Our Approach to Personal Data
At Yoritarencaryn, we recognize that personal information should be handled with care and transparency. When you browse our store, place an order, arrange delivery, or contact our customer service team, certain information may be needed to provide the requested services and manage the customer relationship.
This page explains how personal data may be processed and outlines the rights available under the General Data Protection Regulation (GDPR) when it applies to the relevant processing. The rights and obligations described here depend on the circumstances and applicable law.
Personal Data We May Process
The categories of information processed depend on how you interact with the website and which services you use. They may include:
Contact information: Your name, email address, telephone number, and other contact details you provide.
Order and delivery information: Products purchased, order references, billing details, delivery address, and information needed to arrange or confirm delivery.
Payment-related information: Payment status, transaction references, and information required to verify or manage a payment. Payment card details may be handled by the relevant payment provider rather than being directly accessible to the store, depending on the payment method and configuration.
Customer service communications: Messages, questions, complaints, and other details you provide when requesting assistance.
Technical and usage information: Certain device, browser, log, or website interaction information may be processed to support website operations, security, or performance analysis where those functions are implemented.
We do not intend to request sensitive personal data unless it is genuinely necessary and there is an appropriate legal basis to do so.
Why We Process Personal Data
Personal information may be processed for specific purposes, depending on the circumstances.
Order fulfillment and contract performance
We may use relevant contact, order, payment-status, and delivery information to process purchases, confirm order details, coordinate shipment, and respond to order-related requests. Where processing is necessary to take steps at your request or perform a contract with you, the applicable GDPR legal basis may be contract performance or pre-contractual steps.
Customer support and communications
We may use the information you provide to answer enquiries, investigate order issues, respond to complaints, and communicate about a purchase. Depending on the situation, processing may be necessary for contract performance or supported by a legitimate interest, where that interest is not overridden by your rights and interests.
Legal and record-keeping requirements
Certain records may need to be retained or disclosed to comply with applicable tax, accounting, consumer protection, or other legal obligations. Where processing is required by law, the relevant legal basis is compliance with a legal obligation.
Website operations and security
Technical information may be used where necessary to maintain website functionality, diagnose errors, protect systems, and investigate suspected misuse or fraudulent activity. Depending on the processing, the legal basis may be a legitimate interest or another basis permitted by applicable law.
Optional analytics or marketing
If analytics or marketing technologies are actually used, related information may be processed for the purposes disclosed at the time of collection. Where GDPR requires consent for a particular activity, we will rely on consent before carrying out that activity. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
The legal basis depends on the specific purpose and processing activity. We do not rely on a single legal basis for every use of personal data.
How Information May Be Shared
Personal data may be disclosed where reasonably necessary to provide services, complete transactions, respond to requests, or meet legal obligations. Depending on the services actually used, recipients may include:
-
Payment service providers or financial institutions involved in processing or verifying transactions.
-
Delivery and logistics providers that need shipment information to transport orders.
-
Website hosting, technical support, or other service providers that help operate the store.
-
Professional advisers, public authorities, or law enforcement agencies where disclosure is legally required or otherwise permitted.
Information shared with a service provider should be limited to what is reasonably necessary for its assigned task. The specific recipients depend on the website's actual service arrangements.
We do not state that a particular third party receives personal data unless that arrangement has been confirmed. We do not sell personal information in exchange for monetary payment as part of the ordinary operation described by this notice; however, the legal classification of certain data disclosures may depend on the applicable privacy law and the technology involved.
International Data Transfers
Personal data may be processed in a country different from the country where the individual resides. For example, a business operating from the United States may use service providers or systems that process information across borders.
Where GDPR applies and personal data is transferred outside the European Economic Area, the transfer must comply with the GDPR's international transfer requirements. Depending on the circumstances, this may require an adequacy decision, appropriate safeguards, or another lawful transfer mechanism.
The actual locations of processing and the transfer mechanisms used depend on the services engaged and should be verified before publication of this notice. We do not claim that a specific adequacy decision or contractual safeguard is in place unless it has been confirmed.
Data Retention
Personal data is retained for no longer than reasonably necessary for the purpose for which it was collected, subject to applicable legal obligations and legitimate operational needs.
