Privacy Policy

Last Updated: February 17, 2026

 

1. Introduction and Data Controller

Joint Sewing ("Joint Sewing," "we," "us," or "our") is an international online store operated by SOUHIRO US LLC, a company registered in the State of Oregon, United States.

This Privacy Policy explains how we collect, use, disclose, transfer, retain, and protect personal information when customers visit https://jointsewing.com, place orders, create accounts, subscribe to communications, or contact us.

Our online store is powered by Shopify, and orders are primarily fulfilled and shipped from Japan.

SOUHIRO US LLC is generally the data controller responsible for determining the purposes and means of processing personal information in connection with Joint Sewing's retail operations.

We comply with applicable privacy and data protection laws, including the EU GDPR, UK GDPR, applicable U.S. state privacy laws, and Japan's Act on the Protection of Personal Information, to the extent those laws apply to our processing activities.

 

2. Personal Information We Collect

Depending on customer interactions and the services used, we may collect:

Identity and Contact Information

Names, email addresses, telephone numbers, billing addresses, shipping addresses, and customer account information.

Order and Transaction Information

Purchased products, order numbers, transaction amounts, currencies, payment status, purchase history, shipping records, returns, refunds, and customer support communications.

Technical and Usage Information

IP addresses, device and browser information, cookie identifiers, approximate location, website interactions, and security-related information.

Marketing Information

Marketing preferences, email subscriptions, advertising interactions, and consent records.

Shipping and Customs Information

Recipient information and documentation reasonably necessary for international delivery, customs clearance, and legal compliance.

We seek to collect only personal information reasonably necessary for the relevant purposes.

Where particular information is required to fulfill an order or comply with law, failure to provide it may prevent us from completing the transaction.

 

3. Purposes and Legal Bases for Processing

Where the EU GDPR or UK GDPR applies, our processing activities are based on the following legal grounds, as appropriate:

Purpose	Legal Basis
Processing purchases and payments	Contract performance — Article 6(1)(b)
Shipping and order fulfillment	Contract performance — Article 6(1)(b)
Returns, refunds, and contractual customer support	Contract performance — Article 6(1)(b)
Tax, accounting, and customs compliance	Legal obligation — Article 6(1)(c), where applicable
Fraud prevention and website security	Legitimate interests — Article 6(1)(f), where appropriate
Essential website functionality	Contract performance or legitimate interests, as applicable
Optional promotional emails	Consent — Article 6(1)(a), where required
Non-essential analytics and advertising tracking	Consent — Article 6(1)(a), where required
Business administration and service improvement	Legitimate interests — Article 6(1)(f), where appropriate

Where we rely on legitimate interests, we assess whether those interests are overridden by individuals' rights and freedoms.

Where we rely on consent, consent may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.

We do not treat consent to purchase a product as automatic consent to receive marketing communications or to use non-essential tracking technologies.

 

4. Shopify and Payment Service Providers

Our store uses Shopify for e-commerce hosting, checkout, order management, and related services.

Authorized payment providers process information necessary for payment authorization, fraud prevention, and transaction completion.

We do not intentionally store complete payment card numbers on our own systems.

Depending on the processing activity, Shopify and other service providers may act as processors or independent controllers.

Customers may review Shopify's privacy practices at:

https://www.shopify.com/legal/privacy

Shopify may also process certain customer information for its own purposes, as explained in its applicable consumer privacy notices.

 

5. Sharing and Disclosure of Personal Information

We may disclose personal information to the following categories of recipients where necessary and lawful:

• Shopify and e-commerce infrastructure providers.

• Payment processors and fraud prevention providers.

• DHL, FedEx, and other shipping companies.

• Customs brokers and relevant government authorities.

• Customer support and order fulfillment service providers.

• Website security, analytics, and advertising providers, where used.

• Legal, accounting, tax, and other professional advisers.

• Public authorities where legally required.

Where a service provider acts as our processor, we seek to establish appropriate contractual data protection obligations.

We do not sell customer contact lists to unrelated parties for their independent direct marketing.

Certain advertising-related disclosures may constitute a sale, sharing, or targeted advertising under applicable U.S. privacy laws.

