GDPR Policy
Effective Date: September 11, 2026
1. Introduction
This GDPR Policy explains how Brynsayrleth (“Brynsayrleth,” “we,” “us,” or “our”) processes and protects personal data in connection with brynsayrleth.com (the “Website”) and the home and furniture products and services made available through the Website.
This Policy is intended to describe our approach to personal data protection and the rights that may be available to individuals under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and other applicable data protection laws.
The Website is operated using business information associated with an address in Japan and may offer products and services to customers in Poland and other markets. The GDPR may apply where its territorial requirements are satisfied.
Where the GDPR applies, we process personal data in accordance with the applicable requirements of the GDPR and other applicable data protection laws.
This Policy should be read together with other privacy notices, cookie information, terms, and policies that may apply to your use of the Website or purchase of products.
2. Who We Are
The Website and brand information covered by this Policy are:
Website / Brand: Brynsayrleth
Website: brynsayrleth.com
Email: hello@brynsayrleth.com
Telephone: +81-3-8938-3675
Address: 4-1-G-108 Sakurajosui, Setagaya-ku, Tokyo 156-0045, Japan
Business Hours: Monday to Friday, 9:00–18:00 Central European Time
The entity responsible for determining the purposes and means of processing personal data is the data controller where required under applicable data protection law.
Brynsayrleth is not represented by this Policy as a company incorporated in Poland. The business information provided for the Website identifies an address in Japan.
Where applicable law requires the appointment of an EU representative or Data Protection Officer, the relevant information will be provided in accordance with the applicable legal requirements.
3. GDPR Principles
Where the GDPR applies, we seek to process personal data in accordance with the principles established by the GDPR.
These principles include:
Lawfulness, fairness, and transparency. Personal data should be processed lawfully, fairly, and transparently.
Purpose limitation. Personal data should be collected for specified, explicit, and legitimate purposes and should not be processed in a manner incompatible with those purposes.
Data minimisation. Personal data should be adequate, relevant, and limited to what is necessary for the relevant purpose.
Accuracy. Personal data should be accurate and kept up to date where appropriate.
Storage limitation. Personal data should not be retained longer than necessary for the purposes for which it is processed, subject to applicable legal and other retention requirements.
Integrity and confidentiality. Appropriate technical and organisational measures should be used to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, or disclosure.
Accountability. Where required, appropriate procedures and records should be maintained to demonstrate compliance with applicable data protection obligations.
4. Legal Bases for Processing
Where the GDPR applies, personal data is processed only where an applicable legal basis exists.
Depending on the circumstances, processing may be based on one or more of the following legal bases under Article 6 of the GDPR.
Performance of a contract
We may process personal data where necessary to enter into or perform a contract with you.
This may include receiving and managing orders, confirming purchases, arranging payment and delivery, communicating with you about your order, processing returns and refunds, and providing customer support.
Compliance with a legal obligation
We may process personal data where necessary to comply with a legal obligation applicable to us.
This may include accounting, taxation, transaction records, consumer protection, regulatory requirements, legal claims, and responding to lawful requests from competent authorities.
Legitimate interests
We may process personal data where necessary for our legitimate interests, provided that those interests are not overridden by your interests or fundamental rights and freedoms.
Depending on the circumstances, legitimate interests may include maintaining and securing the Website, preventing fraud or misuse, protecting our systems and business, handling customer service matters, improving Website functionality, and establishing, exercising, or defending legal claims.
Where legitimate interests are relied upon, we consider the necessity of the processing and its potential impact on individuals.
Consent
Where consent is required by applicable law, personal data may be processed on the basis of your consent.
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. Personal Data We May Process
Depending on how you use the Website and our services, we may process the following categories of personal data.
Contact information
This may include your name, email address, telephone number, and other contact information that you provide to us.
Delivery information
When necessary to fulfil an order, we may process your name, delivery address, telephone number, and other information required by the relevant carrier to complete delivery.
Order and transaction information
This may include products ordered, order numbers, order dates, order status, delivery information, return information, refund information, and other transaction-related records.
Payment-related information
Payment processing may involve payment service providers, financial institutions, card networks, or other payment-related providers.
We may receive or process transaction-related information necessary to confirm and administer a payment or refund. Where payment processing is handled by an external provider, we do not intend to store complete payment-card information unless this is specifically required for the relevant payment process.
Customer service information
If you contact us, we may process information contained in your communications and information necessary to investigate and respond to your enquiry, complaint, order issue, return, refund, or other customer service matter.
Technical information
When you visit or use the Website, technical information may be processed where necessary for Website operation, security, troubleshooting, or other legitimate purposes.
Depending on the Website configuration and technologies used, this may include IP address, browser information, device information, log information, and information concerning interactions with the Website.
