Buy 3 Decks & Get 1 Free Worldwide Shipping ★ 4.8/5.0 from Waifu Lovers

Privacy Policy

Last updated: October 12, 2026

1. Controller and contact

PokeCustoms GmbH, Forststraße 18, 73730 Esslingen am Neckar, Germany, is responsible for the processing described in this notice in its operation of Ecchii. Managing director: Emre Yildirim. For privacy questions or requests, contact info@ecchii.com or +49 156 79812087.

This notice explains our current processing. Updating the operator information does not retrospectively change a notice, consent or contract recorded for an earlier transaction, or itself authorize a new marketing use of existing information.

2. Website, hosting, email and security

Website requests involve connection information such as an IP address, the requested address, time, response and browser information. Hosting, infrastructure and email services supplied under the Hostinger brand support the website and its messages. Store messages are sent through Hostinger’s authenticated email service. Information about Hostinger’s processing is available in its Privacy Policy.

We process technical information to deliver requested pages and functions, diagnose faults and prevent misuse. Our legal basis is our legitimate interest in a reliable, secure service under Article 6(1)(f) GDPR, or Article 6(1)(b) where processing is necessary for a contractual service you request. Access and security records are retained as needed for these purposes; records relevant to an incident or dispute may need to be kept until it is resolved. This is separate from browser-cookie expiry.

3. Orders, accounts and enquiries

For an order we process your name, contact information, billing and delivery addresses, items and variations, quantities, prices, payment status, transaction references and related correspondence. We use these to accept, fulfil and administer the order under Article 6(1)(b) GDPR. Accounting, tax and other legally required processing relies on Article 6(1)(c).

The store uses WordPress and WooCommerce. Account functions involve login and profile information, addresses, order history and saved product choices when you use those features. Product requests can include the requested item, your message and contact information, and can be associated with your account. We use those details to handle the request and provide an update you requested. Support messages are used to respond and resolve the matter. The basis is Article 6(1)(b) for contractual enquiries and requested services, or our legitimate interest in answering other enquiries and preventing misuse under Article 6(1)(f).

Account information is retained while the account is maintained. Enquiries and requests are retained as needed to handle them and document a resulting transaction or claim. Deleting an account does not delete order records that must be retained separately. Information marked as required at checkout is necessary to process the purchase; without it we may be unable to accept or deliver an order. Do not send passwords, complete payment-card details or unnecessary sensitive information in messages.

Optional Google and Discord sign-in

You can choose to create or access your Ecchii customer account with Google or Discord instead of entering your store password. When you choose this option, the selected provider receives the sign-in request for Ecchii and sends us its stable account identifier, verified email address and optional profile name. We use these details for the account service and its security described above. We do not receive your provider password or request access to Gmail, messages or Discord servers. This sign-in does not subscribe you to a newsletter or grant advertising or analytics permission.

We store a hashed relationship between the provider identifier and your store account so you can use the same sign-in method again while your account is maintained. Connection records also contain a site-keyed security digest to reject stale links after password or email changes, not a copy of your password. An existing account with the same email is not linked automatically: sign in with its existing credentials and explicitly connect the provider in Account details. Google accounts using an external email address that is not managed by Google must also register or sign in locally first, then connect Google. You can still use or reset your store password. A completed password reset or change of the store account email disconnects social sign-in methods; you can reconnect them after signing in locally. Deleting the store account removes its provider connection records; separately retained orders are unaffected.

A necessary first-party security cookie, __Host-ecchii_customer_login, and temporary server state protect the requested sign-in and expire after ten minutes. Short-lived hashed network identifiers help limit abusive attempts; this feature does not store raw IP addresses in those counters. Expired server security records are removed by scheduled cleanup. Provider access tokens are used only for the current sign-in and are not stored or refreshed. Ordinary hosting and security logs described in section 2 remain separate.

During account creation we also keep a hashed email reservation to prevent duplicate accounts. It is normally removed when the attempt ends; if processing is interrupted, it remains until we have checked the outcome and safely cleared it.

The selected provider also processes the sign-in under its own privacy policy, including its information about international processing: Google Privacy Policy and Discord Privacy Policy. Email and password registration remains available without choosing either provider.