Where such laws apply, we provide legally required notices and opt-out rights.

 

6. Cookies, Tracking Technologies, and Consent

We use cookies and similar technologies to operate the website, maintain security, remember preferences, measure performance, and, where enabled, support advertising.

6.1 Strictly Necessary Technologies

Strictly necessary technologies support functions such as shopping carts, checkout, account authentication, and security.

These technologies may operate without separate consent where legally permitted.

6.2 Analytics Technologies

Where enabled, analytics technologies help us understand website usage and improve our services.

6.3 Advertising Technologies

Where enabled, advertising technologies may help measure campaigns and deliver relevant advertisements.

6.4 Consent Before Non-Essential Tracking

Where applicable law requires prior consent, non-essential cookies, pixels, and similar tracking technologies will not be activated until valid consent has been obtained.

Customers will be offered a meaningful opportunity to accept or reject non-essential technologies.

Consent will not be inferred solely from continued browsing, silence, or the use of essential shopping functions.

6.5 Changing or Withdrawing Consent

Where consent controls are provided, customers may change or withdraw their choices through the website's Cookie Preferences or equivalent privacy settings.

Withdrawal of consent will apply to future processing based on that consent.

Customers may also contact hello@jointsewing.com for assistance.

6.6 Third-Party Tracking

Third-party applications, advertising services, or manually installed tracking technologies may require additional consent management measures.

We review the tracking technologies used on our website and seek to configure them consistently with applicable privacy requirements.

 

7. Marketing Communications

We may send product announcements, promotions, and marketing emails where permitted by applicable law.

Where required, we obtain consent before sending promotional communications.

Customers may unsubscribe at any time using the unsubscribe link in marketing emails or by contacting hello@jointsewing.com.

Order confirmations, payment notices, delivery updates, and other necessary transactional messages may continue where lawful.

 

8. International Data Transfers

Joint Sewing operates internationally, with a U.S. legal entity and order fulfillment activities primarily in Japan.

Personal information may be accessed, transferred, or processed in the United States, Japan, and other countries where authorized providers operate.

Where the EU GDPR or UK GDPR applies to a restricted international transfer, we use an appropriate lawful transfer mechanism.

Depending on the circumstances, this may include:

• An applicable adequacy decision.

• European Commission Standard Contractual Clauses.

• The UK International Data Transfer Agreement.

• The UK Addendum to the EU Standard Contractual Clauses.

• Other lawful transfer mechanisms where available.

The applicable mechanism depends on the parties, countries, and nature of the transfer.

Where required, we assess transfer-related risks and implement supplementary safeguards.

Customers may request information about applicable safeguards by emailing hello@jointsewing.com.

 

9. Personal Information Retention

We retain personal information only for as long as reasonably necessary for the relevant purpose, subject to applicable legal requirements.

9.1 Order and Transaction Records

Order information, payment records, invoices, and related transaction documents are retained for periods required by applicable tax, accounting, customs, and commercial laws.

9.2 Shipping and Customs Records

Shipping and customs information is retained for the period necessary to complete delivery, resolve disputes, and meet applicable recordkeeping obligations.

9.3 Customer Accounts

Customer account information is generally retained while the account remains active or while retention is necessary for lawful business purposes.

Customers may request account-related personal data deletion, subject to legal retention obligations.

9.4 Customer Support Communications

Customer support records are retained for as long as reasonably necessary to resolve inquiries, manage disputes, and comply with applicable obligations.

9.5 Marketing Information

Marketing contact information is retained while the relevant marketing permission or other lawful basis remains valid and the information is necessary for the stated purpose.

Following an unsubscribe request, limited information may be retained to maintain suppression records and prevent unwanted marketing.

9.6 Security and Technical Records

Technical and security information is retained according to operational needs, security risks, and applicable legal requirements.

9.7 Deletion and Review

We periodically review retained personal information and delete or anonymize it when it is no longer required.

Where a statutory retention period applies, deletion requests may be limited to the extent necessary to comply with that obligation.

Customers may request information about applicable retention criteria by contacting hello@jointsewing.com.

 

10. Data Security

We implement reasonable technical, organizational, and administrative safeguards appropriate to the nature of the information and relevant risks.

