We ship internationally

Privacy policy

Last updated: 10 October 2026

This policy explains which personal data we use when you visit japchristmas.eu, order from us or contact us. We explain why we do so, with whom we share data, how long we keep it and what rights you have. Section 4 explains which cookies we use.

1. Who we are

japchristmas.eu is an online shop of Just Another Store B.V. We are the controller of your personal data.

Just Another Store B.V.
De Beverspijken 7D
5221 EE 's-Hertogenbosch
The Netherlands
Chamber of Commerce (KvK) 74001345, VAT NL859739053B01
Email: contact@japchristmas.eu
Phone: +31 73 644 7405 (Monday to Friday, 09:00 to 18:00 Dutch time)

Questions about privacy, or a request about your data? Email us at contact@japchristmas.eu.

2. Who this policy is for

For everyone who visits japchristmas.eu, orders from us, signs up for our emails or contacts us. Do you buy our products through a marketplace such as bol or Amazon? Then the privacy policy of that marketplace explains how it handles your data.

3. Which data we use, for what and for how long

Your order

To process, charge and ship your order, and to handle returns and the legal guarantee.

  • Data: name, address, email address, phone number, items ordered and payment status.
  • Legal basis: performance of the contract (Article 6(1)(b) GDPR).
  • How long: as long as needed for your order, a return or your guarantee. What we need for our accounts we keep for 7 years, because Dutch tax law requires it.

Preventing fraud and misuse

  • Data: IP address, browser and device data with your order.
  • Legal basis: our legitimate interest in selling safely (Article 6(1)(f) GDPR).
  • How long: as long as the data of your order.

Your customer account (if you create one)

  • Data: name, email address, addresses and order history.
  • Legal basis: performance of the contract.
  • How long: until you have your account deleted.

Checking your order status on our site

  • Data: order number and email address, and an encrypted counter of your IP address against misuse. Anyone who enters an order number with the correct email address sees the status of that order and a link to Shopify's order page, which also shows name and address.
  • Legal basis: performance of the contract; for the counter, our legitimate interest in preventing misuse.
  • How long: we do not store what you enter; the counter disappears after 10 minutes.

Customer service

To answer your question, complaint or return, and to process your withdrawal.

  • Data: name, email address, order number, your message and any photos.
  • Legal basis: performance of the contract or our legitimate interest in answering your question; for a withdrawal, our legal obligation (Article 6(1)(c) GDPR).
  • How long: as long as needed to handle your question and answer follow-up questions.

Emails with news and offers

  • Data: email address, name, when and where you signed up, and whether you open or click our emails.
  • Legal basis: consent (Article 6(1)(a) GDPR).
  • How long: until you unsubscribe. After that we keep proof of your sign-up and unsubscription for as long as we need to be able to show that we were allowed to email you.

A reminder about an unfinished order

  • Data: email address and the contents of your cart.
  • Legal basis: consent; we only send such a reminder if you have consented to emails.
  • How long: as long as needed for the reminder.

Website statistics (our own measurement)

  • Data: a visitor ID in a cookie, pages and products viewed, cart actions, search terms, where you came from, device type and browser.
  • Legal basis: consent through the cookie banner (statistics).
  • How long: the cookie 1 year; the measurement data for as long as we need it to improve our shop.

Measuring and improving advertising with Meta (Facebook, Instagram), TikTok and Google

  • Data: cookies and click IDs of those platforms (up to 90 days), what you view and buy, IP address and browser. When you order or are logged in, also your email address, phone number and name, which we pass on in encrypted (hashed) form, and your town, postcode and country.
  • Legal basis: consent through the cookie banner (marketing).
  • How long: with us, as long as the website statistics; with the platform, according to its own privacy policy.

Showing reviews

  • Data: the name or screen name and, where given, the town that a reviewer entered with the review, and the rating.
  • Legal basis: our legitimate interest in showing other customers what buyers think.
  • How long: as long as the review is on our site.

Legal obligations

  • What for: tax, the legal guarantee and requests from authorities.
  • Data: what is needed for that.
  • Legal basis: legal obligation (Article 6(1)(c) GDPR).
  • How long: as long as the law requires.