Cookie information
Cookies and similar technologies may process information relating to Website use, preferences, device information, and interactions. The applicable processing depends on the technologies actually used on the Website.
We do not represent that every category listed above is collected from every visitor or customer.
6. Purposes of Processing
Depending on the circumstances and applicable legal basis, personal data may be processed for purposes including:
-
operating and administering the Website;
-
processing and managing customer orders;
-
confirming purchases and transactions;
-
arranging payment processing;
-
arranging delivery of purchased products;
-
communicating with customers regarding orders;
-
providing customer service and after-sales support;
-
administering returns and refunds;
-
maintaining transaction and business records;
-
responding to enquiries and complaints;
-
preventing fraud, misuse, and unauthorised activity;
-
protecting Website and information-system security;
-
complying with legal and regulatory obligations;
-
establishing, exercising, or defending legal claims; and
-
maintaining and improving Website functionality and services.
Where marketing, analytics, personalisation, or similar optional processing is used, the relevant activity will be carried out only where an appropriate legal basis exists and, where required, consent has been obtained.
7. Sharing of Personal Data
We may disclose or make personal data available to third parties where necessary for the purposes described in this Policy and where permitted by applicable law.
Potential recipients may include the following categories.
Delivery and logistics providers
Relevant delivery information may be provided to shipping and logistics providers selected to fulfil your order, including DHL or UPS where applicable.
Payment-related providers
Payment and transaction information may be processed by payment service providers, financial institutions, card networks, or other providers involved in processing or verifying payments.
Technology and service providers
Personal data may be processed by service providers supporting Website
supporting Website operation, hosting, infrastructure, security, communications, customer service, order management, or other business functions. The categories of providers actually involved may depend on the Website configuration and services used by Brynsayrleth.
Professional advisers and authorities
Personal data may be disclosed to professional advisers, auditors, insurers, legal advisers, regulators, governmental authorities, courts, law-enforcement bodies, or other competent authorities where reasonably necessary or required by applicable law.
Business transactions
Where relevant, personal data may be disclosed in connection with a merger, acquisition, restructuring, sale of assets, financing, or other corporate transaction, subject to applicable legal requirements.
We seek to limit disclosures to information that is reasonably necessary for the relevant purpose.
Third parties receiving personal data may process that information in accordance with their own legal obligations and applicable contractual arrangements.
8. International Transfers of Personal Data
Because the Website and business information associated with Brynsayrleth are connected with Japan, personal data may in some circumstances be processed or transferred outside the European Economic Area (“EEA”), including to countries where our service providers or business partners operate.
Where the GDPR applies and a transfer of personal data outside the EEA requires specific safeguards, we seek to use an appropriate transfer mechanism recognised under applicable data protection law.
Depending on the circumstances, this may include an adequacy decision, appropriate contractual safeguards such as Standard Contractual Clauses, or another legally recognised transfer mechanism.
The safeguards applicable to a particular transfer may depend on the recipient, the destination country, the nature of the processing, and the requirements of applicable law.
9. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, taking into account applicable legal, accounting, tax, consumer-protection, dispute-resolution, and other retention requirements.
Different categories of personal data may therefore be retained for different periods.
For example, information relating to orders and transactions may need to be retained for longer than information used solely to respond to a general enquiry.
When personal data is no longer required, we seek to delete it, anonymise it, or otherwise dispose of it securely, subject to any legal obligation or legitimate need to retain the information.
10. Data Security
We take reasonable technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration, disclosure, destruction, or other unlawful or accidental processing.
The measures used may include access controls, appropriate security procedures, secure communications where applicable, system monitoring, data minimisation, and other measures appropriate to the nature and risks of the processing.
However, no method of transmission over the Internet or electronic storage system can be guaranteed to be completely secure.
Accordingly, while we take reasonable steps to protect personal data, we cannot guarantee absolute security of information transmitted to or through the Website.
11. Your Data Protection Rights
Where the GDPR applies, you may have certain rights in relation to your personal data, subject to applicable legal conditions and limitations.
These rights may include:
-
the right to obtain confirmation as to whether we process your personal data;
-
the right to request access to personal data concerning you;
-
the right to request correction of inaccurate or incomplete personal data;
-
the right to request deletion of personal data in circumstances provided by law;
-
the right to request restriction of processing in circumstances provided by law;
-
the right to receive certain personal data in a structured, commonly used, and machine-readable format where the right to data portability applies;
-
the right to object to certain processing, including processing based on legitimate interests;
-
the right to withdraw consent where processing is based on consent; and
-
the right to lodge a complaint with a competent data protection supervisory authority.
