Privacy Policy

1. Data we collect and how

• Contact form submissions: When you use the contact form, we collect your name, email address, optional subject line, and the message text. This data is stored only for the purpose of responding to your enquiry.
• Analytics data: If you consent to analytics cookies, we collect anonymised information about page visits, browser type, and approximate geographic region via Google Analytics. This data does not identify you personally.
• Cookie preferences: Your cookie consent choices are stored locally in your browser via localStorage. This data does not leave your device.
• Technical logs: Our web hosting provider may retain standard server access logs (IP address, request timestamps, browser agent) for up to 30 days for security and diagnostic purposes.

2. How we use personal data

• Responding to enquiries: Contact form data is used solely to reply to the message you sent. We do not add you to any mailing list or share your details with third parties for marketing purposes.
• Website improvement: Aggregated analytics data helps us understand which pages are useful and where visitors encounter difficulty. No individual profiles are built from this data.
• Legal basis: We process contact form data on the basis of legitimate interest in responding to your request. Analytics processing is based on your explicit consent, which you can withdraw at any time via the cookie settings on this site.

3. Data sharing and third parties

• Google Analytics: If analytics cookies are accepted, data is sent to Google LLC under a data processing agreement. Google may process this data outside Japan. You can opt out at any time by rejecting analytics cookies.
• No data sales: Tsumugi does not sell, rent, or exchange personal data with any third party for commercial purposes.
• Legal disclosure: We may be required to disclose data if compelled by applicable law or court order. We will notify you if legally permitted to do so.

4. Data retention

• Contact enquiries: Email correspondence is kept for up to 24 months, after which it is deleted unless an ongoing business relationship requires longer retention.
• Analytics data: Google Analytics data is retained for 14 months under our account settings.
• Server logs: Hosting provider logs are deleted after 30 days.

5. Data protection measures

• Encryption in transit: All data transmitted between your browser and this website is encrypted via HTTPS/TLS.
• Access controls: Access to email correspondence is limited to staff directly involved in handling enquiries. No stored database of contact form submissions is maintained beyond the email thread.
• Breach procedures: In the event of a data breach affecting your personal information, we will notify you and relevant authorities in accordance with applicable law.

6. Your rights

• Right of access: You may request a copy of any personal data we hold about you.
• Right to rectification: You may ask us to correct inaccurate information.
• Right to erasure: You may request deletion of your personal data, subject to any legal retention obligations.
• Right to data portability: You may request your data in a commonly used electronic format.
• Right to object: You may object to processing based on legitimate interest. We will assess and respond to such requests promptly.
• Withdraw consent: Where processing relies on consent (e.g. analytics cookies), you can withdraw it at any time via the cookie preferences page.

7. Changes to this policy

We may update this privacy policy from time to time. When we do, the date at the top of this page will change. Continued use of the website after an update constitutes acceptance of the revised policy. For significant changes, we will add a notice to the homepage.