Privacy Policy

Last Updated: September 11, 2026

This Privacy Policy explains how コスモス商事株式会社, operating under the brand xsdfr, collects, uses, stores, shares and protects personal information when you visit our online store, place an order, contact us or otherwise interact with our services.

Our online store currently serves customers in Germany and Austria and is powered by Shopify, which provides the e-commerce platform used to operate our store.

For the purposes of this Privacy Policy, our website, online store, products, customer service functions and related services are collectively referred to as the “Services.”

Please read this Privacy Policy carefully before using the Services.

1. Company Information

The company responsible for operating the xsdfr online store is:

Company name: コスモス商事株式会社
Company registration number: 4010001016569
Responsible person: 寺田 武春
Brand: xsdfr

Registered address:
神田錦町2丁目11番地
千代田区, 東京都
101-0054
Japan

Email: support@xsdfr.shop
Telephone: +81 90 5156 1861

Where applicable data protection law requires the identification of a data controller, コスモス商事株式会社 acts as the controller of personal information processed in connection with the operation of our online store, except where another party acts as an independent controller under applicable law.

2. Scope of This Privacy Policy

This Privacy Policy applies when you:

• Visit or browse our online store;
• Create or manage a customer account where available;
• Place or manage an order;
• Purchase products;
• Make or receive a payment;
• Use Cash on Delivery where available;
• Request a return, exchange or refund;
• Contact customer service;
• Subscribe to marketing communications;
• Submit a review, form or other content;
• Interact with our advertising or marketing;
• Use website functions or cookies; or
• Otherwise interact with our Services.

This Privacy Policy does not govern independent third-party websites or services that may be linked from our website.

3. Personal Information We Collect

The personal information we collect depends on how you interact with our Services.

3.1 Identity Information

We may collect:

• Full name;
• Customer account name;
• Account identifiers;
• Information reasonably necessary to verify your identity; and
• Other identification information you voluntarily provide.

3.2 Contact Information

We may collect:

• Billing address;
• Shipping address;
• Postal code;
• City;
• Country or region;
• Email address;
• Telephone number; and
• Communication preferences.

3.3 Order and Transaction Information

When you place or manage an order, we may process:

• Products ordered;
• Order number;
• Product quantities;
• Product variations or specifications;
• Purchase price;
• Currency;
• Payment status;
• Delivery status;
• Tracking information;
• Returns;
• Exchanges;
• Refunds;
• Order cancellations; and
• Communications relating to your transaction.

3.4 Payment Information

Depending on the payment method actually displayed and selected during checkout, we may process:

• Payment method;
• Payment status;
• Billing information;
• Transaction identifiers;
• Partial payment information;
• Refund information; and
• Cash on Delivery information where applicable.

Payment information may be processed directly by Shopify, payment processors, banks or other authorized payment service providers.

We generally do not receive complete payment card credentials where payment information is processed directly by an authorized payment provider.

3.5 Customer Account Information

If customer accounts are available, we may process:

• Email address;
• Account information;
• Saved addresses;
• Account preferences;
• Order history;
• Communication preferences; and
• Account activity.

Authentication information may be processed by Shopify or another authorized service provider.

3.6 Customer Service Information

When you contact us, we may collect:

• Your name;
• Email address;
• Telephone number;
• Order number;
• Product information;
• Complaint details;
• Return or refund reasons;
• Photographs;
• Videos;
• Messages sent to us; and
• Records of our responses.

3.7 Device and Technical Information

When you access our Services, certain technical information may be collected automatically, including:

• IP address;
• Browser type;
• Browser language;
• Device type;
• Operating system;
• Device identifiers;
• Network information;
• Pages viewed;
• Date and time of access;
• Referring website;
• Session information;
• Click and navigation activity;
• Cookie identifiers;
• Approximate location derived from an IP address; and
• Website performance or error information.

3.8 Marketing and Preference Information

Where applicable, we may collect:

• Product interests;
• Products viewed;
• Marketing preferences;
• Advertising interactions;
• Promotional campaign activity;
• Customer satisfaction information; and
• Shopping preferences.

4. How We Collect Personal Information

We may collect personal information from the following sources.

Information You Provide Directly

You may provide information when you:

• Place an order;
• Create an account;
• Complete a form;
• Enter delivery or billing information;
• Contact customer service;
• Request a return or refund;
• Subscribe to marketing communications;
• Submit a review; or
• Otherwise communicate with us.