For example, order and transaction records may need to be retained for accounting, tax, dispute resolution, or legal compliance. Customer service messages may be kept for a period needed to respond to enquiries and maintain relevant records. Technical information may have different retention periods depending on its function and configuration.
Retention periods vary according to the type of information, the reason for processing, and the legal requirements that apply. When personal data is no longer required, it should be deleted or otherwise handled in accordance with applicable law and the relevant retention procedures.
Data Protection and Security
We take the handling of personal information seriously and seek to limit access and use to legitimate business needs. Appropriate data protection measures should be selected according to the type of information, the risks involved, and the systems and service providers used.
No method of electronic storage or transmission can be guaranteed to be completely secure in every circumstance. Customers should protect their email accounts and other credentials and avoid sending passwords, full payment card details, or other unnecessary sensitive information through unsecured channels.
Where GDPR applies, personal data must be processed in accordance with its applicable security and accountability requirements.
Your Rights Under the GDPR
If the GDPR applies to the processing of your personal data, you may have the following rights, subject to the relevant legal conditions and exceptions.
Right of access: You may request confirmation of whether your personal data is being processed and, where applicable, obtain access to that data and related information.
Right to rectification: You may request correction of inaccurate personal data or completion of incomplete information.
Right to erasure: In certain circumstances, you may request deletion of personal data. This right is not absolute, and some information may need to be retained to comply with legal obligations or establish, exercise, or defend legal claims.
Right to restriction of processing: In certain circumstances, you may request that the use of your personal data be restricted.
Right to data portability: Where the legal conditions are met, you may request personal data you have provided in a structured, commonly used, machine-readable format and may have the right to transmit it to another controller.
Right to object: Where processing is based on legitimate interests or another applicable ground covered by the GDPR, you may have the right to object based on your particular situation. You have an absolute right to object to processing of personal data for direct marketing where the GDPR provides that right.
Right to withdraw consent: Where processing relies on consent, you may withdraw it at any time. Withdrawal does not affect processing lawfully carried out before the consent was withdrawn.
These rights are not unconditional in every situation. Applicable law may allow certain exceptions, and we may need to assess the nature of the request and the relevant legal requirements before responding.
How to Submit a Privacy Request
To ask a question about personal data or exercise a right that applies to you, contact us using the details provided at the end of this page. Please describe your request clearly so we can understand the information or processing involved.
We may request reasonable information to verify your identity or authority to make the request. Please do not send passwords, complete payment card details, or other unnecessary sensitive information.
Where GDPR applies, requests will generally be handled without undue delay and within one month of receipt. This period may be extended by up to two additional months where the request is complex or numerous requests have been received, as permitted by the GDPR. If an extension applies, the requester should be informed within the initial one-month period. Applicable law may provide additional details or exceptions.
If we cannot take action on a request, we will explain the reasons where required by law and inform you of any applicable options for making a complaint or seeking a remedy.
Complaints to a Data Protection Authority
If the GDPR applies to your personal data, you may have the right to lodge a complaint with a competent data protection supervisory authority, particularly in the EU or EEA. The appropriate authority may depend on your place of residence, workplace, the location of the alleged infringement, and the circumstances of the processing.
You may contact the relevant supervisory authority directly for information about its complaint procedure. Contacting us first may help us understand and address your concern, but it does not remove any right you may have to complain to a supervisory authority.
Children's Personal Data
Our products and services are presented as a general retail offering. If you believe a child has provided personal information in circumstances that require special handling under applicable law, please contact us so the matter can be reviewed. Any processing involving children's personal data must be handled in accordance with the legal requirements that apply to the circumstances.
Changes to This Information
We may update this page if our data processing practices, service arrangements, or applicable legal requirements change. The revised version will be published on this page, with an updated effective date where appropriate.
Contact Information
For questions about this GDPR Information page or to submit a privacy-related request, please contact us using the following details.
Email: contact@yoritarencaryn.com
Phone: +1 (940) 627-3846
Mailing Address: 500 E Highmeadow Dr #4209, Aubrey, TX 76227, United States
Customer Service Hours: Monday through Friday, 9:00 AM–6:00 PM Central Time (CT)