プライバシーポリシー

Last updated: July 28, 2026

GDPR PRIVACY POLICY

This privacy policy (hereinafter referred to as the “Privacy Policy”) is intended to inform customers (hereinafter referred to as “Customers”, “you”, or “your”) residing in the United Kingdom (UK) or the European Economic Area (EEA) who visit the website (hereinafter referred to as “our Website”) of Shibuly Co., Ltd. (Shibuya Dogenzaka Tokyu Building 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo) (hereinafter referred to as the “Company”, “we”, “us”, or “our”) about the collection, use, disclosure, transfer, and other processing of their Personal Data.

The Company processes your Personal Data in accordance with the UK and EU data protection regulations, including the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation 2016/679 (hereinafter collectively referred to as “GDPR”).

Personal Data We Process

We process the following categories of Personal Data:

Customer Identification Information: Name, email address, phone number.
Shipping Information: Address for product delivery.
Transaction Information: Details of transactions on our website, history of past transactions and inquiries.
Payment Status Information: Information regarding the success or failure of payments made by Customers when purchasing products, provided by payment service providers.
Online Identifiers: IP address, cookie or similar identifiers, and device and browser information.
Website Activity and Advertising Event Data: Pages and products viewed, searches, items added to the cart, initiation of checkout, the event that payment information is added (but not payment card details), purchases, order value, and related event identifiers and timestamps.

How We Collect Personal Data

We collect your Personal Data either directly from the Customers or indirectly through third parties in the following cases:

Direct Collection: We obtain Customer Identification Information, Shipping Information, and Transaction Information directly from you when:

You enter information into the registration form on our website;
You enter information into the form when purchasing products on our website;
You contact our inquiry desk via email; or
We acquire it in the process of your purchasing products from our website.

Indirect Collection (Payment): We use Shopify Payments, provided by Shopify Commerce Singapore Pte. Ltd., for the settlement of payments on our Website. Payment transactions may be processed by payment processing service providers, including Stripe Japan Co., Ltd. We share Customer Identification Information and Transaction Information with these providers to the extent necessary to process payments.
Automatic and Event-Based Collection: We automatically collect Online Identifiers and Device Information and Website Activity and Advertising Event Data when you visit or interact with our Website. Where you consent to marketing-related processing, this information, together with available Customer Identification Information, location information and Transaction Information, may be transmitted to Meta Platforms Ireland Limited through the Meta Pixel and Conversions API.

Purposes and Legal Basis for Processing

We process Personal Data for the purposes and based on the legal bases listed below. We strive to ensure that the Personal Data processed is adequate, relevant, and limited to what is necessary for the achievement of these purposes. If we process Personal Data for a purpose other than the original purpose, we will notify you to that effect.

Purpose of Processing	Categories of Personal Data	Legal Basis for Processing
To identify the Customer	Customer Identification Information: Name, email address, phone number	Performance of a contract (Article 6(1)(b) GDPR)
To allow the Customer to purchase products on our website	Customer Identification Information: Name, email address, phone number	Performance of a contract (Article 6(1)(b) GDPR)
	Transaction Information: Details of transactions, transaction history
	Payment Status Information: Success/failure of payment
To deliver purchased products to the Customer	Customer Identification Information: Name, email address, phone number	Performance of a contract (Article 6(1)(b) GDPR)
	Transaction Information: Transaction details
	Shipping Information: Address
To support product purchases and respond to related inquiries	Contact Information: Name, email address, phone number	Performance of a contract (Article 6(1)(b) GDPR)
	Transaction Information: Contract details, transaction details, transaction history, etc.	Performance of a contract (Article 6(1)(b) GDPR)
To deliver and optimize advertising on Meta services, measure advertising performance and conversions, and match Website events with users of Meta services.	Customer Identification Information: Name, email address, phone number. Shipping Information: Address for product delivery. Transaction Information: Details of transactions on our website, history of past transactions and inquiries. Online Identifiers: IP address, cookie or similar identifiers, and device and browser information. Website Activity and Advertising Event Data: Pages and products viewed, searches, items added to the cart, initiation of checkout, the event that payment information is added (but not payment card details), purchases, order value, and related event identifiers and timestamps.	Consent (Article 6(1)(a) GDPR).

