KRCY Shop | Privacy Policy
Last Updated: June 1, 2026
This Privacy Policy (hereinafter referred to as "Policy") explains how KRCY Shop (hereinafter referred to as "we", "us", or "our") collects, uses, stores, shares, and protects your personal data when you access or use our website (krcyshop.com, hereinafter referred to as "the Site"), purchase products, or interact with us. This Policy applies to all users of the Site, including visitors, customers, and account holders. By using the Site, you agree to the collection and processing of your personal data in accordance with this Policy. We reserve the right to modify this Policy at any time; any updates will be posted on this page, and your continued use of the Site after the updates take effect constitutes your acceptance of the revised Policy.
1. Data Controller Information
Data Controller: [Insert Your Company Full Name Here];
Address: [Insert Your Company Address Here];
Contact Email: [privacy@krcyshop.com];
Contact Phone: [Insert Your Contact Phone Number Here].
For EU users: If applicable, Data Protection Officer (DPO) contact information: [privacy@krcyshop.com].
2. Types of Personal Data Collected
2.1 Identifying Information: Name, email address, phone number, shipping/billing address, date of birth (if required for age verification).
2.2 Payment Information: Credit/debit card details, PayPal account information (processed by third-party payment providers; we do not store full card details).
2.3 Account Information: Username, password (encrypted), account preferences, order history, and communication history.
2.4 Browsing and Usage Data: IP address, device type, browser type, operating system, referring URLs, pages visited, time spent on the Site, and clickstream data (collected via cookies and similar technologies).
2.5 Marketing Data: Consent status for receiving marketing communications, preferences, and interaction with marketing materials.
2.6 Customer Service Data: Information provided when contacting customer service, including inquiries, complaints, and feedback.
2.7 Sensitive Personal Data: We do not collect sensitive personal data (e.g., racial or ethnic origin, political opinions, religious beliefs, health data) unless explicitly required and with your express consent.
3. Purposes of Data Processing
3.1 Order Processing and Fulfillment: Process your orders, arrange shipping, send order confirmations and delivery updates, and handle returns and refunds. Legal basis: Performance of a contract with you (GDPR Article 6(1)(b)).
3.2 Account Management: Create and manage your account, provide personalized services, and maintain account security. Legal basis: Performance of a contract with you (GDPR Article 6(1)(b)) and legitimate interest in providing secure account services (GDPR Article 6(1)(f)).
3.3 Customer Service: Respond to your inquiries, resolve issues, and provide support. Legal basis: Legitimate interest in providing customer service (GDPR Article 6(1)(f)) and performance of a contract (if related to an order).
3.4 Marketing Communications: Send you promotional offers, product updates, and newsletters (only with your explicit consent). Legal basis: Consent (GDPR Article 6(1)(a)). You may withdraw your consent at any time by clicking the "unsubscribe" link in marketing emails or contacting us.
3.5 Website Improvement: Analyze user behavior, optimize the Site’s performance and user experience, and prevent fraud. Legal basis: Legitimate interest in improving our services (GDPR Article 6(1)(f)) and compliance with legal obligations (GDPR Article 6(1)(c)).
3.6 Legal Compliance: Comply with applicable laws, regulations, and legal requests, and protect our legal rights. Legal basis: Compliance with legal obligations (GDPR Article 6(1)(c)) and legitimate interest in protecting our rights (GDPR Article 6(1)(f)).
4. Legal Bases for Processing (GDPR Specific)
We process your personal data based on the following legal bases as required by GDPR:
4.1 Consent: When you explicitly agree to data processing (e.g., for marketing purposes).
4.2 Contract Performance: When processing is necessary to fulfill our contractual obligations to you (e.g., order processing).
4.3 Legal Obligation: When processing is required by law (e.g., tax and accounting requirements).
4.4 Legitimate Interests: When processing is necessary for our legitimate business interests, provided that your rights and freedoms do not override these interests (e.g., fraud prevention, website improvement). We have conducted a legitimate interest assessment (LIA) to ensure compliance with GDPR requirements.
5. Data Retention Periods
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:
5.1 Order and Account Data: Retained for [X] years after the last order or account activity (to comply with tax and accounting laws and resolve potential disputes).
5.2 Marketing Data: Retained until you withdraw your consent or unsubscribe from marketing communications.
5.3 Browsing and Usage Data: Retained for [X] months (for website improvement and analytics purposes).
5.4 Customer Service Data: Retained for [X] years after the last interaction (to address future inquiries and comply with legal obligations).
5.5 After retention periods expire: Your data will be securely deleted or anonymized so that it can no longer be associated with you.