Information Collected Automatically

Certain information may be collected automatically using:

• Cookies;
• Pixels;
• Tags;
• Server logs;
• Analytics technologies;
• Local storage;
• Device identifiers; and
• Similar technologies.

Information Received From Service Providers

We may receive information from service providers that assist us with:

• Shopify store hosting;
• Payment processing;
• Fraud prevention;
• Order fulfilment;
• Warehousing;
• Shipping and delivery;
• Tracking;
• Customer support;
• Analytics;
• Marketing;
• Advertising; and
• Website security.

5. How We Use Personal Information

We may use personal information for the purposes described below.

Providing Our Services

We may use your information to:

• Operate and maintain our online store;
• Create and manage customer accounts;
• Process and confirm orders;
• Verify order information;
• Process or confirm payments;
• Manage Cash on Delivery orders where available;
• Arrange order fulfilment;
• Arrange shipping and delivery;
• Provide tracking information;
• Communicate about orders;
• Process returns;
• Process exchanges;
• Process refunds;
• Respond to customer inquiries; and
• Provide customer service.

Improving Our Services

We may use information to:

• Understand how customers use our website;
• Improve website functionality;
• Improve navigation;
• Improve products;
• Improve customer service;
• Evaluate website performance;
• Understand shopping preferences; and
• Improve our Services.

Security and Fraud Prevention

We may use information to:

• Verify transactions;
• Detect suspected fraud;
• Prevent unauthorized purchases;
• Protect customer accounts;
• Prevent misuse of our Services;
• Maintain website security; and
• Protect our legal rights.

Legal and Compliance Purposes

We may process information where necessary to:

• Comply with applicable laws;
• Meet accounting and tax obligations;
• Respond to lawful requests from authorities;
• Comply with court orders;
• Resolve disputes;
• Enforce our agreements;
• Establish, exercise or defend legal claims; and
• Protect the rights and safety of our customers, our business or third parties.

Marketing and Advertising

Where permitted by applicable law, we may use personal information to:

• Send promotional communications;
• Provide product updates;
• Measure marketing performance;
• Understand customer interests;
• Display relevant advertising; and
• Improve marketing activities.

Where consent is legally required, we will obtain the appropriate consent before carrying out such processing.

6. Legal Bases for Processing for Customers in Germany and Austria

For customers in Germany and Austria, the General Data Protection Regulation (GDPR) applies where relevant.

We process personal information only where an appropriate legal basis exists.

Performance of a Contract

We may process personal information where necessary to:

• Accept and process an order;
• Receive or verify payment;
• Deliver products;
• Provide customer support;
• Process returns;
• Process refunds; and
• Perform our contractual obligations.

Legal Obligation

We may process or retain personal information where necessary to comply with:

• Tax requirements;
• Accounting requirements;
• Consumer protection requirements;
• Fraud-prevention obligations;
• Regulatory requirements; and
• Other applicable legal obligations.

Legitimate Interests

Where permitted by law, we may process information based on legitimate interests such as:

• Preventing fraud;
• Protecting website security;
• Improving our Services;
• Managing customer relationships;
• Responding to customer inquiries;
• Evaluating business performance; and
• Protecting our legal rights.

Where we rely on legitimate interests, we consider whether our interests are overridden by your rights and freedoms.

Consent

Where required, we may rely on your consent for activities such as:

• Marketing communications;
• Non-essential cookies;
• Personalized advertising; and
• Other optional processing activities.

You may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing that occurred before consent was withdrawn.

7. Shopify

Our online store is powered by Shopify.

Shopify provides the technical e-commerce infrastructure used to operate our online store.

Information submitted through our Services may be transmitted to and processed by Shopify in order to:

• Host our online store;
• Operate checkout;
• Manage customer accounts;
• Process orders;
• Support available payment functions;
• Provide website functionality;
• Prevent fraud;
• Maintain platform security; and
• Provide related Shopify services.

Shopify may process certain personal information independently in accordance with its own privacy practices and legal obligations.

8. Payment Providers

Payments may be handled by independent payment service providers.

The payment methods available to you are the methods actually displayed during checkout.

Depending on the payment method selected, relevant information may be shared with:

• Shopify;
• Banks;
• Payment processors;
• Payment networks;
• Fraud-prevention providers; and
• Other parties reasonably necessary to complete the payment.