4. Payments and fulfilment

Stripe and PayPal are integrated into the store. Available methods are shown at checkout and can differ between orders. Embedded payment features can send connection and device information to their provider when those features load, not only after a payment succeeds. Providers process the payment, billing, order and technical information needed for payment, authentication and fraud prevention. We receive payment status and transaction references. Providers also process information for their own legal and security purposes and may act as independent controllers.

See the Stripe Privacy Policy and PayPal Privacy Statement for the relevant entities, processing and rights. Providers can use automated fraud and risk checks which affect whether a payment is accepted. Contact the provider for its decision-review options, and contact us if a payment problem affects your order. Our contractual payment processing relies on Article 6(1)(b); required records rely on Article 6(1)(c); proportionate fraud prevention relies on Article 6(1)(f).

We use Billbee GmbH, Arolser Str. 10, 34477 Twistetal, Germany, for order handling. Its information is available in the Billbee privacy notice. Order information is shared with production and fulfilment partners as necessary to prepare the item, and with shipping providers as necessary to deliver it. This can include order-data exports for fulfilment. International shipments may require information to reach a carrier or customs authority in the destination country. The basis is Article 6(1)(b), or Article 6(1)(c) for legally required disclosures.

Hosting, email and IT service providers support these activities. Relevant information may also be handled by authorized staff, professional advisers and authorities for administration, compliance or legal claims. The information disclosed depends on the recipient’s function.

5. Cookies, browser storage and external resources

Cookies and similar storage support functions you request, including login, cart sessions and security. Storage or access that is strictly necessary for an explicitly requested service relies on Section 25(2) TDDDG. This does not make every external script or analytics function necessary. Personal-data processing has the contractual, consent or legitimate-interest basis applicable to the particular function.

Optional Google Ads shopping measurement

With your separate consent to marketing measurement, we use Google Ads conversion tracking through Google Tag Manager to understand whether our advertising leads to eligible visits, successful additions to a cart, checkout starts and paid purchases, and to assess campaign performance. Participation is optional. You can shop and pay without agreeing, and accepting store terms or joining a newsletter does not provide this consent.

Our basic consent implementation blocks the Google Ads measurement tags until you allow marketing measurement. If you decline the Google Ads purpose entirely, these tags do not send measurement requests to Google, including cookieless measurement requests. Other services described in this notice, such as payment providers and Google Fonts, are separate.

For eligible visits, successful additions to a cart and checkout starts, we send the event type, a clean page address and, where relevant, the combined goods value and currency. These Google Ads event fields do not include product names, product identifiers, categories, images or item-by-item cart details. Eligible products can have any content rating, including NSFW, Secret Collection and no saved rating. Verified member-product visits and private shopping steps use a separate minimal measurement document without the original private query address or customer forms. A failed add-to-cart attempt is not a successful cart event.

After a paid purchase with a positive goods value, this measurement can include orders from every product range, including orders combining different ranges. Orders in which only shipping is charged are not counted as purchases by this feature. We send a purchase event containing a pseudonymous order reference, the combined goods value after discounts and excluding tax and shipping, and the order currency. The reference helps avoid counting the same order more than once. We do not include product names, product identifiers, categories, images or an item-by-item order breakdown in this purchase event. We also do not send your name, email address, telephone number, postal address, payment details or store login ID as conversion fields.

Local order-source attribution requires the updated Analytics choice described below, independently of Google Ads permission. Google Ads measurement cookies are separate from that shop feature. Valid Google advertising click parameters remain on eligible landing-page addresses for the permitted Google tag to read and store using its first-party measurement cookies. The store does not create a separate copy of those Google click identifiers for this handoff.

Google can also receive technical information when the permitted tag contacts its servers, including your IP address, browser or device information, page or referrer information, request time, consent signals, cookie identifiers and advertising click identifiers. These identifiers can allow Google to associate a purchase event with an earlier advertisement interaction. Individual measurement requests are not anonymous merely because we use a pseudonymous order reference; the campaign reports we use combine results from multiple events. See how Google uses information from partner sites.

We do not use Enhanced Conversions, customer-list uploads, remarketing or personalized advertising with this shopping-measurement feature. We do not send hashed customer contact details for matching. This feature does not activate Google Analytics or optional local visitor analytics.

