GDPR
Our Approach to Personal Data Protection
At Ilenmora, we recognize that personal information deserves careful handling throughout the online shopping process. This GDPR Data Protection Policy explains the principles and procedures that apply when personal data is processed in connection with our website, furniture purchases, customer communications, and related online services.
The General Data Protection Regulation (GDPR) applies only when its territorial and substantive requirements are met. For a website operator established outside the European Economic Area, the GDPR may apply when personal data processing is connected to offering goods or services to individuals in the EU or monitoring their behaviour there. This Policy does not imply that GDPR automatically applies to every U.S. customer or transaction.
Where GDPR applies, we aim to process personal data lawfully, fairly, and transparently, collect it for specified purposes, retain it only as necessary, and respect the rights granted to individuals by applicable data protection law.
Who Is Responsible for Processing Your Data?
The website is presented to customers under the name Ilenmora. For GDPR purposes, the data controller is the natural person or legal entity that determines why and how personal data is processed.
The controller's full legal identity must be disclosed where required by applicable law. The public-facing website name should not be treated as a substitute for the legal identity of the controller if they are different.
The contact details at the end of this Policy may be used to submit privacy questions and requests. Any designated Data Protection Officer or required representative in the European Union must also be identified separately where the GDPR requires such an appointment.
Personal Data We May Process
The categories of personal data processed depend on how you use the website and which services or technologies are actually enabled.
Identity and contact information. This may include your name, email address, telephone number, billing address, and delivery address when you place an order or communicate with customer support.
Order and transaction information. This may include products purchased, order references, order history, delivery status, refund information, and transaction details needed to administer a purchase.
Payment-related information. Information associated with a payment may be processed to complete a transaction, verify payment status, or investigate a payment problem. The exact information handled by the website and the payment provider depends on the payment arrangement.
Communications and service requests. Messages, questions, complaints, and other information you provide when seeking assistance may be processed to respond to your request and maintain relevant transaction records.
Technical and usage information. Depending on the website configuration, information such as IP address, browser type, device characteristics, access times, pages viewed, and interactions with website features may be collected through technical logs or similar technologies.
We do not intentionally request information that is unnecessary for the relevant transaction or service. Please avoid providing passwords or sensitive personal information that is not needed to resolve your request.
How and Why Personal Data Is Used
Personal data may be processed for the following purposes, depending on the activity involved.
Order and contract administration. To process purchases, arrange delivery, communicate order status, handle cancellations, and fulfil contractual obligations.
Payment and transaction verification. To process payments, investigate payment errors, maintain transaction records, and address suspected fraud.
Customer support. To answer inquiries, investigate complaints, and respond to questions about products, delivery, returns, or refunds.
Website operation and security. To maintain website functionality, diagnose technical problems, protect systems against misuse, and improve service reliability.
Legal and recordkeeping obligations. To comply with applicable laws and maintain records where necessary for accounting, taxation, dispute resolution, or legal claims.
Preferences, analytics, and marketing. Where these activities are actually used and lawful, information may help remember preferences, understand website usage, or deliver marketing communications.
We aim to collect and use only information reasonably relevant to the stated purpose. Personal data will not be used for an incompatible purpose without an appropriate legal basis or other steps required by law.
Legal Grounds for Processing
Where GDPR applies, each processing activity must have an applicable legal basis. Depending on the circumstances, the relevant basis may include:
Performance of a contract. Processing necessary to complete a purchase, arrange delivery, administer a refund, or take steps requested before entering into a contract.
Compliance with a legal obligation. Processing required to meet applicable legal, tax, accounting, or recordkeeping obligations.
Legitimate interests. Processing that is necessary for legitimate interests, such as protecting transactions, preventing fraud, maintaining website security, or administering customer inquiries, where those interests are not overridden by the individual's rights and freedoms.
Consent. Processing based on your freely given consent where consent is the applicable legal basis, including optional technologies or marketing activities when consent is required.
Where processing relies on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. Where another lawful basis applies, withdrawing consent does not automatically require the underlying processing to stop.
Disclosure to Service Providers and Other Recipients
Personal data may be disclosed to recipients where necessary for the purposes described in this Policy and permitted by law.
These recipients may include payment service providers, shipping carriers such as DHL and UPS, website hosting or technical support providers, customer service tools, and other service providers involved in the relevant activity. Analytics or advertising providers may receive information only where those services are actually used.
Information may also be disclosed where required by law, in response to a valid request from a competent authority, or where reasonably necessary to establish, exercise, or defend legal claims.
The categories of recipients depend on the services used for the particular transaction. We do not claim that every listed category of provider receives personal data in every case, nor do we treat necessary order fulfilment as automatically equivalent to selling personal information.
Cookies and Similar Technologies
Cookies and similar technologies may be used to maintain essential website functions, remember preferences, understand website performance, or support analytics and advertising where those features are enabled.
Where applicable law requires consent before optional technologies are used, the required consent must be obtained before activation. Continuing to browse the website does not automatically constitute valid consent in every circumstance.
Depending on the actual technologies in use, you may be able to change your preferences through available cookie controls or browser settings. Blocking certain cookies may affect some website features.