These may include access controls, authentication, encrypted transmission, restricted access, service provider oversight, and incident response procedures.

No method of electronic storage or transmission is completely secure.

We review safeguards as appropriate to our operations and applicable legal requirements.

 

11. Privacy Rights and Requests

Depending on applicable law, individuals may have rights to:

• Access personal information.

• Correct inaccurate information.

• Request deletion.

• Restrict certain processing.

• Object to processing.

• Request data portability.

• Withdraw consent.

• Opt out of certain targeted advertising or data sharing.

• Lodge complaints with relevant authorities.

Requests may be submitted to hello@jointsewing.com.

We may request reasonable verification of identity before fulfilling certain requests.

We will respond within applicable legal deadlines.

 

12. United States Privacy Rights

Residents of certain U.S. states may have additional rights under applicable privacy laws.

These may include access, correction, deletion, portability, and opting out of certain sales, sharing, or targeted advertising.

Where required by applicable law, we provide appropriate request and opt-out mechanisms.

We do not unlawfully discriminate against individuals for exercising applicable privacy rights.

 

13. European Union and United Kingdom Privacy Rights

Where the EU GDPR or UK GDPR applies, individuals may exercise the following rights, subject to applicable conditions and exceptions:

• Right of access — Article 15.

• Right to rectification — Article 16.

• Right to erasure — Article 17.

• Right to restriction of processing — Article 18.

• Right to data portability — Article 20.

• Right to object — Article 21.

• Rights relating to qualifying automated decision-making — Article 22.

• Right to withdraw consent — Article 7.

Individuals may object to processing for direct marketing at any time.

Response Period

We generally respond to valid GDPR requests within one month.

Where legally permitted, this period may be extended by up to two additional months for complex or numerous requests, with appropriate notice.

Complaints

EU individuals may contact a competent EU data protection supervisory authority.

UK individuals may contact the Information Commissioner's Office:

https://ico.org.uk

EU and UK Representatives — Article 27

SOUHIRO US LLC is established outside the European Union and the United Kingdom.

Where our processing activities fall within the territorial scope of the EU GDPR or UK GDPR, we assess whether an Article 27 representative must be appointed.

An exemption may apply where the relevant processing is occasional, does not involve large-scale processing of special categories of personal data or criminal conviction data, and is unlikely to result in a risk to individuals' rights and freedoms, subject to the applicable legal requirements.

Where an exemption does not apply, we must appoint an appropriate representative in the relevant jurisdiction and make the representative's identity and contact information available as legally required.

The appointment of a representative does not replace our responsibility for compliance with applicable data protection laws.

Privacy inquiries may be directed to hello@jointsewing.com.

 

14. Children's Privacy

Our services are intended for individuals legally capable of making purchases.

We do not knowingly collect children's personal information in violation of applicable law.

Where unlawful collection is identified, we take appropriate steps to delete the information.

 

15. Personal Data Breaches

We maintain procedures to assess and respond to suspected personal data breaches.

Where the EU GDPR or UK GDPR applies, reportable breaches will be notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours of awareness, where legally required.

Where a breach is likely to result in a high risk to individuals' rights and freedoms, affected individuals will be notified without undue delay, unless a lawful exception applies.

We maintain appropriate incident records and take reasonable remedial measures.

 

16. Third-Party Websites

Our website may link to third-party services.

Those services may maintain separate privacy policies and processing practices.

We encourage customers to review the relevant privacy notices.

 

17. Changes to This Policy

We may update this Privacy Policy to reflect changes in legal requirements, business operations, or data processing activities.

The updated policy will be published with a revised effective date.

Where required, material changes will be communicated and additional consent obtained.

 

18. Contact Information

Store Name: Joint Sewing

Legal Operator: SOUHIRO US LLC

Registered Jurisdiction: Oregon, United States

Website: https://jointsewing.com

Email: hello@jointsewing.com

Order Fulfillment Location:

14-27 Nishinokyo
Nagaokakyo-shi, Kyoto 617-0816
Japan

For privacy requests, complaints, or information about international transfers, please contact hello@jointsewing.com.

Nothing in this Privacy Policy restricts mandatory rights under applicable data protection laws.