The legal basis for our optional measurement processing is your consent under Article 6(1)(a) GDPR. Consent for optional storage or access on your device is obtained under Section 25(1) TDDDG. You can withdraw consent at any time through the site’s cookie settings by disabling marketing measurement. This stops subsequent measurement through this feature on that browser and does not affect the lawfulness of earlier consent-based processing. You can also remove existing cookies through your browser; withdrawing consent does not automatically delete information already received by Google. Contact info@ecchii.com to exercise the rights explained in section 9.

We remember your marketing-measurement choice, this notice’s consent version, and the time of the choice in the first-party ecchii_consent_v1 cookie for 180 days. It is signed to protect the integrity of the choice and does not introduce an additional visitor identifier. A temporary browser-session flag helps enforce an immediate withdrawal even while the saved choice is being updated; it is not a visitor ID. We do not keep a separate per-visitor consent log on our server through this feature. You can change or withdraw the choice before the cookie expires. Google’s cookie information describes _gcl_ advertising-measurement cookies with a 90-day lifetime. Cookie expiry is separate from retention of information already sent to Google, which depends on the data, purpose and applicable service settings, including security or legal requirements. See Google’s cookie information and Google’s Privacy Policy.

Optional local order-source attribution

With the updated Analytics choice, our shop can link a new order to the visit source that led to it. We use validated campaign source, medium and campaign-name labels from tagged links, or the referring website domain where available. A direct visit does not replace a source already recognized in the current 30-minute window. Email and app links do not always supply a referrer, so an untagged link can appear as Direct or remain unknown.

After permission, the signed first-party ecchii_order_source_v1 cookie holds these limited fields for up to 30 minutes from capture. It is Secure and HttpOnly, is bound to the current Analytics permission, and ordinary browsing does not extend its expiry. This local source record does not contain a full page or referrer address, advertising click identifier, contact identifier, IP address, user agent or device fingerprint. Private account, receipt and personal claim pages are not used to create a new source. The native Sourcebuster tracker stays disabled.

When a new checkout order is created with the current permission, the source fields are saved with that order for our marketing analysis. This local feature does not send them to an external analytics service; the independently described Google and Omnisend features have their own data flows. Source fields already attached to an order remain in the order record unless removed; clearing the cookie does not delete them. The general retention and rights information in sections 7 and 9 applies. Existing orders without a known source are not retrospectively attributed.

This is optional consent-based processing under Article 6(1)(a) GDPR and optional device storage under Section 25(1) TDDDG. It requires a renewed Analytics choice: an older permission, a purchase or newsletter subscription does not authorize it. You can shop without allowing it. Deselect Analytics in Cookie settings and save to stop new source attribution and clear this source cookie. A first-party deny-only preference marker, ecchii_order_source_denied_v1, can remain for up to 180 days to enforce withdrawal even if saving fails; it contains only a denial flag, not a visitor ID. Only a fresh explicit Analytics grant clears that marker. This does not automatically erase source fields already saved with an order; contact info@ecchii.com for an access or erasure request.

Optional Google Analytics with Google Tag Manager

With your separate Analytics consent, we use Google Analytics 4 through Google Tag Manager to understand how selected public pages and shopping steps are used and improve our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the Ecchii Analytics stream G-V7TYRNVQ9R. This choice is independent of Google Ads purchase measurement and Meta measurement. An existing advertising choice, an account, a purchase, acceptance of store terms or a newsletter subscription does not give Analytics permission. You can shop without allowing Analytics.

Analytics tags are blocked until you allow Analytics under the updated notice. The same Tag Manager container can separately deliver Google Ads tags when you allow the independent Ads purpose. Public visit measurement is limited to eligible visits to our published Home, Shipping, Returns, Privacy, Terms and Imprint pages and eligible public products. Products are eligible regardless of their content rating, including NSFW, Secret Collection and no saved rating. Verified member-product visits can be measured through the separate minimal measurement document with the additional shopping permission. Analytics does not run in the original member-product, category, account, cart or checkout document. Unverified addresses, parameters and referrers remain excluded. Shopping events are separately checked against actual store actions and the current permission for the relevant purpose.