Those providers may process personal information under their own privacy policies and legal obligations.

If Cash on Delivery (COD) is available and selected, information necessary to deliver the parcel and collect payment may be provided to the relevant courier or logistics provider.

9. Shipping and Delivery Providers

To fulfil and deliver orders to customers, including customers in Germany and Austria, we may share necessary information with:

• Warehouses;
• Fulfilment partners;
• Shipping companies;
• Postal services;
• Couriers;
• Logistics providers; and
• Tracking providers.

The information shared may include:

• Recipient name;
• Delivery address;
• Postal code;
• Telephone number;
• Email address;
• Order reference;
• Package details;
• Delivery instructions; and
• Cash on Delivery amount where applicable.

Delivery providers may contact you regarding:

• Delivery scheduling;
• Tracking updates;
• Delivery confirmation;
• Failed delivery attempts; or
• Cash on Delivery arrangements where applicable.

10. Disclosure of Personal Information

We may share personal information only where reasonably necessary for the purposes described in this Privacy Policy or where required by applicable law.

Recipients may include:

• Shopify;
• Payment providers;
• Banks;
• Payment networks;
• Courier and logistics companies;
• Warehousing and fulfilment providers;
• Cloud and hosting providers;
• Customer support providers;
• Email service providers;
• Analytics providers;
• Advertising or marketing providers;
• Fraud-prevention providers;
• Security providers;
• Accountants;
• Lawyers;
• Auditors;
• Insurers;
• Professional advisers;
• Government authorities;
• Courts;
• Law enforcement authorities; and
• Regulators.

We may also disclose information where necessary to:

• Complete an order;
• Arrange delivery;
• Process a payment;
• Prevent fraud;
• Protect our legal rights;
• Comply with applicable law; or
• Complete a merger, acquisition, restructuring or transfer of business assets.

11. Cookies and Similar Technologies

Our website and Shopify may use cookies and similar technologies.

Cookies may be used to:

• Keep the website functioning;
• Maintain shopping cart sessions;
• Remember customer preferences;
• Support account login;
• Operate checkout;
• Protect website security;
• Prevent fraud;
• Analyze website traffic;
• Measure website performance;
• Understand customer activity;
• Improve the shopping experience; and
• Support advertising or marketing where permitted.

Essential Cookies

Essential cookies may be necessary for:

• Shopping cart operation;
• Checkout;
• Account login;
• Payment processing;
• Security; and
• Fraud prevention.

These cookies may be required for the website to function properly.

Analytics Cookies

Analytics technologies may help us understand:

• How customers use our website;
• Which pages are visited;
• Which products are viewed;
• Website performance; and
• Customer navigation patterns.

Marketing Cookies

Where legally permitted and, where required, after obtaining consent, marketing cookies may be used to:

• Measure advertising performance;
• Understand customer interests;
• Personalize marketing; and
• Display relevant advertising.

For customers in Germany and Austria, non-essential cookies will only be used where permitted under applicable law and where any required consent has been obtained.

You may manage available cookie preferences through our website cookie controls or your browser settings.

Disabling certain cookies may affect some website functions.

12. Marketing Communications

Where legally permitted, we may send marketing or promotional communications.

You may receive such communications where:

• You have provided consent;
• Another applicable lawful basis exists; and
• You have not opted out.

You may unsubscribe from marketing communications by:

• Using the unsubscribe link included in a marketing email;
• Changing available communication preferences; or
• Contacting us at support@xsdfr.shop.

Communications necessary for:

• Orders;
• Payments;
• Delivery;
• Returns;
• Refunds;
• Security; or
• Account administration

are transactional or service communications and may still be sent where necessary.

13. International Data Transfers

Our company is established in Japan, while our online store currently serves customers in Germany and Austria.

As a result, personal information may be transferred to or processed outside Germany, Austria or the European Economic Area.

Personal information may be processed in:

• Japan;
• The European Economic Area;
• Countries in which Shopify operates;
• Countries in which payment providers operate; or
• Countries in which other authorized service providers operate.

Where personal information protected by the GDPR is transferred outside the European Economic Area, we will use an appropriate transfer mechanism where required by applicable law.

Such safeguards may include:

• An applicable adequacy decision;
• Standard Contractual Clauses;
• Appropriate contractual safeguards;
• Technical and organizational safeguards; or
• Another legally recognized transfer mechanism.

14. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or as required by applicable law.

Retention periods may depend on:

• The duration of the customer relationship;
• Order fulfilment;
• Delivery requirements;
• Returns and refunds;
• Customer support;
• Accounting obligations;
• Tax obligations;
• Fraud-prevention needs;
• Warranty obligations;
• Legal limitation periods;
• Dispute resolution; and
• Legal claims.

When information is no longer required, we may:

• Delete it;
• Anonymize it; or
• Restrict further processing where appropriate.

15. Data Security

We use reasonable administrative, organizational and technical safeguards designed to protect personal information against:

• Unauthorized access;
• Accidental loss;
• Unauthorized disclosure;
• Alteration;
• Destruction;
• Misuse; and
• Unauthorized processing.

Measures may include:

• Access controls;
• Authentication measures;
• Secure hosting;
• Encryption where appropriate;
• Fraud monitoring;
• Security reviews; and
• Restricted access by authorized personnel and service providers.

However, no method of transmission over the internet or method of electronic storage can be guaranteed to be completely secure.

16. Children's Privacy

Our Services are intended for persons legally capable of entering into purchase contracts.

We do not knowingly collect personal information from children in violation of applicable law.

Where required, minors should obtain the involvement or authorization of a parent or legal guardian before:

• Using the Services;
• Creating an account;
• Placing an order; or
• Providing personal information.

If we become aware that personal information from a minor has been collected in circumstances that violate applicable law, we may delete or restrict that information as required.

17. Privacy Rights of Customers in Germany and Austria

Customers in Germany and Austria may have rights under the GDPR and applicable national data protection laws.

These rights may include:

Right of Access

You may request information about whether we process your personal information and request access to eligible personal information.

Right to Correction

You may request correction of inaccurate or incomplete personal information.

Right to Deletion

You may request deletion of your personal information where the legal requirements for deletion are satisfied.

Right to Restrict Processing

You may request restriction of certain processing activities where applicable.

Right to Data Portability

You may have the right to receive eligible personal information in a structured, commonly used and machine-readable format.

Right to Object

You may object to certain processing based on legitimate interests.

You may object to the processing of personal information for direct marketing purposes at any time.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights Concerning Automated Decision-Making

Where applicable, you may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

Right to Lodge a Complaint

If you are located in Germany or Austria, you may lodge a complaint with the competent data protection supervisory authority in your country or region if you believe that your personal information has been processed unlawfully.

These rights may be subject to legal conditions, exceptions and reasonable identity-verification requirements.

18. How to Exercise Your Privacy Rights

To exercise an applicable privacy or data protection right, please contact:

Email: support@xsdfr.shop
Telephone: +81 90 5156 1861

Please clearly describe your request.

We may ask you to provide information reasonably necessary to verify your identity, such as:

• Your full name;
• Email address associated with your account or order;
• Order number where applicable; and
• A description of your request.

We will only request information reasonably necessary to verify and process your request.

We will respond within the period required by applicable law.

19. Third-Party Websites and Services

Our Services may contain links to websites, platforms or services operated by independent third parties.

We do not control the privacy, security or content practices of independent third-party services.

When you leave our website or use an external service, information you provide may be governed by that third party's privacy policy.

We recommend reviewing the applicable privacy information before providing personal information to a third-party service.

20. Business Transfers

If our business undergoes:

• A merger;
• Acquisition;
• Reorganization;
• Financing;
• Sale of assets; or
• Another corporate transaction,

personal information may be transferred to relevant parties as part of that transaction, subject to applicable data protection requirements.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time due to:

• Changes in applicable law;
• Regulatory requirements;
• Changes to our Services;
• Changes in Shopify services;
• Changes to payment methods;
• Changes to logistics providers;
• Changes to cookies or analytics technologies;
• Security developments; or
• Changes to our business operations.

The latest version will be published on our online store.

Where required by applicable law, we may provide additional notice of material changes.

The “Last Updated” date at the top of this Privacy Policy indicates when the latest version became effective.

22. Contact Information

If you have questions about this Privacy Policy, our handling of personal information or your privacy rights, please contact:

コスモス商事株式会社
Company registration number: 4010001016569
Responsible person: 寺田 武春
Brand: xsdfr

Registered address:
神田錦町2丁目11番地
千代田区, 東京都
101-0054
Japan

Email: support@xsdfr.shop
Telephone: +81 90 5156 1861