Retention Period of Personal Data

We will retain your Personal Data only for as long as it is necessary to achieve the purposes set out above, and we will not retain Personal Data beyond the necessary period unless required by law. Specifically, we retain Personal Data for the following periods:

Categories of Personal Data	Retention Period
Customer Identification Information	Until 2 years have passed since the date the Customer deregistered from our site.
Shipping Information	Until 2 years have passed since the date the Customer deregistered from our site.
Transaction Information	Until 2 years have passed since the date the Customer deregistered from our site.
Payment Status Information	Until 2 years have passed since the date the Customer deregistered from our site.
Online Identifiers; Website Activity and Advertising Event Data	Cookie-related retention periods are described in our Cookie Policy. Event Data received by Meta may be retained for a maximum of two years in accordance with the Meta Business Tools Terms.

Sharing of Personal Data

In accordance with the GDPR, we share your Personal Data with third parties operating the businesses listed below for the purposes stipulated in this Privacy Policy. This sharing includes transferring your Personal Data to Japan, which is outside the UK/EEA.

(1) EC Site Platform

We use the e-commerce platform "Shopify" to build and operate our online store and to store and manage Customer information. We share Customer Personal Data—including Customer Identification Information, Shipping Information, Transaction Information, Payment Status Information, and Online Identifiers—with Shopify International Ltd., located in Ireland.

(2) Payment Settlement Services

We use Shopify Payments, provided by Shopify Commerce Singapore Pte. Ltd., for the settlement of payments on our Website. Payment transactions may be processed by payment processing service providers, including Stripe Japan Co., Ltd. We share Customer Identification Information and Transaction Information with these providers to the extent necessary to process payments.

Privacy Policy: https://www.shopify.com/ie/legal/privacy?country=ie&lang=en
https://www.shopify.com/legal/privacy

(3) Logistics, Warehousing, Delivery and Delivery Management Service Providers

For the purposes of processing orders and delivering products, we share your name, contact details, shipping address, details of purchased products, and other information necessary for delivery with logistics providers, warehouse operators, delivery service providers and providers of delivery management systems.

Examples of delivery service providers that we may use include:

Japan Post Co., Ltd.: https://www.post.japanpost.jp/privacy.html
Federal Express Corporation: https://www.fedex.com/en-us/trust-center/privacy.html
DHL International GmbH: https://group.dhl.com/en/data-protection.html
United Parcel Service, Inc.: https://www.ups.com/gb/en/support/shipping-support/legal-terms-conditions/privacy-notice

(4) Meta Business Tools

With your consent, we use the Meta Pixel and Conversions API provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), in connection with advertising on Facebook, Instagram and other Meta services.

Through these tools, we may collect and transmit Website Activity and Advertising Event Data, including pages and products viewed, searches, items added to the cart, checkout and purchase events, order value, IP address, device and browser information, cookie or similar identifiers and, where available, matching information such as name, email address, phone number and location information. Payment card details are not transmitted to Meta through these tools.

We use this information to deliver and optimise advertising, measure advertising performance and conversions, and match Website events with users of Meta services. The legal basis for this processing is your consent under Article 6(1)(a) GDPR. You may refuse or withdraw your consent at any time through the Cookie settings made available on our Website. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

With respect to the collection and transmission of Event Data through the Meta Business Tools, the Company and Meta act as joint controllers in accordance with Meta’s Controller Addendum. Meta remains an independent controller for processing that takes place after Meta receives the Event Data. You may exercise your rights in relation to the joint processing against either the Company or Meta.

Meta may process or transfer Personal Data outside the UK or EEA, including in the United States, as described in the Meta Privacy Policy. Further information about Meta’s processing practices, international transfers and the allocation of responsibilities between the Company and Meta is available at:

Meta Privacy Policy: https://www.facebook.com/privacy/policy/
Meta Controller Addendum: https://www.facebook.com/legal/controller_addendum
Meta Business Tools Terms: https://www.facebook.com/legal/technology_terms

Transfer of Personal Data Outside the UK or EEA

We are located in Japan, and your Personal Data is processed in Japan. As Japan is a country covered by the European Commission’s adequacy decision (Commission Implementing Decision of 23 January 2019) and by the UK Government’s adequacy regulations, the transfer of your Personal Data to Japan is made, pursuant to Article 45 of the GDPR, on the basis that an adequate level of protection is ensured.