With the updated Analytics shopping permission, we send product views, successful additions to a cart, checkout starts and eligible paid purchases. Product events contain the product or variation identifier, quantity and price. Cart and purchase events can include those fields for each eligible item, combined goods value and currency; purchase events also use a pseudonymous order reference to help avoid duplicates. We omit product names, categories and images from these item fields. Eligible products can have any content rating, including NSFW, Secret Collection and no saved rating. Campaign gifts, unpublished and hidden products remain excluded; cart and purchase events require every item to be eligible. Paid purchase values exclude tax, shipping and fees. Zero-goods-value test orders and shipping-only orders are not purchase events.

For verified member-product visits and shopping events on private steps, the Google tags run in a separate, minimal measurement document rather than in the member-product page, checkout form or original order-access page. The store supplies checked event fields to that document. It contains no customer form, address or order-access key, uses a generic title and does not supply a previous-page address or private query URL. A verified member-product visit can produce a page-view event; opening the measurement document for cart, checkout or receipt events does not itself create an additional Analytics page view. We do not intentionally send customer names, email addresses, phone numbers, postal addresses, payment details, store login IDs or order-access keys as Google event fields.

After the current Analytics permission, we can use bounded UTM campaign labels from an eligible landing page in the existing WooCommerce session for up to 30 minutes from capture. The underlying session record can remain until normal WooCommerce cleanup. These labels describe campaign source, medium, name, term, content or ID and can be supplied to our own Analytics stream before its event handoff, including during checkout and payment return. Ordinary navigation does not extend that expiry. The record is bound to the current permission and session, adds no cookie and does not contain the original page address. Google click identifiers are not included in this UTM record.

The initial page measurement uses a clean page address, the generic title “Ecchii” and no previous-page address. A product-page address can identify the public product being viewed. Google can also receive technical information when its permitted tags contact its servers, including your IP address, browser and device information, request time, consent signals, cookie identifiers and session information. This processing is not anonymous merely because reports combine visits.

Google Analytics Enhanced Measurement remains enabled. On eligible pages, it can automatically measure further page views and interactions such as scrolling, outbound-link clicks, searches, supported video engagement, downloads and form starts or submissions, where the corresponding content and settings are present. Depending on the event, Google may receive interaction metadata such as link addresses or text, download names, video information and technical form identifiers or destinations. These automatic events are not limited to the three fields in the initial page measurement. See Google’s Enhanced Measurement information.

This Analytics feature does not enable Google Signals, Enhanced Conversions, remarketing or advertising personalization. Our separately described Google Ads shopping measurement remains independent. Allowing one purpose does not allow the other.

The legal basis for optional Analytics processing is your consent under Article 6(1)(a) GDPR. Optional storage or access on your device requires your consent under Section 25(1) TDDDG. You can withdraw the Analytics choice at any time through Cookie settings. This stops future Analytics measurement through this feature on that browser and does not affect the lawfulness of earlier consent-based processing. Withdrawal does not delete information already received by Google. You can also clear existing cookies through your browser and contact info@ecchii.com to exercise the rights explained in section 9.

We remember your separate Analytics choice, its notice version and time in the signed first-party ecchii_analytics_v1 cookie for 180 days. It is not an additional visitor identifier. A temporary browser-session flag helps enforce a pending withdrawal. After consent, Google Analytics may set _ga and _ga_* first-party cookies to distinguish visitors and remember sessions. Google lists two years as their default expiry; service settings, later visits and browser limits can affect the actual lifetime. This cookie expiry is separate from retention of information already received by Google. See Google’s Analytics cookie information.

