Privacy Policy

1) Introduction

This Privacy Policy explains how New kenshi collects, uses, stores, shares and protects personal data relating to users and customers of the website New kenshi.

The data controller is established in France. Personal data processed in the context of this French establishment is therefore handled in accordance with the EU General Data Protection Regulation (GDPR), the French Data Protection Act and other applicable European data-protection requirements.

For users and customers in Hong Kong, the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and its Data Protection Principles may also apply to relevant collection, holding, processing or use of personal data to the extent that such activities fall within the scope of Hong Kong law.

Under the PDPO, an organisation that controls the collection, holding, processing or use of personal data is referred to as a "data user".

By using the website, you acknowledge that you have had an opportunity to read this Privacy Policy. Where consent is legally required, including for certain marketing or tracking activities, consent is requested separately and may be withdrawn in accordance with applicable law.

2) Data Controller / Data User

Where a data protection officer or another person responsible for privacy matters has been formally appointed, that person may be contacted using the details published on the website or through contact@kenshiblades.com.

Requests concerning access to or correction of personal data may also be sent to the contact details above, subject to any formal requirements imposed by applicable law.

3) Personal Data Collected

New kenshi collects personal data that is reasonably necessary for website operation, order fulfilment, customer service, security, legal compliance and the improvement of the user experience.

The categories of personal data may include:

• Identification and contact data: first name, surname, postal address, email address and phone number;
• Order and transaction data: purchased products, order history, payment method, amount, currency, billing address, delivery address, refunds and returns;
• Account data: login credentials, account preferences and saved information, where a customer account is created;
• Technical and browsing data: IP address, device information, browser type, operating system, visited pages, session data, referral source and cookie or similar identifiers;
• Communication data: messages, requests, complaints, reviews and information submitted through forms, email or customer support;
• Marketing data: newsletter subscriptions, marketing preferences, consent records and interactions with promotional communications;
• Security and fraud-prevention data: risk indicators, authentication information and information reasonably necessary to detect suspicious, fraudulent or unlawful activity.

Some information is necessary to enter into and perform a sales contract. If required order, payment or delivery information is not provided, we may be unable to process or fulfil the order.

Where personal data is collected directly from an individual and Hong Kong's PDPO applies, the individual will be provided with information required under the applicable Data Protection Principles, including the purposes for which the data is collected, the classes of persons to whom it may be transferred, whether providing the data is obligatory or voluntary and the means of requesting access to and correction of the data.

New kenshi does not intentionally request sensitive information that is unnecessary for the transaction. Please do not include medical, biometric, identity-document or other particularly sensitive information in free-text messages unless it is strictly necessary for your request and specifically requested through an appropriate channel.

4) Sources of Personal Data

Personal data may be collected:

• Directly from you when you place an order, create an account, contact us, submit a form, subscribe to marketing or publish a review;
• Automatically when you browse the website or interact with cookies and similar technologies;
• From payment, delivery, fraud-prevention, analytics or technical service providers where necessary to complete a transaction, secure the website or investigate an issue;
• From publicly available or lawfully accessible sources where permitted by applicable law.

Where the PDPO applies, personal data will be collected by lawful and fair means for lawful purposes directly related to our functions or activities, and the data collected should be adequate but not excessive in relation to those purposes.

5) Purposes of Processing

Personal data may be used for the following purposes:

• Processing orders, payments, deliveries, returns and refunds;
• Managing customer accounts and purchase history;
• Providing customer service and responding to requests or complaints;
• Sending order confirmations, tracking information and service communications;
• Operating, maintaining, securing and troubleshooting the website;
• Preventing fraud, abuse, chargebacks and other unlawful activity;
• Improving website performance, products, services and user experience;
• Measuring traffic and website usage, subject to applicable privacy and consent requirements;
• Sending newsletters or promotional offers where legally permitted and, where required, with appropriate consent;
• Complying with tax, accounting, consumer-protection, regulatory and legal obligations;
• Establishing, exercising or defending legal claims.

Under Hong Kong's Data Protection Principle 3, where it applies, personal data will not be used for a new purpose that is not the original purpose of collection or a directly related purpose unless the individual's prescribed consent has been obtained or another applicable legal exception permits the use.

Where GDPR requirements also apply, any further processing will additionally be assessed under the applicable GDPR rules concerning purpose compatibility and legal basis.