We use services provided by Shopify. Personal Data of Customers located in the EEA or UK may be received by Shopify International Ltd. in Ireland and subsequently transferred to and processed by Shopify group companies and service providers in other countries, including Singapore, Canada and the United States. According to Shopify, transfers from the EEA to Shopify group companies are protected by Shopify’s approved Binding Corporate Rules, and transfers to third-party service providers are protected by Standard Contractual Clauses where appropriate. Transfers from the UK are protected by applicable Standard Contractual Clauses, the UK International Data Transfer Addendum and applicable adequacy regulations. Further information is available in Shopify’s Privacy Policy and Data Processing Addendum.

Disclosure to Authorities and Courts

We may be required to disclose Personal Data based on instructions from public authorities or courts in the context of investigations or legal proceedings. We may also disclose Personal Data if we determine in good faith that it is reasonably necessary to protect our rights and pursue available remedies.

Your Legal Rights

You have the following rights with respect to the Personal Data that we collect and process:

(1) Right of Access

You have the right to access your Personal Data. You may also receive a copy of your Personal Data held by us (although this may not necessarily be in document form).

(2) Right to Rectification

You have the right to request the correction of inaccurate Personal Data concerning you.

(3) Right to Erasure (Right to be Forgotten)

You have the right to request the erasure of your Personal Data if any of the following requirements are met:

The Personal Data is no longer necessary for the purposes for which it was collected or processed;
The processing is based on consent, you withdraw that consent, and there is no other legal ground for the processing;
You object to the processing and there are no overriding legitimate grounds for the processing;
The Personal Data has been unlawfully processed;
The Personal Data has to be erased for compliance with a legal obligation to which we are subject; or
The Personal Data has been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

Note: We may not be required to comply with your request if processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.

(4) Right to Restriction of Processing

You have the right to request the restriction of processing of your Personal Data if any of the following requirements are met:

You contest the accuracy of the Personal Data, for a period enabling us to verify the accuracy of the Personal Data;
The processing is unlawful and you oppose the erasure of the Personal Data and request the restriction of its use instead;
We no longer need the Personal Data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims; or
You have objected to processing pending the verification whether our legitimate grounds override yours.

Note: Even where processing has been restricted, we may continue to process such Personal Data (i) with your consent; (ii) for the establishment, exercise or defence of legal claims; (iii) for the protection of the rights of another natural or legal person; or (iv) for reasons of important public interest of the United Kingdom, the EU, or a Member State.

(5) Right to Data Portability

Where the processing is based on consent or the performance of a contract and is carried out by automated means, you have the right to receive the Personal Data you have provided to us in a structured, commonly used, and machine-readable format, and to request the transfer of such data to another controller.

(6) Right to Object

You have the right to object, on grounds relating to your particular situation, at any time to processing of your Personal Data which is based on Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions. We shall no longer process the Personal Data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where Personal Data is processed for direct marketing purposes, you have the right to object at any time to processing of your Personal Data for such marketing.

(7) Right not to be Subject to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless:

It is necessary for entering into, or performance of, a contract between you and us;
It is authorized by UK or EU law (or Member State law) to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
It is based on your explicit consent.

(8) Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw your consent at any time.

(9) Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a supervisory authority in the Member State of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of your Personal Data infringes the applicable data protection laws.

Automated Decision-Making

We do not make decisions based solely on automated data processing (including profiling) that would have legal effects or similarly significant effects on you.

Personal Data of Individuals Under 18

Our website prohibits use by individuals under the age of 18. Accordingly, we do not knowingly handle Personal Data of individuals under the age of 18.

Updates to this Privacy Policy

We may revise or update this Privacy Policy from time to time. Any changes to this policy will become effective at the time the revised Privacy Policy is posted on our website.

Contact Details

If you have any questions about this Privacy Policy or requests, please contact us at the following addresses:

[Shibuly Co., Ltd.]

