COLLECTIONS
Privacy Policy
English, Governing Version
Last updated: May 2026
1. Who We Are and How to Contact Us
1.1 This Privacy Policy is issued by KASAI STUDIO SRL, registered in Romania under J2025093067008, CUI 53019306, VAT RO53019306, registered office at Str. Transilvaniei nr. 38, Corp C, ap. 2, Bucharest, Romania (KASAI, we, us, our).
1.2 KASAI is the data controller responsible for your personal data collected through this Website and in connection with your purchases.
1.3 For all privacy-related enquiries or requests to exercise your rights, contact us at contact@kasai-studio.com, www.kasai-studio.com, or by post at Str. Transilvaniei nr. 38, Corp C, ap. 2, Bucharest, Romania.
1.4 We do not have a formally designated Data Protection Officer, as we do not meet the thresholds requiring mandatory appointment under GDPR Art. 37. All data protection matters are handled directly by KASAI management.
2. Scope of This Policy
2.1 This Policy explains what personal data we collect, why we collect it, the legal basis on which we process it, who we share it with, how long we keep it, and what rights you have.
2.2 This Policy applies to visitors to www.kasai-studio.com, customers who place orders, individuals who subscribe to our newsletter, and anyone who contacts us directly.
2.3 Read this together with our Cookie Policy for additional detail on tracking technologies.
2.4 Our Website is not intended for persons under 16. We do not knowingly collect personal data from anyone under 16.
3. What Personal Data We Collect and How
3.1 Data You Provide Directly
Data Type | When Collected |
|---|---|
Full name | Account creation, order placement |
Email address | Account creation, order placement, newsletter signup |
Delivery and billing address | Order placement |
Phone number | Order placement, delivery coordination |
Payment information | Order placement. Processed by Netopia Payments and not stored by KASAI |
Size and product preferences | Order placement, account profile |
Communications content | When you contact us by email or through the Website |
3.2 Data Collected Automatically
Data Type | Purpose |
|---|---|
IP address | Security, fraud prevention, analytics |
Browser type and version | Website optimisation |
Device type and operating system | Website optimisation |
Pages visited and time spent | Analytics and performance improvement |
Referring URL | Understanding how users find us |
Cookie identifiers | Preferences, analytics, advertising |
3.3 Data Received from Third Parties
- Payment processors: Transaction confirmation and fraud signals from Netopia Payments
- Advertising platforms: Aggregated and anonymised audience insights from Meta and Google
- Couriers: Delivery status updates and confirmation from Fan Courier and DHL
We do not purchase personal data from data brokers or third-party list providers. We do not enrich your profile with socioeconomic or demographic data from external sources.
4. Why We Process Your Data and the Legal Basis
4.1 Contract Performance, Art. 6(1)(b) GDPR
Purpose | Data Used |
|---|---|
Processing and fulfilling your order | Name, address, email, phone, payment confirmation, size and product selection |
Managing your customer account | Name, email, password, delivery addresses |
Communicating about your order | Email, phone, order details |
Processing returns, refunds, and store credit | Name, email, order details, payment method |
Responding to customer service enquiries | Name, email, order details, communications content |
4.2 Legal Compliance, Art. 6(1)(c) GDPR
Purpose | Data Used |
|---|---|
Issuing and retaining invoices and financial records | Name, address, order value, payment confirmation |
Compliance with Romanian tax and accounting obligations | Transaction data, invoicing data |
Responding to lawful regulatory or law enforcement requests | As required by the specific legal obligation |
Retaining records for warranty and conformity claims | Order data, product data, communications |
4.3 Legitimate Interests, Art. 6(1)(f) GDPR
Purpose | Our Legitimate Interest |
|---|---|
Fraud prevention and transaction security | Protecting KASAI and customers from fraudulent transactions |
Website security and performance monitoring | Maintaining a secure and functional website |
Improving products and customer experience | Understanding how customers use our Website |
Sending transactional and post-purchase service emails | Direct communication necessary to fulfil and support orders |
Retaining records of customer communications | Resolving disputes and maintaining service quality |
4.4 Consent, Art. 6(1)(a) GDPR
Purpose | How Consent Is Given |
|---|---|
Marketing emails, newsletters, and promotional communications via Mailchimp | Explicit opt-in via newsletter signup form or at account creation, separate from purchase consent |
Placing non-essential cookies (analytics, advertising, social media) | Active acceptance via cookie consent banner (Complianz) |
Targeted advertising on Meta, Google, and TikTok | Active acceptance of marketing cookies via cookie consent banner |
Consent is always voluntary. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal. See Section 8.
5. Third Parties With Whom We Share Your Data
We do not sell your personal data. We do not share your data for third-party marketing purposes without your consent.