6) Legal Bases and Lawful Use

Because the data controller is established in France, processing that falls within the GDPR relies on one or more applicable legal bases, which may include:

• Performance of a contract: processing orders, payments, deliveries, returns and contractual customer requests;
• Legal obligation: accounting, tax, regulatory, compliance and record-keeping requirements;
• Consent: optional marketing communications, non-essential tracking technologies and other activities for which consent is required;
• Legitimate interests: securing the website, preventing fraud, improving services, managing disputes and conducting appropriate business communications, provided those interests are not overridden by the individual's rights and interests.

Where processing is based on consent under the GDPR, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

Hong Kong's PDPO does not use the same general "legal basis" framework as the GDPR. Where the PDPO applies, personal data must instead be collected, retained, used, disclosed and secured in accordance with the relevant Data Protection Principles and specific statutory requirements, including the rules applicable to direct marketing.

7) Data Recipients and Service Providers

Personal data is accessible only to authorised persons and service providers that need it for the purposes described in this policy.

• E-commerce platform and hosting: Shopify International Limited and relevant Shopify affiliates and subprocessors;
• Domain name registrar: HOSTINGER operations, UAB;
• Payment providers: providers displayed at checkout, which may include Stripe, PayPal, Klarna, Apple Pay or Google Pay;
• Logistics providers: carriers, delivery partners, fulfilment centres and customs intermediaries;
• Technical providers: email, customer-support, security, fraud-prevention, analytics, consent-management and website-service providers used by the store;
• Professional and public recipients: accountants, legal advisers, insurers, banks, courts, regulators, tax authorities and law-enforcement bodies where legally required or reasonably necessary.

Shopify processes customer data for merchants in accordance with its contractual and data-processing terms. Further information is available in Shopify's Consumer Privacy Policy.

Where a service provider processes personal data on our behalf and the PDPO applies, New kenshi will use contractual or other appropriate means where required to address applicable data-retention and data-security obligations.

We do not sell personal data for monetary consideration as part of our ordinary business activities.

8) Data Retention

Personal data is retained only for as long as reasonably necessary for the relevant purpose, subject to legal, accounting, tax, fraud-prevention and dispute-resolution requirements.

Where Hong Kong's PDPO applies, all practicable steps are taken to avoid keeping personal data longer than is necessary for the purpose for which the data is used, subject to any legal requirement or legitimate need to retain the information.

When personal data is no longer required, it may be securely deleted, anonymised or restricted to archival use where continued retention is required by law or necessary for the establishment, exercise or defence of legal claims.

9) Privacy Rights

Privacy rights depend on the law applicable to the individual and the relevant processing activity. Requests may be sent to contact@kenshiblades.com. We may reasonably verify the identity and authority of the requester before disclosing or changing personal data.

9.1) Rights under the GDPR

Where the GDPR applies to processing carried out in the context of our establishment in France, individuals may have rights of access, rectification, erasure, restriction, objection, data portability and withdrawal of consent, together with the right to lodge a complaint with a competent supervisory authority.

Individuals may object to processing of their personal data for direct marketing purposes at any time.

GDPR requests are normally answered within one month, subject to a lawful extension where permitted by the GDPR.

9.2) Hong Kong — Access to Personal Data

Where Hong Kong's PDPO applies, an individual may make a Data Access Request to determine whether a data user holds personal data relating to that individual and, where applicable, obtain a copy of the personal data.

A statutory Data Access Request may need to comply with the form and procedural requirements prescribed under the PDPO.

A valid Data Access Request must generally be dealt with within 40 days after receipt, subject to the circumstances and exceptions provided by the PDPO.

A fee may be charged for complying with a Data Access Request only to the extent permitted by applicable law and must not be excessive.

9.3) Hong Kong — Correction of Personal Data

Where the requirements of the PDPO are satisfied, an individual may request correction of inaccurate personal data.

A valid Data Correction Request will generally be dealt with within 40 days, subject to the statutory requirements and permitted grounds for refusal.

9.4) Direct Marketing Rights in Hong Kong

Where Part 6A of the PDPO applies, New kenshi will not use an individual's personal data for direct marketing unless the applicable statutory requirements have been satisfied.

Before using personal data for direct marketing, the individual will be informed, where required, of:

• The intention to use personal data for direct marketing;
• The kinds of personal data intended to be used;
• The classes of goods, facilities or services that may be marketed;
• The channel through which the individual may communicate the required consent or indication of no objection.