Security and backups

  • Data: all data above.
  • Legal basis: our legitimate interest and our legal obligation to secure your data (Article 32 GDPR).
  • How long: backups 14 days.

Do you have to provide data? For an order we need your name, address and email address, otherwise we cannot deliver. The checkout page shows which fields are required. Everything else is voluntary.

4. Cookies

A cookie is a small text file that a website places on your computer, tablet or phone. Similar techniques include local storage (a storage space in your browser) and pixels (a piece of code that sends a message when you view a page). Below we call all of these cookies.

Your choice

On your first visit we ask in a window whether you accept cookies for statistics and marketing. You can also decline, or choose per category. Declining has no effect on your order.

You can change your choice and withdraw your consent at any time. To do so, delete the cookies of japchristmas.eu in your browser; on your next visit we will ask for your choice again. What we did before you withdrew remains lawful.

Necessary cookies

Without these cookies the shop does not work: your cart, checkout, your language and country, your cookie choice and security. No consent is needed for these.

  • _shopify_essential (Shopify): your session, cart, checkout, your cookie choice and security. 1 year.
  • cart and cart_currency (Shopify): your cart and its currency. 3 months.
  • localization (Shopify): your country and language. 1 year.
  • _shop_app_essential (Shopify, domain shop.app): fast checkout with Shop Pay. 1 year.
  • __cf_bm (EasyGift via Cloudflare, domain cdn.506.io): security of the gift feature in the cart. 30 minutes.
  • Storage in your browser by Shopify (such as consentHeader and _shs_state, for your cookie choice and to detect misuse), by PayPal (the PayPal button in your cart) and by our shop itself (such as the products you just viewed; this stays on your own device).

We also load functional components from Shopify (shop platform and Shop Pay), EasyGift (gift in your cart), StarApps (choosing sizes and colours), a translation feature and PayPal. These parties see your IP address when doing so.

Statistics cookies

These show us how visitors use the shop, so that we can improve it. We ask for your consent for these.

  • _shopify_analytics (Shopify): statistics on the use of the shop. 1 year.
  • _nano_id (JAP Christmas, own measurement): recognises your browser on a later visit, for our own statistics. 1 year.
  • _nano_last, _nano_session and _nano_utm (JAP Christmas, own measurement): count your visit as one session and remember which campaign you came from. 1 day, or until you close your browser.
  • _ga and _ga_F5Z4YGW889 (Google Analytics): statistics. Because we link Google Analytics to Google Ads, we also use this data for marketing. 400 days.

Our own measurement runs on our own server in the Netherlands. We do not share that data with other parties, unless you also consent to marketing (see below).

Marketing cookies

These let us measure which ads work, and let advertising platforms show you our ads. We ask for your consent for these.

  • _shopify_marketing (Shopify): marketing through Shopify. 1 year.
  • _fbp and _fbc (Meta): measure which ads on Facebook and Instagram lead to a visit or purchase, and show ads. 90 days.
  • The Meta pixel and the Meta Conversions API Gateway (Meta, via servers of Amazon Web Services and Google Cloud in the US): the same events, such as a page or product viewed, something added to your cart and a purchase.
  • _gcl_au and _gcl_aw (Google Ads): measure which Google ads lead to a purchase. 90 days.
  • _nano_fbc, _nano_gclid, _nano_gbraid, _nano_wbraid, _nano_ttclid and _nano_epik (JAP Christmas, own measurement): remember which ad you came from. 90 days.
  • Triple Whale (storage in your browser, such as TriplePixel, di_pmt_wt and TW_EXT_ keys): measure which ads lead to a purchase. Until you delete them.

With your marketing consent we also send events from our own server to Meta and TikTok, so that they can measure which ads work. When you order, we only send your email address and phone number in encrypted (hashed) form. Without marketing consent we do not do this.

5. With whom we share your data

We do not sell your data. We only share it when that is necessary for the purposes above.