The expanded Analytics and shopping measurement described here requires a renewed choice under the updated notice. Earlier Analytics permissions and earlier shopping permissions do not authorize the expanded scope. An earlier Google Ads permission continues to allow the previously described aggregate paid-purchase measurement. To stop the relevant Google purpose entirely, open Cookie settings, deselect its Google Ads or Analytics checkbox and save your preferences. Saving a checked purpose under the updated settings notice also allows its shopping scope. We remember the independent shopping scope in signed first-party ecchii_google_ads_shop_v1 and ecchii_google_analytics_shop_v1 cookies for 180 days. They record a choice, notice version and time, not an additional visitor ID. They operate alongside the purpose cookies described above. Temporary browser-session denial markers help apply withdrawal immediately. After consent, verified member-page source and duplicate-prevention records are valid for up to 24 hours in the existing shop and login session, create no additional cookie and are not sent to Google; the underlying records can remain until normal WooCommerce session cleanup. The shop uses its existing WooCommerce session for a signed handoff of confirmed shopping actions, valid for up to two minutes; the underlying session record can remain until normal session cleanup. This handoff does not replace the separately retained cart or order. Events captured without the relevant shopping permission are not later released merely because permission is granted. A short-lived server marker prevents concurrent tabs from claiming the same event twice. Loading failures can be retried within the original two-minute handoff window; an ambiguous local dispatch is not automatically replayed. These local handoff records are not confirmations that Google received an event.

Google may process information in the United States and other countries. Its Privacy Policy describes its processing and international transfers. Further information is available in how Google uses information from sites or apps that use its services.

Optional Microsoft Clarity website analytics

With your renewed Analytics consent, we use Microsoft Clarity to understand how visitors navigate and interact with Ecchii, identify usability problems and improve the shopping experience. Clarity provides behavioural metrics, click and scroll heatmaps, and session replays that reconstruct interactions with our pages. This covers our own storefront pages, including product pages, the cart, checkout, customer-account pages and Secret/18+ areas. Participation is optional and you can use the store without allowing it.

After permission, your browser sends website-usage and technical information to Microsoft. This can include page and referring addresses, page content, clicks, scrolling, changes to the page, timing, browser and device information, IP address and cookie or session identifiers. We use Clarity’s standard masking settings for sensitive content and input fields. Masking does not make the remaining usage data anonymous. Our integration does not add a store-account identifier or customer contact details through Clarity’s identification API.

Microsoft processes Clarity information as a controller under its Microsoft Privacy Statement, including the purposes and rights explained there. Microsoft states that Clarity data is stored in US data centres. Its terms describe Microsoft Ireland Operations Limited’s arrangements with Microsoft Corporation for international transfers, including standard contractual clauses. See Clarity’s terms and data privacy information. Our implementation sends permission for analytics storage after your Analytics choice and keeps Microsoft advertising-storage permission denied.

The basis for our optional processing is consent under Article 6(1)(a) GDPR and, for optional device storage or access, Section 25(1) TDDDG. Clarity is loaded only after the current Analytics permission. Earlier Google-only Analytics permission does not authorize this addition. The existing signed Analytics choice cookie described above remembers your selection for 180 days. Clarity can use its own cookies to connect permitted visits and interactions; details are in Microsoft’s cookie documentation. Microsoft currently states that ordinary replay data is available for 30 days, while labelled or favourited sessions and heatmap data are retained for nine months; see its retention information.

You can withdraw this permission at any time by disabling Analytics in Cookie settings in the footer and saving. This stops subsequent Clarity collection through this integration on that browser and does not affect the lawfulness of earlier consent-based processing. Withdrawal does not automatically delete information already received by Microsoft. Contact info@ecchii.com for requests about our processing, and use the rights channels in Microsoft’s Privacy Statement for information held by Microsoft.

Optional Meta advertising measurement

With your separate consent to Meta advertising measurement, we use the Meta Pixel and server-side Conversions API to assess how our Facebook and Instagram advertising contributes to visits, product views, successful cart additions, checkout starts and paid purchases. This choice is independent of Google Ads and Analytics measurement. An account, purchase, acceptance of store terms or newsletter subscription does not give permission for Meta measurement. You can use the shop without allowing it. This expanded scope requires a renewed choice; earlier Meta permission does not authorize it.

The recipient is Meta Platforms Ireland Limited, Dublin 4, Ireland. Permitted requests also involve Meta’s infrastructure and group companies. Selected Home and information-page visits can produce PageView events. Actual product visits, confirmed cart additions and eligible checkout starts can produce ViewContent, AddToCart and InitiateCheckout events. These events cover eligible products across all content ratings, including NSFW, Secret Collection and products without a saved rating. Publication, access, visibility and campaign-gift checks remain. A failed add-to-cart attempt is not a successful cart event, and entering checkout is not a purchase.