Address: Shibuya Dogenzaka Tokyu Building 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo, 150-0043, Japan

E-mail: contact@shibuly.com

[EU/EEA GDPR Representative]

If you are located in the EU, and have questions or concerns regarding your personal data, you may contact our GDPR representative:

EU Representative:

Euverify Ltd (Ireland), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland

Email: gdpr@euverify.com

To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, please use our secure portal.

This link allows you to verify our appointed representative and submit GDPR requests directly. Requests submitted through this portal are logged and tracked to ensure timely response and compliance.

Cookie Policy

1. What are Cookies?

A Cookie is a small text file that a website sends to, and stores on, your web browser when you access that website.

2. Types of Cookies Used on Our Website

Our website https://shibuly.com/ (hereinafter referred to as “our Website”) uses the following categories of Cookies:

(1) Strictly Necessary Cookies These Cookies are strictly necessary for our Website to function properly and effectively. They are used for purposes such as enabling cart functionality, managing sessions and ensuring security. Without these Cookies, certain features you request — such as navigating between pages — may not be technically possible.

(2) Analytics / Performance Cookies These Cookies collect information about how you use our Website, helping us to measure and improve its performance.

(3) Marketing Cookies These Cookies are used to deliver content and information tailored to your interests.

3. Details of Cookies Used on Our Website

The Cookies used on our Website are set out in detail below:

Cookie Name	Purpose	Duration	Recipient & Privacy Policy	Legal Basis
_ab	Controls when the admin bar is displayed on the storefront.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
_abv	Keeps the admin bar in a collapsed state.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
_checkout_queue_token	Manages a customer’s place in the queue when checkout is subject to a wait or processing delay.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
_cmp_a	Stores and manages the customer’s privacy settings.	1 day	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
_identity_session	Identifies and maintains the customer’s authentication session within Shopify’s authentication system, in order to manage login status, provide account features, ensure security and prevent fraudulent use.	2 years	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
_master_udr	An ID that identifies the customer’s browser or device when the online store is used, supporting session management, authentication, security, fraud prevention and the proper functioning of other core features of the online store.	Session	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
_pay_session	Maintains the customer’s payment session during Shop Pay / Shopify Pay transactions so that checkout can be completed securely and accurately.	Session	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
_secure_account_session_id	Tracks the session of a customer using a new customer account.	30 days	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
_session_id	Used to generate reporting and analytics.	2 years	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
_shopify_country	Used in stores where the price currency or country is determined from the visitor’s GeoIP location; helps avoid repeating the GeoIP lookup after the first request.	30 minutes	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
_shopify_essential	Contains information essential to the correct functioning of the store, such as session and checkout data and tamper-protection data.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
_storefront_u	Facilitates updates to customer account information.	1 minute	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
_tracking_consent	Stores the user’s preferences where we have defined privacy rules for the visitor’s region.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
auth_state_<>	Stores the authentication state before the customer is redirected to an external service for authentication.	25 minutes	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
card_update_verification_id	Supports verification when the buyer is redirected back to Shopify after completing 3-D Secure during checkout.	20 minutes	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
cart	Holds information relating to the user’s cart.	2 weeks	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
cart_currency	Initializes a new, empty cart in the same currency as the one most recently used, once checkout is completed.	2 weeks	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
cart_sig	Stores a hash of the cart contents, used to verify the integrity of the cart and to maintain the performance of cart operations.	2 weeks	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
cart_ts	Used in connection with the checkout process.	2 weeks	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
checkout	Used in connection with the checkout process.	21 days	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
checkout_prefill	Encrypts and stores URL parameters containing personal information (PII) that are used for the cart permalink URL.	5 minutes	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
checkout_session_lookup	Used in connection with the checkout process.	3 weeks	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
checkout_session_token_<>	Used when a checkout session is established on the server.	3 weeks	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
checkout_token	Captures the landing page when a visitor arrives from another site.	Session	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
customer_account_locale	Remembers the customer account locale when a redirect to the customer account occurs from checkout or the storefront.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
customer_payment_method	Stores the payment method being updated for a subscription.	1 hour	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
customer_shop_pay_agreement	Supports authentication of a new Shop Pay payment method.	20 minutes	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
device_fp_id	A device fingerprint ID used to prevent fraudulent orders.	Session	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
device_id	A session-level device ID used to prevent fraudulent orders.	Session	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
discount_code	Stores a discount code (received as a URL parameter when the online store is visited) for use at the next checkout.	Session	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
dynamic_checkout_shown_on_cart	Tailors the checkout experience for buyers proceeding to standard checkout and those proceeding to dynamic checkout.	30 minutes	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
hide_shopify_pay_for_checkout	Set when a buyer dismisses the Shop Pay login modal during checkout, and used to display a notification to the buyer.	Session	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
identity-state	Stores the state before the customer is redirected to identity verification.	1 day	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
identity-state-<>	Stores the state before the customer is redirected to identity verification.	1 day	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
identity_customer_account_number	Stores an ID used to facilitate login across the customer account domain and the storefront domain.	12 weeks	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
keep_alive	Determines whether a request is the first in a session when international domain redirects are enabled.	Session	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
locale_bar_accepted	Records whether a modal from the geolocation app has been accepted.	Session	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
locale_bar_dismissed	Records whether a modal from the geolocation app has been dismissed.	1 day	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
localization	Localizes the cart to the correct country.	2 weeks	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
logged_in	Used as a hint to facilitate the user’s own login.	12 weeks	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
login_with_shop_finalize	Facilitates login with Shop.	5 minutes	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
master_device_id	A persistent device ID.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
order	Allows access to the buyer’s order detail page data.	3 weeks	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
pay_update_intent_id	Stores the ID of the Shop Pay billing-agreement update intent required for the callback after a new Shop Pay payment method is authenticated.	20 minutes	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
preview_theme	Indicates whether a theme is being previewed.	Session	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
previous_checkout_token	Pre-fills the details of the previous checkout at checkout.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
previous_step	Used in connection with the checkout process.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
profile_preview_token	Used to preview checkout customizations.	5 minutes	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
receive-cookie-deprecation	A cookie set by Google to identify certain Chrome browsers affected by the deprecation of third-party cookies.	Session	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
remember_me	Pre-fills the details of the previous checkout at checkout.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
secure_customer_sig	Identifies the user so that they do not need to log in again after logging in to the shop as a customer.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
shop_pay_accelerated	Indicates whether a buyer is eligible for Shop Pay accelerated checkout.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
shopify-editor-unconfirmedsettings	Stores changes made by the merchant in the editor in order to update the preview.	16 hours	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
shopify_pay	Used to log in to Shop Pay when a buyer returns to the checkout of the same store.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
shopify_pay_redirect	Speeds up the checkout process when a buyer has a Shop Pay account.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
storefront_digest	Stores a digest of the storefront password, allowing the merchant to preview the storefront while it is password-protected.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
tracked_start_checkout	Used in connection with the checkout process.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
user	Used in connection with login to Shop.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
user_cross_site	Used in connection with login to Shop.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
wpm-domain-test	Tests that Shopify’s web pixel manager is functioning correctly on the domain.	Session	Shopify International Ltd. (Ireland) Privacy Policy	Legitimate interests (Art. 6(1)(f) GDPR): Necessary to provide the basic functions of our Website (online store) and to ensure its security and integrity.
_landing_page	Captures the landing page when a visitor arrives from another site.	2 weeks	Shopify International Ltd. (Ireland) Privacy Policy	Consent (Art. 6(1)(a) GDPR; ePrivacy Directive / UK PECR): Used, with your consent, to analyze and improve how our Website is used.
_orig_referrer	Enables the merchant to identify the source of a visitor’s traffic.	2 weeks	Shopify International Ltd. (Ireland) Privacy Policy	Consent (Art. 6(1)(a) GDPR; ePrivacy Directive / UK PECR): Used, with your consent, to analyze and improve how our Website is used.
_shopify_ga	Contains Google Analytics parameters that enable cross-domain analytics measurement.	Session	Shopify International Ltd. (Ireland) Privacy Policy	Consent (Art. 6(1)(a) GDPR; ePrivacy Directive / UK PECR): Used, with your consent, to analyze and improve how our Website is used.
_shopify_s	Identifies a particular combination of browser session and shop.	30 minutes	Shopify International Ltd. (Ireland) Privacy Policy	Consent (Art. 6(1)(a) GDPR; ePrivacy Directive / UK PECR): Used, with your consent, to analyze and improve how our Website is used.
_shopify_sa_p	Captures the landing page when a visitor arrives from another site, to support marketing analytics.	30 minutes	Shopify International Ltd. (Ireland) Privacy Policy	Consent (Art. 6(1)(a) GDPR; ePrivacy Directive / UK PECR): Used, with your consent, to analyze and improve how our Website is used.
_shopify_sa_t	Captures the landing page when a visitor arrives from another site, to support marketing analytics.	30 minutes	Shopify International Ltd. (Ireland) Privacy Policy	Consent (Art. 6(1)(a) GDPR; ePrivacy Directive / UK PECR): Used, with your consent, to analyze and improve how our Website is used.
_shopify_y	Provides Shopify store analytics.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Consent (Art. 6(1)(a) GDPR; ePrivacy Directive / UK PECR): Used, with your consent, to analyze and improve how our Website is used.
checkout_one_experiment	Used when checkout is eligible for Checkout One and has been assigned to a test (control or test group).	Session	Shopify International Ltd. (Ireland) Privacy Policy	Consent (Art. 6(1)(a) GDPR; ePrivacy Directive / UK PECR): Used, with your consent, to analyze and improve how our Website is used.
shop_analytics	Contains buyer information required for Shop analytics.	1 year	Shopify International Ltd. (Ireland) Privacy Policy	Consent (Art. 6(1)(a) GDPR; ePrivacy Directive / UK PECR): Used, with your consent, to analyze and improve how our Website is used.
unique_interaction_id	Used for checkout metrics.	10 minutes	Shopify International Ltd. (Ireland) Privacy Policy	Consent (Art. 6(1)(a) GDPR; ePrivacy Directive / UK PECR): Used, with your consent, to analyze and improve how our Website is used.
_fbp	Identifies a browser for advertising delivery, advertising measurement and site analytics.	90 days	Meta Platforms Ireland Limited (Ireland). https://www.facebook.com/privacy/policy/	Consent (Art. 6(1)(a) GDPR; ePrivacy Directive / UK PECR): Used, with your consent, to analyze and improve how our Website is used.
_fbc	Stores the Meta click identifier when a visitor reaches our Website after clicking a Meta advertisement, to support conversion attribution and measurement. This Cookie is not set on every visit.	90 days	Meta Platforms Ireland Limited (Ireland). https://www.facebook.com/privacy/policy/	Consent (Art. 6(1)(a) GDPR; ePrivacy Directive / UK PECR): Used, with your consent, to analyze and improve how our Website is used.