The technologies, providers, and retention periods must correspond to the website's actual configuration. No particular tracking tool, analytics platform, or advertising service is represented as active unless its use has been verified.
Data Retention and Security
Personal data is retained only for as long as reasonably necessary to achieve the purpose for which it was collected, subject to applicable legal obligations and legitimate recordkeeping requirements.
The retention period may depend on the type of information, the transaction involved, legal retention requirements, and the need to resolve disputes or establish and defend legal claims. When personal data is no longer required, it may be deleted, anonymized, or otherwise handled in accordance with applicable law.
Reasonable technical and organizational measures may be used to protect personal data against unauthorized access, loss, misuse, or disclosure. However, no method of online transmission or electronic storage can be guaranteed to be completely secure.
International Transfers of Personal Data
Depending on the services and systems actually used, personal data may be accessed or processed outside the country in which it was collected.
Where GDPR applies and a transfer of personal data outside the European Economic Area requires specific protection, the transfer must rely on a lawful transfer mechanism. Depending on the circumstances, this may include an applicable adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses.
The applicable mechanism depends on the destination, the recipients, and the legal circumstances of the transfer. We will not claim that a particular transfer safeguard is being used unless the relevant arrangement has been verified.
Where required by law, information about the applicable safeguard and how to obtain a copy or further details will be made available.
Your Rights Under the GDPR
Where GDPR applies to the processing of your personal data, you may have the following rights, subject to the conditions and exceptions set out in the Regulation.
Right of access. You may request confirmation of whether your personal data is being processed and obtain access to the relevant information.
Right to rectification. You may request correction of inaccurate personal data or completion of incomplete information.
Right to erasure. You may request deletion of personal data when the legal conditions for erasure are met. This right is not absolute; certain information may need to be retained to comply with the law or establish, exercise, or defend legal claims.
Right to restriction of processing. You may request that certain processing be restricted in circumstances provided by law.
Right to data portability. Where the legal conditions are met, you may request personal data that you have provided in a structured, commonly used, machine-readable format and transmit it to another controller.
Right to object. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation, subject to the legal conditions. You have the right to object at any time to the processing of personal data for direct marketing.
Right to withdraw consent. Where processing is based on consent, you may withdraw that consent at any time.
Rights concerning automated decisions. Where applicable, you may have rights concerning decisions based solely on automated processing that produce legal effects or similarly significant effects. The scope of these rights depends on the circumstances and legal exceptions.
These rights are not unconditional in every case. A request may be subject to verification of identity and to lawful exceptions. We will explain any applicable limitation where required.
How to Submit a Data Protection Request
You may submit a request to access, correct, delete, restrict, or obtain a portable copy of your personal data by using the contact details at the end of this Policy.
Please describe the right you wish to exercise and provide enough information for us to locate the relevant records. We may request additional information where reasonably necessary to verify your identity or authority, but we will avoid requesting information that is unrelated to the request.
Where GDPR applies, we generally respond to requests without undue delay and within one month of receipt. If a request is complex or multiple requests have been received, the applicable response period may be extended by up to 2 additional months where legally permitted. If an extension is necessary, we will inform you within the initial one-month period and explain the reasons.
Where a request cannot be fulfilled, we will provide an explanation and information about available complaint or judicial remedies where required by law.
Right to Complain to a Supervisory Authority
If you believe that the processing of your personal data violates the GDPR or other applicable data protection law, you may have the right to lodge a complaint with a competent data protection supervisory authority.
Where applicable, you may complain to the supervisory authority in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement. The appropriate authority and procedure depend on the circumstances and applicable law.
You may also have the right to seek a judicial remedy where provided by law. Contacting us directly about a privacy concern does not remove your right to submit a complaint to a supervisory authority.
Personal Data Required for Transactions
Certain information, such as contact details, delivery information, and necessary transaction details, may be needed to process an order or perform a contract.
If you choose not to provide information that is essential to a requested transaction, we may be unable to accept the order, arrange delivery, complete the payment process, or respond fully to the request. Where information is optional, the consequences of not providing it may differ.
We will aim to distinguish information that is necessary for a transaction from information requested for optional purposes where applicable.
Children's Data
Our furniture shopping website is intended for a general shopping audience. We do not intend to process children's personal data in a manner that violates applicable law.
If you believe that personal data relating to a child has been collected or processed unlawfully, please contact us. We will review the issue and take appropriate steps as required by applicable law.
Changes to This Policy
This GDPR Data Protection Policy may be updated to reflect changes in website operations, personal data processing, service arrangements, or legal requirements.
The revised version will identify its effective or revision date. Where applicable law requires additional notice or consent for a change, the relevant requirements will be followed.
Contact Information
For questions about this Policy, requests to exercise data protection rights, or concerns about the processing of personal data, please contact us using the details below.
Email: solutions@ilenmora.com
Phone: +81 98-682-4736
Address: Room 204, Forest Casa, 1399 Maezato, Itoman City, Okinawa 901-0362, Japan
Customer Service Hours: Monday through Friday, 9:00 AM–6:00 PM Eastern Time (ET)