Privacy Policy

Last updated: 8 August 2026

KaijuMonsteR (“we”, “us”, “our”) is committed to protecting your personal data and complying with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). This Privacy Policy explains how we collect, use, and protect your personal information when you visit kaijumonster.com or purchase from us.

1. Data Controller

The data controller responsible for your personal data is:

KaijuMonsteR
[STREET ADDRESS, CITY, POSTAL CODE], Netherlands
Email: [email protected]
Chamber of Commerce (KvK):
VAT:
Data Protection Contact: [email protected]

[OPTIONAL: EU Representative under Art. 27 GDPR: TO BE FILLED IF APPLICABLE]

2. Data We Collect

We collect only the personal data necessary for the purposes described below. This may include:

Identity & contact data: name, email address, billing and shipping address, phone number (where provided).
Order data: products ordered, order history, delivery details, purchase value.
Payment data: we do not store full card numbers or full bank details. Payment is processed by our payment providers (e.g. Stripe, PayPal), which may share limited transaction metadata with us (such as the last four digits of your card, a transaction ID, and billing country).
Account data: if you create an account, your login email, hashed password, and account preferences.
Communications data: the content of messages you send us and records of our responses.
Technical data: IP address, browser type and version, device information, referring URLs, and usage data collected via cookies and similar technologies (see our Cookie Policy).

3. Legal Basis for Processing

We process your personal data under one or more of the following legal bases under Article 6 GDPR:

Performance of a contract (Art. 6(1)(b)) — to process and fulfil your orders, deliver Goods, and handle returns.
Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and consumer law record-keeping requirements (e.g. invoicing, VAT).
Legitimate interests (Art. 6(1)(f)) — to operate and secure our business, prevent fraud, analyse and improve the Site, and provide customer support, balanced against your privacy rights.
Consent (Art. 6(1)(a)) — for marketing communications, non-essential cookies, and optional features, where you have given consent. You may withdraw consent at any time.

4. How We Use Your Data

We use your personal data to:

process, fulfil, and deliver your orders, including returns and refunds;
communicate with you about your orders and customer service requests;
process payments securely and prevent fraud;
comply with legal and tax obligations;
operate, maintain, and improve the Site and our services;
send marketing newsletters and offers, only where you have consented or otherwise permitted by law (you can unsubscribe at any time);
respond to your enquiries and provide support.

We do not sell your personal data to third parties.

5. Third-Party Processors

We share personal data with trusted third parties who act as processors or independent controllers to help us run our business. Each operates under its own privacy policy and, where applicable, under GDPR-compliant data processing agreements:

Processor	Purpose	More information
Stripe	Card payments and payment security (PCI-DSS)	stripe.com/privacy
PayPal	PayPal payments	paypal.com/privacy
Apple Pay / Google Pay	Wallet-based payments (tokenised)	apple.com/legal/privacy · policies.google.com/privacy
WordPress / WooCommerce	Site and e-commerce platform hosting and order management	wordpress.org/about/privacy
Cloudflare	Security, DDoS protection, performance, and CDN	cloudflare.com/privacypolicy
Shipping carriers (e.g. PostNL and partners)	Delivery of orders and tracking	carrier privacy policies
Email service / hosting provider	Transactional and marketing email delivery
[Analytics provider]	Site usage analytics (where enabled)

We may also disclose data where required by law, court order, or competent authority, or to protect our rights, safety, or property.

6. International Transfers

Some processors (for example, certain payment and cloud providers) are located outside the EU/EEA, including in the United States. Where your personal data is transferred to a third country, we rely on an adequacy decision (e.g. the EU–U.S. Data Privacy Framework where the recipient is certified), Standard Contractual Clauses, or another lawful transfer mechanism under Chapter V GDPR.

You may request a copy of the safeguards used for such transfers by contacting us at [email protected].

7. Data Retention

We retain personal data only as long as necessary for the purposes set out in this policy and to comply with legal obligations. In particular:

Order, invoicing, and tax records are retained for the period required by Dutch/EU tax and commercial law (typically 7 years).
Customer account data is retained while your account is active and for a reasonable period after deletion to comply with legal obligations.
Marketing data is retained until you unsubscribe or withdraw consent, after which it is deleted or anonymised.
Technical and usage data is retained for a limited period in accordance with our Cookie Policy.

8. Cookies

We use cookies and similar technologies for essential functionality, analytics, and (where you consent) marketing. Full details, including cookie types, purposes, retention periods, and how to manage or delete them, are set out in our Cookie Policy.

9. Your Rights

Under the GDPR and the EU ePrivacy rules, you have the following rights regarding your personal data:

Right of access — to obtain a copy of your personal data and information about how we process it.
Right to rectification — to have inaccurate or incomplete data corrected.
Right to erasure (“right to be forgotten”) — to request deletion of your personal data, subject to legal retention obligations.
Right to restriction of processing — to limit how we use your data in certain circumstances.
Right to data portability — to receive your personal data in a structured, machine-readable format and to transmit it to another controller.
Right to object — to object to processing based on legitimate interests or for direct marketing.
Rights regarding automated decision-making and profiling — not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
Right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at [email protected]. We will respond within one month (extendable by two further months for complex requests, in which case we will inform you of the extension).

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS/HTTPS), access controls, and regular reviews of our systems. Payment data is handled exclusively by PCI-DSS-compliant processors. No method of transmission or storage is completely secure, but we work to protect your data using industry standards.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected individuals, in accordance with Articles 33–34 GDPR.

11. Children

Our Site is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Changes

We may update this Privacy Policy from time to time. The “Last updated” date indicates the most recent version. We encourage you to review this page periodically.

13. Contact & Complaints

If you have any questions about this Privacy Policy or how we handle your data, contact us at [email protected].

If you believe we have not handled your data in accordance with the law, you have the right to lodge a complaint with your local data protection authority or with the Dutch supervisory authority:

Autoriteit Persoonsgegevens (Dutch DPA)
Postbus 93374, 2509 AJ Den Haag, Netherlands
autoriteitpersoonsgegevens.nl