Depending on how you reach our Website and your browser, device and consent settings, one or both of the Meta Cookies listed above may not be set. We also use the Meta Conversions API, which transmits certain Event Data between Shopify and Meta through server-to-server communications and does not operate solely through browser Cookies. Further information is provided in the “Meta Business Tools” section of our Privacy Policy.

4. Consent to the Use of Cookies

With the exception of Strictly Necessary Cookies, we rely on your consent as the legal basis for the use of Cookies on our Website, including Analytics / Performance Cookies and Marketing Cookies (Art. 6(1)(a) GDPR; ePrivacy Directive / UK PECR). When you first access our Website, a Cookie banner is displayed asking for your consent to the use of Cookies. Through this banner, you can accept or refuse Cookies by category, and you can withdraw or change your consent at any time. Strictly Necessary Cookies, however, are used irrespective of whether consent is given, as they are essential to providing the basic functions of our Website (Art. 6(1)(f) GDPR: legitimate interests).

5. International Data Transfers

Whether your Cookie data is transferred internationally, and the safeguards applied to any such transfer, are described in the privacy policy of the relevant third-party provider linked in the table in Section 3. Recipients of Cookie data may include Shopify International Ltd. and Meta Platforms Ireland Limited, both located in Ireland.

Meta may process or transfer Personal Data outside the UK or EEA, including in the United States, as described in the Meta Privacy Policy. As explained in our Privacy Policy, any transfer of Personal Data is carried out subject to the applicable requirements and safeguards under data protection law.

6. Other

We may update this Policy from time to time, and any changes will be reflected on our Website. Please review the latest information on our use of Cookies, and contact us using the contact details provided in our Privacy Policy if you have any questions.