Browser events are delivered through a minimal measurement document with a generic title and page address. We do not supply the original product, member, account, cart or checkout URL or its forms as Meta event fields. Shop events can include product or variation identifiers, quantities, prices, combined goods value and currency. We omit product names, categories and images. We do not send your name, email address, telephone number, postal address, payment reference, store account ID or an order-access key as event fields. Automatic advanced matching, automatic event enrichment and customer-list uploads are not enabled by this feature. We do not create remarketing audiences through this implementation.

Purchase measurement covers eligible paid orders across all product ratings. Orders containing campaign gifts, unpublished or hidden products remain excluded, as do refunded orders, zero-goods-value test orders and shipping-only orders. A purchase event contains the combined goods total recorded by the shop after discounts, without shipping, fees or separately recorded order taxes, the currency and an opaque, pseudonymous event reference. Purchase events contain no product identifiers or item-by-item breakdown. The browser purchase follows WooCommerce’s verification of the order and the current browser’s access to its separate confirmation page.

When server-side purchase measurement is enabled and configured, our server can send the eligible paid purchase after WooCommerce confirms payment, even if the buyer does not return to the confirmation page. This requires Meta permission under this notice recorded during the actual checkout and an existing valid Meta browser or advertising-click identifier. The server sends that identifier (fbp or fbc), the browser’s user-agent information, purchase time, value, currency, a generic confirmation-page address and the same event reference used by the browser. It does not add customer contact details or a customer IP-address field. Meta can use the common event name and reference to recognize the browser and server copies as the same purchase. Failed temporary transmissions may be retried with that same reference; our local attempt status is not itself proof of Meta receipt. Historical orders are not backfilled.

When the permitted Pixel contacts Meta, Meta can also receive your IP address, browser and device information, the generic measurement-page address, request time, cookie identifiers and an advertising click identifier. These requests are not anonymous. A valid fbclid on an advertising landing page may be remembered for attribution after Meta permission. Other bounded campaign parameters can remain in the shop address without blocking Meta measurement. Meta can combine received information with activity on its services, associate it with a Meta account and use it for advertising measurement, delivery, personalization and other purposes described in its Privacy Policy.

Our legal basis for this optional processing is your consent under Article 6(1)(a) GDPR. Optional storage or access on your device requires consent under Section 25(1) TDDDG. Before permission, this feature does not load the Meta Pixel or send its measurement events. You can withdraw consent through Cookie settings in the footer by switching off Meta advertising measurement. Withdrawal stops subsequent measurement from that browser and revokes linked pending server purchases; a signed-in withdrawal also invalidates pending purchases linked to that store account. It does not affect the lawfulness of earlier processing or automatically delete information already received by Meta.

We remember the independent Meta choice, its notice version and time in the signed first-party ecchii_meta_consent_v2 cookie for 180 days. This choice cookie is not an additional visitor ID. A temporary browser-session flag enforces pending withdrawal. After permission, a valid Meta advertising click can be remembered in _fbc for up to 90 days; Meta’s Pixel can set _fbp, which Meta describes with a 90-day lifetime. The existing WooCommerce session holds checked browser-event handoffs valid for up to two minutes and bounded duplicate/source markers valid for up to 24 hours; underlying session records can remain until normal session cleanup. The verified purchase handoff remains valid for up to 30 minutes. Temporary server purchase matching data and its checkout permission proof are valid for no more than seven days and scheduled for cleanup after expiry. They are removed earlier after confirmed receipt or a terminal rejection; physical cleanup after expiry depends on the background queue running. A minimal server consent/withdrawal record can remain until the signed choice expires; it contains a proof hash and status, without contact details. Limited operational purchase status remains with the separately retained order. Clearing browser storage does not delete separately held order records or data already received by Meta. Meta’s Business Tools terms describe retention of event data for up to two years, with separate rules for information processed for other purposes. See Meta’s Cookie Policy and Business Tools Terms.

For collection and transmission of Meta measurement event information, PokeCustoms GmbH and Meta Platforms Ireland Limited act as joint controllers under the Controller Addendum. We provide the information and obtain the consent for our implementation; Meta provides information about its further processing, security and rights procedures. Meta processes received information for its own purposes as a separate controller and handles rights requests relating to that further processing. Meta also provides certain matching and measurement functions on our behalf under its Business Tools terms. You can exercise applicable rights against either joint controller. Contact info@ecchii.com for requests concerning our processing, or use the rights channels in Meta’s Privacy Policy. We forward a request relating to information held by Meta when appropriate.