5.1 Service Providers (Data Processors Acting on Our Behalf)
Provider | Role | Data Shared | Location |
|---|---|---|---|
Netopia Payments | Payment processing | Payment card data, transaction amount, billing name | Romania / EU |
Fan Courier | Domestic delivery (Romania) | Name, delivery address, phone, order reference | Romania |
DHL Express | International delivery | Name, delivery address, phone, email, order value | Germany / Global |
SiteGround | Website hosting and server infrastructure | All data stored on the Website | Bulgaria / EU |
YITH / WooCommerce | Store credit and gift card management | Name, email, store credit value | EU |
Complianz | Cookie consent management | Cookie preferences, consent records | Netherlands / EU |
5.2 Platform and Analytics Providers
Provider | Role | Location | Transfer Mechanism |
|---|---|---|---|
Mailchimp (Intuit Inc.) | Email marketing platform | United States | Standard Contractual Clauses (SCCs) |
Meta Platforms (Facebook/Instagram) | Advertising and audience targeting | United States | Standard Contractual Clauses (SCCs) |
Google LLC | Advertising, analytics | United States | Standard Contractual Clauses (SCCs) |
TikTok Technology Limited | Advertising and audience targeting | Ireland / potentially Singapore and China | Standard Contractual Clauses (SCCs) |
Note on TikTok: TikTok’s EU legal entity is incorporated in Ireland. Certain personnel in other jurisdictions, including China, may access EU user data under controlled conditions. We share data with TikTok only where you have actively consented to marketing cookies. You may withdraw this consent at any time via our cookie banner.
5.3 Legal and Regulatory Disclosure
We may disclose your personal data to regulatory authorities, law enforcement agencies, or courts where required by applicable law or a court order.
6. International Data Transfers
6.1 KASAI is based in Romania, within the European Union. Your data is primarily stored and processed within the EU/EEA.
6.2 Where we transfer your data to providers located outside the EU/EEA, we ensure appropriate safeguards are in place in accordance with GDPR Art. 46, specifically through Standard Contractual Clauses (SCCs) approved by the European Commission.
6.3 You may request a copy of the relevant transfer safeguards by contacting us at contact@kasai-studio.com.
7. How Long We Keep Your Data
Data Category | Retention Period | Reason |
|---|---|---|
Order and transaction records | 10 years | Romanian accounting and tax law (Law 82/1991) |
Customer account data (active) | Duration of account plus 2 years after last activity | Contract performance and warranty period |
Customer account data (deleted) | 30 days after deletion request, then purged | GDPR right to erasure |
Delivery and logistics data | 2 years from delivery | Warranty claims and dispute resolution |
Marketing consent and communication history | Until consent is withdrawn plus 1 year | Proof of consent |
Cookie consent records | 1 year from consent | GDPR accountability requirement |
Customer service communications | 3 years from last interaction | Dispute resolution and legitimate interests |
Fraud prevention and security logs | 1 year | Legitimate interest in security |
8. Your Rights Under GDPR
You may exercise any of the following rights by contacting us at contact@kasai-studio.com. We will respond within 30 calendar days.
8.1 Right of Access (Art. 15): Request confirmation of whether we process your personal data and receive a copy of that data.
8.2 Right to Rectification (Art. 16): Request correction of inaccurate or completion of incomplete personal data.
8.3 Right to Erasure (Art. 17): Request deletion of your personal data where it is no longer necessary, consent has been withdrawn, or processing has been unlawful.
Important: We are legally required to retain invoices and transaction records for up to 10 years under Romanian tax law. This obligation overrides the right to erasure for those specific records.
8.4 Right to Restriction of Processing (Art. 18): Request that we restrict processing of your data in certain circumstances.
8.5 Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
8.6 Right to Object (Art. 21): Object at any time to processing based on our legitimate interests. You have an absolute right to object to direct marketing at any time.
8.7 Right to Withdraw Consent (Art. 7(3)): For marketing emails, click the unsubscribe link. For cookies and tracking, update preferences via the cookie banner on our Website.
8.8 Automated Decision-Making (Art. 22): KASAI does not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
9. How We Protect Your Data
9.1 We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction.
9.2 These measures include:
- SSL/TLS encryption for all data transmitted through the Website
- Secure, access-controlled hosting infrastructure (SiteGround, Bulgaria/EU)
- Payment data processed exclusively by Netopia Payments. KASAI does not store card details
- Limited internal access to personal data on a need-to-know basis
- Regular review of our data handling practices
9.3 In the event of a personal data breach, we will notify ANSPDCP within 72 hours and notify you directly without undue delay where the breach poses a high risk to you.
10. Cookies
We use cookies and similar tracking technologies on our Website, managed through Complianz. Non-essential cookies are only placed after you have actively accepted them via our cookie consent banner. For full details, please see our Cookie Policy at www.kasai-studio.com/cookie-policy.
11. Links to Third-Party Websites
Our Website may contain links to third-party websites. KASAI is not responsible for the privacy practices or content of any third-party website.
12. Complaints and Supervisory Authority
12.1 If you have a concern about how we handle your personal data, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania.
12.2 We would always appreciate the opportunity to address your concerns directly before a regulatory complaint is made. Please contact us first at contact@kasai-studio.com.
13. Updates to This Policy
We may update this Privacy Policy from time to time. The date at the top of this Policy indicates when it was last updated. Where changes are material, we will notify registered customers by email and display a notice on the Website.
© 2026 KASAI. All rights reserved.