Silence or failure to respond is not treated as consent to direct marketing.

Consent to direct marketing is optional and is not required in order to complete an ordinary purchase.

An individual may at any time request that New kenshi stop using their personal data for direct marketing. Such an opt-out request will be honoured without charge.

When personal data is used for direct marketing for the first time, the individual will be informed of the right to request that such use cease where required by the PDPO.

10) Data Security and Privacy Breaches

New kenshi implements appropriate technical and organisational measures designed to protect personal data against unauthorised or accidental access, processing, erasure, loss, alteration, disclosure or other misuse.

Measures may include HTTPS encryption, access controls, authentication, restricted permissions, secure service providers, backups, monitoring, fraud-prevention controls and confidentiality obligations.

Where Hong Kong's PDPO applies, all reasonably practicable steps will be taken in accordance with Data Protection Principle 4 to protect personal data, taking into account matters such as the nature of the data, potential harm, storage location, security measures, access controls and secure transmission.

No online system can be guaranteed to be completely secure. If a personal-data breach occurs, New kenshi will investigate the incident and take reasonable steps to contain and mitigate the risk.

Hong Kong's PDPO does not currently impose a general statutory obligation requiring every data breach to be notified to the Privacy Commissioner for Personal Data. However, notification to the PCPD and affected individuals may be made where appropriate in accordance with PCPD guidance and the circumstances of the incident.

Separately, because the data controller is established in France, where a breach falls within the GDPR, the competent European supervisory authority will be notified where required, without undue delay and, where feasible, within 72 hours after becoming aware of the breach. Affected individuals will also be informed where the GDPR requires notification because of a likely high risk to their rights and freedoms.

11) Payment Security

Payments are processed by payment service providers that may include Stripe, PayPal, Klarna, Apple Pay, Google Pay or other providers displayed at checkout.

Payment information is transmitted using secure encryption. Full payment-card details are not stored directly on our website servers where payment processing is handled by the relevant payment provider.

Payment providers may act as independent data controllers or data users for some processing activities, including legal compliance, fraud prevention and transaction authentication.

12) Cookies and Similar Technologies

The website New kenshi may use cookies and similar technologies to:

• Provide essential website, cart, checkout and security functions;
• Remember preferences and improve the user experience;
• Measure traffic and website performance;
• Personalise content or advertising where legally permitted.

Where cookies or similar technologies collect information that constitutes personal data, that information is handled in accordance with the privacy requirements applicable to the relevant processing.

Where consent is required by applicable law, non-essential technologies are not activated until the required consent has been obtained.

Preferences may be modified or withdrawn through the “Manage cookies” link or consent tool available on the website.

For more information, see our Cookie Policy.

13) International and Cross-Border Data Transfers

Some service providers, affiliated companies or technical systems may process personal data in countries or territories other than the location of the customer.

Because the data controller is established in France, where the GDPR restricts a transfer of personal data outside the European Economic Area, an appropriate GDPR transfer mechanism is used. This may include an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules or another lawful safeguard.

Hong Kong's PDPO contains section 33 concerning transfers of personal data outside Hong Kong. As of the date of this policy, section 33 has not been brought into operation.

Nevertheless, where Hong Kong's PDPO applies, other requirements remain relevant to cross-border processing. These may include requirements concerning collection purposes, use of personal data, retention, security and the use of data processors.

Where appropriate, New kenshi may use contractual safeguards or other measures designed to require overseas service providers to protect personal data. These measures may take account of the recommended model contractual clauses and cross-border guidance published by the Office of the Privacy Commissioner for Personal Data, Hong Kong.

Further information about applicable transfer safeguards may be requested through contact@kenshiblades.com.

14) Automated Processing and Fraud Prevention

Automated tools may be used to detect fraud, secure payments, identify suspicious activity or protect the website and its customers.

New kenshi does not ordinarily make decisions based solely on automated processing that produce legal or similarly significant effects on an individual.

Where the GDPR applies and such automated decision-making is used, it will only be carried out where permitted by applicable law and subject to the safeguards and rights required by the GDPR.

Where Hong Kong's PDPO applies, personal data used by fraud-prevention and automated systems will remain subject to the applicable Data Protection Principles concerning collection, use, accuracy, retention and security.