Parties working on our behalf (processors)

  • Shopify International Ltd (Ireland): our online shop, the checkout, customer accounts and the emails about your order.
  • StockItUp: our order and stock system.
  • Our logistics partners: storage, packing and shipping.
  • Microsoft Ireland Operations Ltd: email (Microsoft 365).
  • A customer service software provider: helps us prepare replies to emails.
  • Triple Whale Inc. (US): analysis of our advertising results.
  • Klaviyo Inc. (US): software for sign-up forms and emails, connected to our shop.
  • Suppliers of apps that add features to our shop, such as the gift feature in the cart (EasyGift) and choosing sizes and colours (StarApps).

Our own customer and measurement database runs on our own server in the Netherlands.

Parties that are themselves responsible for what they do with your data

  • Carriers, such as DHL, PostNL, bpost and DPD: your name and address, and where needed your email address and phone number for delivery messages, to deliver your parcel.
  • Payment providers: Mollie B.V. (including iDEAL, Bancontact and credit card), PayPal (Europe) S.à r.l. et Cie, S.C.A. and Klarna Bank AB (pay later). Your payment details go directly to them; we do not see your full card or account details.
  • Advertising platforms: Meta Platforms Ireland Ltd, TikTok Technology Ltd and Google Ireland Ltd, based on your consent through the cookie banner. For collecting and passing on the data, we are jointly responsible with Meta and, where applicable, TikTok. What the platform then does with the data falls under its own responsibility and privacy policy. You can also come to us with questions about your rights; we will pass them on where needed.
  • Authorities, such as the tax authorities or the police, if the law requires us to.

6. Data outside Europe

Some parties process data outside the European Economic Area (EEA). This is only allowed with appropriate safeguards, such as a decision by the European Commission that a country offers adequate protection (for example the EU-US Data Privacy Framework for US companies certified under it), or standard contractual clauses approved by the European Commission.

  • Shopify: Canada and the US.
  • Meta, Google and Klaviyo: the US.
  • TikTok: including the US, Singapore and Malaysia; staff in China may also have access.
  • Microsoft: in principle within the EU; for support sometimes from the US.
  • Our customer service software provider: the US.
  • Triple Whale: the US, and other countries outside the EEA such as Israel and Ukraine.

Would you like to know which safeguard applies to a party, or receive a copy? Email us.

7. How we protect your data

  • Our site and our connections use an encrypted connection.
  • Only those who need it for their work can access your data.
  • We encrypt (hash) your email address and phone number before sending them to advertising platforms.
  • We make a backup every day.

If something does go wrong with your data, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) where the law requires it, and, if the risk to you is high, to you as well.

8. Automated decisions and profiles

We do not make decisions about you that are taken solely by a computer. If you choose to pay later with Klarna, Klarna itself assesses whether you can pay later; you can read more about this in Klarna's privacy policy. If you consent to marketing cookies, Meta, TikTok and Google build a profile to show you ads that suit you better.

9. Your rights

You have the right to:

  • access your data;
  • have incorrect data corrected;
  • have your data deleted, unless we are required to keep it, for example for tax purposes;
  • have the use of your data restricted;
  • receive your data in a common file format, or have it sent to someone else;
  • object to the use of your data based on our legitimate interest;
  • always object to the use of your data for direct marketing. We then stop immediately;
  • withdraw your consent. For emails, use the unsubscribe link at the bottom of every email; for cookies, see section 4. What we did up to that moment remains lawful.

Send your request to contact@japchristmas.eu. Include your order number if you have one, and email from the address we know. Then we know the request comes from you. We do not ask for a copy of your ID. We respond within one month. For a complex request this can take two months longer; if so, we will tell you within the first month.

Do you disagree with how we handle your data? Please tell us first, so that we can find a solution together. You may also always lodge a complaint with a data protection supervisory authority, in particular in the country where you live, or with the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). Customers in the United Kingdom can complain to the Information Commissioner's Office (ICO), customers in Switzerland to the Federal Data Protection and Information Commissioner (FDPIC).

10. Children

Our shop is intended for adults. If you are under 16, please ask your parent or guardian to place the order or to give consent for emails and cookies.

11. Changes

We update this policy when our way of working or the law changes. The date of the last update is at the top. For important changes we will let you know, for example by email or with a notice on the site.