as well as with authorised authorities or professional advisers where necessary or legally required.

Providers acting as processors handle data on our instructions under agreements that comply with Article 28 of the GDPR. Some recipients may act as independent data controllers for their own legal obligations.

Where data is transferred outside the European Economic Area, including to Japan if it is processed there, the transfer must rely on a mechanism that complies with Chapter V of the GDPR:

An adequacy decision by the European Commission, where the recipient and processing fall within its scope.
Otherwise, appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with any necessary assessments and supplementary measures.

The adequacy decision concerning Japan does not automatically cover all recipients or processing activities. Its applicability must be checked for each relevant transfer.

Users may contact us for details about transfer destinations and applicable safeguards, and for a copy of those safeguards where provided for by applicable regulations.

7. Data Controller

The data controller is the operator of the store:

Name or legal name: [to be completed with the operator’s legal identity]

Address: 202, 4-22-22 SHIOHARA, MINAMI-KU, FUKUOKA-SHI, FUKUOKA-KEN 815-0032, JAPAN

Email: warranty@soleniaroom.com

Where Article 27 of the GDPR requires the appointment of a representative in the European Union, their identity and contact details are provided here: [to be completed, if applicable].

The contact details of a Data Protection Officer will also be provided if one is appointed.