15) Children's Privacy

The website is not directed specifically to children and is intended primarily for persons who have the legal capacity to make purchases.

We do not knowingly collect personal data from children where such collection would be unlawful or unnecessary.

A parent, legal guardian or other person legally authorised to act on behalf of a minor who believes that personal data has been collected or used improperly may contact contact@kenshiblades.com.

Where Hong Kong's PDPO applies, applicable provisions allowing a "relevant person" to act for a minor or another individual will be respected.

16) Complaints and Supervisory Authorities

Please contact contact@kenshiblades.com first so that we can investigate and attempt to resolve any privacy concern.

• Hong Kong: Office of the Privacy Commissioner for Personal Data (PCPD) — https://www.pcpd.org.hk/english/complaints/how_complaint/complaint/complaint.html
• France / European Union: Commission nationale de l'informatique et des libertés (CNIL) — https://www.cnil.fr/fr/plaintes

Where the PDPO applies to an act or practice relating to an individual's personal data, the individual may be entitled to lodge a complaint with the PCPD in accordance with the Ordinance and the PCPD's complaint procedures.

Where the GDPR applies, the individual may also lodge a complaint with an EU supervisory authority competent under the GDPR.

17) Hong Kong Privacy Requirements

17.1) Data Protection Principle 1 — Collection

Personal data will be collected for lawful purposes directly related to the functions or activities of New kenshi.

The data collected should be necessary, adequate and not excessive in relation to those purposes, and collection should be carried out by lawful and fair means.

Where required, individuals will be informed of the purposes of collection, the classes of persons to whom their personal data may be transferred, whether providing the data is obligatory or voluntary and the consequences of failing to provide mandatory information.

17.2) Data Protection Principle 2 — Accuracy and Retention

All practicable steps will be taken to keep personal data accurate having regard to the purpose for which the data is used.

Personal data should not be retained longer than is necessary for the fulfilment of the relevant purpose, except where continued retention is required or permitted by applicable law or reasonably necessary for a legitimate legal purpose.

17.3) Data Protection Principle 3 — Use

Personal data will normally be used only for the purpose for which it was collected or a directly related purpose.

Where New kenshi wishes to use personal data for a new and unrelated purpose and the PDPO requires prescribed consent, the relevant consent will be obtained before such use.

17.4) Data Protection Principle 4 — Security

Reasonably practicable measures are used to protect personal data against unauthorised or accidental access, processing, erasure, loss or use.

Where data processors are engaged, contractual or other appropriate measures may be used as required to address applicable security obligations.

17.5) Data Protection Principle 5 — Openness

New kenshi aims to maintain transparent policies and practices regarding personal data, including information about the kinds of personal data held and the principal purposes for which it is used.

17.6) Data Protection Principle 6 — Access and Correction

Where the PDPO applies, individuals may request access to their personal data and correction of inaccurate personal data in accordance with the statutory requirements.

Valid statutory access and correction requests are generally handled within 40 days, subject to permitted exemptions and procedural requirements.

17.7) Direct Marketing

Personal data will not be used for direct marketing in Hong Kong unless the requirements of Part 6A of the PDPO have been satisfied.

Consent to direct marketing is separate from the information necessary to process an ordinary order and will not be made a mandatory condition of completing a purchase.

An individual may request at any time, without charge, that New kenshi cease using their personal data for direct marketing.

17.8) Personal Information Collection Statements

Where required, notices presented at points where personal data is collected may supplement this Privacy Policy and provide more specific information about the relevant collection activity.

Such notices may include the purposes of collection, classes of recipients, whether supplying the information is mandatory or voluntary and information about access and correction rights.

17.9) Cross-Border Processing

Although section 33 of the PDPO concerning transfers outside Hong Kong is not currently in operation, New kenshi seeks to apply appropriate safeguards to personal data processed across borders and to comply with all other applicable PDPO requirements.

This includes appropriate controls concerning service providers, retention, security, use and purpose limitation.

18) Policy Updates

New kenshi may update this Privacy Policy to reflect changes in legal requirements, website features, service providers or personal-data processing practices.

The date of the latest update is displayed at the top of the page.

Where required by applicable law, material changes will be brought to users' attention and new consent will be requested where a processing activity cannot lawfully continue on the basis of an earlier consent.

19) Contact