The theme still requests font resources from Google Fonts. Your browser sends connection information, including its IP address and request information, to Google to obtain those resources. This is separate from Google Analytics. See the Google Privacy Policy.

You can remove cookies and site storage through your browser. Blocking necessary storage can prevent a requested feature from working. Removing browser storage does not delete server-side orders, messages or records already held by providers.

Optional Omnisend personalization

With your separate Omnisend permission, we use visits, viewed products, cart activity and checkout starts to personalize our email follow-up and help you return to an unfinished cart. This choice is independent of Google Ads, Analytics and Meta. An earlier cookie choice, newsletter subscription, account or purchase does not grant this permission. You can shop without allowing it. Allowing this tracking does not subscribe you to newsletters or change your existing email subscription status.

On eligible public pages, Omnisend’s script can receive page and product information, browser and device information, IP address, timestamps, referrer information and cookie or contact identifiers. Products are eligible regardless of their content rating. The script is not loaded inside account pages, checkout forms, order-access pages or personal campaign-claim pages. On cart and checkout steps, our shop checks the separate permission before sending the relevant shopping event from its server. When you enter your checkout email, that address can be used to associate the event with you. Events can include product and variation identifiers, names, links, attributes, quantities, prices, coupons, totals, currency, a cart reference and a link that restores the cart. We do not send passwords or payment-card details through this feature.

We use Omnisend as a service provider acting on our behalf under its Data Processing Agreement. The Omnisend group includes UAB Omnisend in Lithuania, Omnisend Limited in the United Kingdom and Omnisend, Inc. in the United States. Processing may involve other countries and subprocessors; the agreement describes the applicable transfer safeguards, including standard contractual clauses where required. Further information is available in Omnisend’s Privacy Policy.

The legal basis for this optional processing is your consent under Article 6(1)(a) GDPR. Optional storage or access on your device requires consent under Section 25(1) TDDDG. You can withdraw the Omnisend choice at any time through Cookie settings. This stops subsequent tracking through this feature on that browser and removes its browser tracking cookies; it does not delete information already received by Omnisend or affect the lawfulness of earlier processing. Newsletter unsubscription is a separate choice, available through the email’s unsubscribe link. Contact info@ecchii.com for access or deletion requests.

The signed first-party ecchii_omnisend_v1 cookie remembers your choice, notice version, time and a random permission reference for 180 days. A temporary browser-session denial marker helps apply withdrawal immediately. Our server keeps a session-bound preference revision for up to two days and a limited fingerprint of a withdrawn permission until its original expiry, to prevent an older browser tab from restoring it. The existing WooCommerce session also holds permission and session-binding fingerprints until that shop session expires. A separate checkout fingerprint, attempt time and delivery status help prevent duplicate events and normally expire after two days; these records contain no raw email address or cart contents. Expired server records are removed by periodic background cleanup. Separately, Omnisend describes its omnisendSessionID cookie as lasting 30 minutes of inactivity and its omnisendContactID cookie as lasting up to 365 days. Browser restrictions can shorten these periods. Cookie expiry is separate from retention of information already received by Omnisend, which depends on the service purpose, account settings and applicable contractual or legal requirements. See Omnisend’s tracking-cookie information.

6. Newsletters and requested campaign messages

Free Cards newsletter gift: On our Free Cards page, submitting the form with the newsletter checkbox selected subscribes the entered email address directly through Omnisend, without a separate email-confirmation step. We record the signup time and consent wording version, and email a personal link to the 15-card Black Core gift through our authenticated store email service. The link is valid for 14 days. The store keeps the email address and gift-claim status, and links a resulting order or customer account as needed to administer the one-set-per-customer limit. Failed signup attempts without completed consent are scheduled for cleanup after 30 days. Newsletter unsubscription remains available through newsletter links or info@ecchii.com. This signup does not grant optional browser tracking permission.