These rights are not absolute and may be subject to conditions, exceptions, or limitations under the GDPR or other applicable law.
To exercise a right, you may contact us using the contact details provided in this Policy.
We may take reasonable steps to verify the identity of the person making a request where this is necessary to protect personal data against unauthorised disclosure.
12. Right to Object
Where personal data is processed on the basis of legitimate interests, you may have the right to object to such processing on grounds relating to your particular situation, subject to the conditions established by applicable law.
Where personal data is processed for direct marketing purposes, you may have a right to object to such processing in accordance with the GDPR and other applicable law.
Where an objection is made, we will consider the request and determine whether the processing may lawfully continue or should be discontinued, taking into account the applicable legal requirements.
13. Automated Decision-Making and Profiling
We do not intend for this Policy to represent that automated decision-making or profiling is carried out in every interaction with the Website.
Where applicable, if we carry out processing involving automated decision-making that produces legal effects or similarly significant effects concerning an individual, we will do so only where permitted by applicable law and subject to any safeguards and rights required by that law.
14. Children and Minors
The Website is intended for general consumers and is not specifically directed at children.
Where applicable law requires parental or guardian involvement for the processing of a child's personal data, we will apply the requirements established by that law.
If you believe that personal data relating to a child has been provided to us in circumstances where it should not have been collected, you may contact us using the details provided below.
15. Cookies and Similar Technologies
The Website may use cookies and similar technologies for purposes such as enabling Website functionality, remembering preferences, maintaining security, analysing Website use, or supporting other functions.
The specific cookies and technologies used may depend on the current configuration of the Website.
Where applicable law requires consent for certain cookies or similar technologies, the relevant technologies will be used subject to the applicable consent requirements.
For further information, please refer to the applicable Cookie Policy.
16. Links to Third-Party Websites
The Website may contain links to external websites, services, or platforms operated by third parties.
Those third parties may have their own privacy policies and data-processing practices.
We are not responsible for the privacy practices, content, security, or processing activities of external websites that are not operated by Brynsayrleth.
We recommend reviewing the applicable privacy information before providing personal data to a third-party website.
17. Data Breach and Security Incidents
If we become aware of a personal data breach affecting personal data processed by us, we will assess the incident and take appropriate measures in accordance with applicable law.
Where the GDPR requires notification to a supervisory authority or communication to affected individuals, we will take such action within the applicable legal requirements.
18. Complaints and Supervisory Authorities
If you have concerns about how your personal data is processed, we encourage you to contact us first so that we can review and address the matter where possible.
Where the GDPR applies, you may also have the right to lodge a complaint with a data protection supervisory authority in accordance with applicable law.
The competent supervisory authority may depend on factors including your habitual residence, place of work, the location of an alleged infringement, and the circumstances of the relevant processing.
19. Changes to This GDPR Policy
We may update this Policy from time to time to reflect changes in our Website, business activities, data-processing practices, legal requirements, or other relevant circumstances.
The updated version will be published on the Website with an updated effective date where appropriate.
We recommend reviewing this Policy periodically to remain informed about how personal data may be processed.
Changes to this Policy do not affect rights or obligations that arose before the applicable update, except where otherwise required or permitted by applicable law.
20. Contact Information
For questions, requests concerning personal data, or other privacy-related matters, you may contact Brynsayrleth using the following details:
Website / Brand: Brynsayrleth
Website: brynsayrleth.com
Email: hello@brynsayrleth.com
Telephone: +81-3-8938-3675
Address: 4-1-G-108 Sakurajosui, Setagaya-ku, Tokyo 156-0045, Japan
Business Hours: Monday to Friday, 9:00–18:00 Central European Time
When submitting a data protection request, please provide sufficient information to allow us to understand and process your request. Please do not send unnecessary sensitive information or complete payment-card details by email.
21. Relationship with Other Policies
This GDPR Policy should be read together with the Privacy Policy, Cookie Policy, Terms & Conditions, Payment Information, Order Cancellation Policy, and other notices or policies applicable to the Website.
Where a more specific notice applies to a particular processing activity, that notice may provide additional information about the relevant processing.
Nothing in this Policy is intended to exclude, restrict, or reduce any mandatory rights or protections available to individuals under applicable data protection or consumer-protection law.
22. Final Provisions
This Policy describes the general approach to personal data protection applicable to the Website and should not be interpreted as a representation that every processing activity described above occurs in every case.
The actual categories of data processed, purposes, recipients, retention periods, cookies, and other processing details may depend on the Website's configuration, the services used, the nature of the customer's interaction with the Website, and applicable legal requirements.
Where there is a conflict between this Policy and a mandatory provision of applicable law, the mandatory legal provision will prevail.
Effective Date: September 11, 2026