Privacy Policy

1. Policy Scope

This policy applies to data collected through the Tora Matcha website, payment pages, customer service, marketing messages, reviews, and any official channels associated with the store.

Separate policies may apply to external websites or services accessed through a link, and it is advisable to review them before providing data.

2. Data We May Collect

3. How We Obtain Data

• Directly when you register, purchase, complete a form, or contact us.
• Automatically when you use the website through cookies and technical logs.
• From payment and shipping providers and the technical platform when payment, order, or delivery status is updated.
• From analytics and advertising partners when using their services and according to available consent settings.

4. Why We Use Data

• Account creation, order management, payment, invoicing, shipping, and tracking.
• Responding to inquiries, complaints, and exchange or return requests.
• Verifying transactions, preventing fraud and misuse, and securing the website.
• Fulfilling accounting, tax, and regulatory obligations, and record keeping.
• Improving products, website experience, measuring performance, and troubleshooting.
• Sending offers and marketing content when consent or an appropriate legal basis exists.
• Customizing content and advertisements and measuring their effectiveness, when settings and systems allow.

5. Legal Basis for Processing

We process data when necessary to execute a sales contract and provide service, or to comply with a regulatory requirement, or to protect legitimate interests such as security and service improvement, or based on consent that can be withdrawn in cases requiring consent.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal, and we may retain some data when required by law or to defend a legitimate right.

6. With Whom We Share Data

We do not sell customer lists. We may share the necessary minimum data with:

• Shopify as the store's operating, hosting, and e-commerce platform.
• Payment gateways, banks, and fraud prevention providers to complete and verify transactions.
• Shipping, delivery, and customs clearance companies to deliver orders and update tracking.
• Mail, messaging, customer service, and marketing providers when operating these services.
• Analytics, performance measurement, and advertising providers, such as Google or Meta services or user experience measurement tools, when active and according to consent options.
• Accountants, auditors, consultants, and competent authorities when legally required.
• A party acquiring the business or part of it, subject to appropriate data obligations.

7. Processing Outside the Country

Some technology, payment, or analytics providers may operate from other countries, and therefore data may be processed outside the customer's country. We strive to use trusted providers and take the contractual or technical safeguards required by applicable regulations.

8. Retention Period

We retain data for the period necessary to fulfill the order, provide the service, and process complaints, and then for the period required by tax, accounting, and regulatory obligations or to protect legal rights.

The period may vary depending on the type and purpose of the data. Data is deleted or anonymized when it is no longer needed and there is no legitimate reason to retain it.

9. Data Security

We employ reasonable technical and organizational measures to limit unauthorized access, loss, or alteration, such as encrypted communications, access controls, and the use of specialized payment and hosting providers.

No transmission or storage method is absolutely secure. In the event of a suspected incident affecting data, we take appropriate action and notify authorities or individuals when required by law.

10. Data Subject Rights

Depending on the applicable law, rights may include:

• Knowing how data is used and accessing it or requesting a copy.
• Correcting inaccurate data or completing incomplete data.
• Requesting deletion or restriction of processing when regulatory conditions are met.
• Withdrawing consent or objecting to direct marketing.
• Requesting data portability when the right is legally and technically available.
• Filing a complaint with the competent data protection authority.

We may request information to verify identity before fulfilling a request, and some records related to past orders may not be deletable if retention is legally required.

11. Marketing Messages

You can unsubscribe from marketing emails via the unsubscribe link within the message, or by contacting us. Necessary operational messages, such as order or shipping confirmations, may continue even after opting out of marketing.

12. Cookies

We use essential cookies for cart, payment, and security functionality, and we may use cookies for preferences, analytics, and advertising based on settings and consent. Please refer to our Cookie Policy for details and control options.

13. Children's Data

The store is intended for individuals capable of completing a legal purchase. We do not knowingly seek to collect data from a child without parental consent when such consent is required. If you believe a child's data has been inappropriately collected, please contact us to have it deleted or processed.

14. Policy Updates

We may update this policy as services, providers, or regulatory requirements change. The updated version will be posted here with the last updated date, and we may provide additional notice if the change is material.