Optional newsletters require separate consent under Article 6(1)(a) GDPR. A purchase or campaign registration does not automatically subscribe you. Newsletter information includes your email address, preferences and evidence of consent or withdrawal. Withdraw consent at any time using the message’s preference link or by contacting info@ecchii.com. Earlier lawful processing is not affected.

Requested registration confirmations and personal claim-link messages are separate from optional marketing. Campaign administration relies on providing the requested participation service under Article 6(1)(b), with proportionate duplicate-claim and misuse prevention under Article 6(1)(f). The Free Product Drop privacy addendum explains its information and retention rules.

Unconfirmed campaign registrations are scheduled for cleanup after 14 days. After campaign handling ends, records without active newsletter consent are scheduled for cleanup after 30 days, subject to the timing and unresolved-order or email exceptions described in the addendum. This is not a promise that every order record is deleted after 30 days. While newsletter consent remains active, the linked campaign record, including the chosen product and consent information, remains stored. Necessary consent evidence and limited suppression information may be kept to document consent, handle claims and respect an opt-out.

7. Returns, retention and legal claims

To handle a cancellation, withdrawal or return we process your declaration, identifying order information, contact details, receipt time and handling records. The bases are Articles 6(1)(b) and 6(1)(c) GDPR. Necessary information for a legal claim can also be processed under Article 6(1)(f).

Order, invoice and related business records are retained for the period required by the commercial or tax rule applicable to that record. An ongoing dispute, official proceeding or applicable limitation period can require longer retention of relevant information. Information no longer needed for its purpose, a legal duty or a legitimate claim is deleted or anonymized. There is no single deletion deadline for all store information.

8. International processing

International technology and payment services can involve processing outside the European Economic Area. A shipment to a destination outside the EEA can also require delivery information to reach the providers handling that shipment. These are separate purposes; visiting this site is not consent to every international transfer.

Stripe describes international processing and its use of measures including adequacy decisions and contractual safeguards in its privacy notice. PayPal describes international processing and group safeguards in its privacy statement and Binding Corporate Rules information. These descriptions concern those providers and do not mean that every recipient or transfer uses the same mechanism.

For European personal data processed through Google Ads, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as Google’s responsible controller, as described in the Google Controller-Controller Data Protection Terms. Google also processes information for its own purposes under its Privacy Policy. Processing can involve Google LLC and other Google group entities or service providers outside the EEA, including the United States. Google states that Google LLC is certified under the EU–US Data Privacy Framework and that it uses Standard Contractual Clauses where required for transfers not covered by an adequacy decision. Google’s transfer-framework information describes these safeguards and how to request a copy of the clauses. You can also contact info@ecchii.com for information about the safeguards relevant to our use of the service. This does not mean that your information remains exclusively in Europe.

Meta advertising measurement can involve transfers to Meta Platforms, Inc. and other recipients outside the EEA, including in the United States. Meta describes its international-transfer safeguards and rights channels in its Privacy Policy. A recipient outside the EEA can be subject to different legal protections and access by public authorities. Consent to this optional feature does not mean that information remains exclusively in Europe. Contact info@ecchii.com for information about the safeguards relevant to our use of Meta and how to obtain a copy where applicable.

Contact info@ecchii.com for information about the recipients and countries involved in your transaction and any applicable transfer safeguards. Where safeguards apply, you can request information about them and a copy, subject to protection of other information.

9. Your rights

Under the applicable GDPR conditions you can request access, correction, erasure, restriction of processing and data portability. You can withdraw consent at any time without affecting earlier lawful consent-based processing.

Right to object: you can object on grounds relating to your particular situation to processing based on Article 6(1)(e) or 6(1)(f) GDPR. You can object to direct marketing, including related profiling, at any time without giving a reason.

Contact info@ecchii.com to exercise a right. We may need proportionate information to verify your identity. You can complain to a supervisory authority, particularly where you live, work or consider that a breach occurred. The local authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg. Other rights under laws applicable to your circumstances are not excluded.

10. Adult-only features and updates

The store includes adult-only sections. If you believe that a child has provided information that should not have been collected, contact us so we can address it. A remembered adult-content confirmation is not an identity document or verification of a birth date.

We update this notice when relevant processing changes. An updated notice does not replace consent or any other legal requirement, and does not rewrite earlier consent records.