6. Data Sharing and Disclosure
6.1 Third-Party Service Providers: We share your data with trusted third-party service providers who assist us in operating the Site and providing services, including: Payment processors (e.g., PayPal, Stripe), Logistics and shipping providers (e.g., DHL, FedEx), Email marketing platforms (e.g., Mailchimp), Analytics tools (e.g., Google Analytics), Fraud prevention services. These providers are contractually obligated to protect your data and use it only for the purposes specified by us.
6.2 Legal Requirements: We may disclose your data if required by law, regulation, or legal process, or to protect our rights, property, or safety, or that of others.
6.3 Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred to the new owner, subject to the same privacy protections.
6.4 With Your Consent: We may share your data with third parties for other purposes with your explicit consent.
7. International Data Transfers
7.1 Data Transfer Mechanisms: Since we are based in [Your Country, e.g., China], your data may be transferred to and processed in countries outside your jurisdiction, including [List Countries, e.g., China, United States].
For transfers to countries outside the EU/EEA, we ensure adequate protection by using: EU Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs) if applicable, or other mechanisms approved by the European Commission.
For transfers to the US, we participate in the EU-US Data Privacy Framework (DPF) and/or UK-US Data Privacy Framework (UK DPF) where applicable.
7.2 Your Rights: You have the right to obtain information about the specific safeguards used for international data transfers by contacting us.
8. User Rights Under Applicable Laws
8.1 GDPR Rights (for EU/EEA users): Right to access your personal data; Right to rectify inaccurate data; Right to erasure ("right to be forgotten"); Right to restrict processing; Right to data portability; Right to object to processing; Right to withdraw consent at any time; Right to lodge a complaint with a supervisory authority.
8.2 CCPA/CPRA Rights (for California users): Right to know what personal data is collected, used, and disclosed; Right to delete personal data; Right to opt-out of the sale or sharing of personal data; Right to correct inaccurate data; Right to limit the use and disclosure of sensitive personal information; Right to non-discrimination for exercising rights.
8.3 PIPEDA Rights (for Canadian users): Right to access your personal data; Right to request correction of inaccurate data; Right to be informed of the purpose of data collection; Right to withdraw consent (where applicable).
8.4 APP Rights (for Australian users): Right to access your personal data; Right to request correction of data; Right to complain about data handling; Right to be informed of data breaches that may affect you.
8.5 How to Exercise Rights: To exercise any of these rights, please contact us at [privacy@krcyshop.com]. We will respond to your request within [30-45] days as required by applicable law.
9. Cookies and Similar Technologies
9.1 Cookie Usage: We use cookies and similar technologies (e.g., web beacons, pixels) to enhance your browsing experience, analyze site traffic, and personalize content.
9.2 Types of Cookies: Necessary cookies (required for basic site functionality, cannot be disabled); Performance cookies (collect data on how users interact with the Site); Functional cookies (remember user preferences); Targeting/advertising cookies (used to deliver relevant ads).
9.3 Cookie Consent: You can manage your cookie preferences through our cookie banner or by adjusting your browser settings. You may disable non-necessary cookies, but this may affect site functionality.
9.4 Third-Party Cookies: Some cookies are set by third-party service providers (e.g., Google Analytics, payment processors). Please refer to their privacy policies for more information.
9.5 Cookie Policy: For detailed information, please see our separate Cookie Policy.
10. Data Security Measures
We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, use, disclosure, alteration, or destruction. These measures include: Encryption of data in transit (SSL/TLS) and at rest; Regular security audits and vulnerability assessments; Access control mechanisms (role-based access, strong authentication); Employee training on data protection and security; Incident response plan for data breaches. While we strive to protect your data, no security system is completely foolproof. We cannot guarantee absolute security, but we will take all reasonable steps to mitigate risks.
11. Children's Privacy
Our Site is not intended for children under the age of 16 (or 13 for US users under COPPA). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will delete it immediately. If you believe we have collected data from a child, please contact us.
12. Changes to This Policy
We may update this Policy from time to time to reflect changes in our data practices or legal requirements. We will post the updated Policy on this page with a new "Last Updated" date. We encourage you to review this Policy periodically. Your continued use of the Site after the changes take effect constitutes your acceptance of the revised Policy.
13. Contact Information
For any questions, concerns, or requests related to this Policy, data protection, or to exercise your rights, please contact us at:
Email: [privacy@krcyshop.com];
Address: [Insert Your Company Address Here];
Phone: [Insert Your Contact Phone Number Here].
For EU users: You may also lodge a complaint with your local data protection authority (DPA).