Privacy policy

Last updated: 3 October 2026

This Privacy Policy explains which personal data K-pop Escape collects, why, for how long, and which rights you have. It applies to kpopescape.com and to your contact with us.

Who is responsible for your data

The data controller is Stay Escape, a Dutch sole proprietorship trading online as K-pop Escape.

Genderdreef 12, 5524 AD Steensel, Netherlands
KVK: 42031519
Email: stayescape99@gmail.com
Telephone: +31 6 51360546

Stay Escape is a one-person business. It is not part of a corporate group and does not share your data with affiliated companies.

What we collect, why, and on which legal basis

• Orders and delivery. Name, delivery and billing address, email address, telephone number if you provide it, the items ordered, and payment status. We use this to process, pack, ship and invoice your order and to handle returns and refunds. Legal basis: performance of the contract with you.
• Payments. Payments are handled by the payment provider you choose at checkout. We receive confirmation of payment and limited transaction details, never your full card or bank credentials. Legal basis: performance of the contract.
• Tax and accounting records. Order and invoice data. Legal basis: legal obligation under Dutch tax law.
• Customer service. Your name, email address, order number and the content of your message, including photographs you send us about a problem. Legal basis: performance of the contract, or our legitimate interest in answering enquiries.
• Legal claims and consumer-law duties. Order data and correspondence, where needed to handle withdrawals, warranty claims, chargebacks or disputes. Legal basis: legal obligation, or our legitimate interest in establishing and defending legal claims.
• Newsletter. Your email address, your subscription status and whether you open or click our newsletters, only if you sign up. Legal basis: your consent, which you can withdraw at any time through the unsubscribe link in every newsletter. We do not send marketing by text message or by post, and we do not send marketing email to people who did not subscribe.
• Security and fraud prevention. IP address, device and browser information and order risk indicators. Legal basis: our legitimate interest in keeping the store and payments secure.
• Cookies and usage data. See “Cookies” below. Legal basis: our legitimate interest in a working and secure store for essential cookies, which the law allows without consent; your consent for all other cookies.

You need to give us your name, address, email address and payment details to place an order; without them we cannot conclude or perform the contract. All other data, such as a telephone number or a newsletter subscription, is optional.

We receive this data directly from you, automatically from your device when you use the store, and from the service providers named below, for example a payment confirmation. We do not buy personal data.

Automated decisions

Shopify gives us an automated fraud-risk indication for each order. We use it only as advice: a person always decides whether an order is cancelled, and you can ask us to reconsider. Payment providers may refuse a payment automatically under their own rules; their privacy notices apply to that. We do not take any other decisions about you by solely automated means.

Cookies

Essential cookies are needed for the store to work, for example to remember your cart, keep checkout secure and store your cookie choice. They are placed without consent.

If you visit us from the European Economic Area, the United Kingdom or Switzerland, analytics and marketing cookies are placed only after you have accepted them in the cookie banner. Refusing is as easy as accepting and does not affect your ability to shop. You can change or withdraw your choice at any time through the “Cookie preferences” link in the footer of the store. In other countries these cookies may be placed unless you object, where local law allows that.

No custom or app advertising pixels are currently connected in our Shopify Customer events settings. Shopify analytics and the Enhanced Services described below can still use usage data and cookies, subject to your privacy choices.

Shopify Network Intelligence and Enhanced Services

Shopify Network Intelligence is enabled for this store. We use Shopify Enhanced Services to improve the store and your shopping experience, including personalisation and advertising-related features. Shopify may combine personal data collected through our store with data from your interactions with other merchants and Shopify services to provide these services. For this processing, Shopify is responsible for handling your personal data as described in the Shopify Consumer Privacy Policy.

In regions where consent is required, non-essential collection and use is subject to your cookie choices. You can refuse or withdraw consent through Cookie preferences. Depending on where you live, you can also exercise your rights through the Shopify Privacy Portal and use Your Privacy Choices to opt out of sharing for targeted advertising. Some US privacy laws classify this processing as sharing or sale, even where no money is exchanged for your data.

Who receives your data

We share personal data only with parties that need it for the purposes above:

• Shopify (Shopify International Ltd., Ireland), which hosts the store and checkout and sends the store's emails, as our processor. If you use a Shopify consumer service yourself, such as Shop Pay or the Shop app, Shopify is separately responsible for that data; see the Shopify Consumer Privacy Policy.
• Payment providers you select at checkout, to process your payment. They are responsible for their own processing.
• Carriers and shipping services, such as PostNL and the service we use to create shipping labels, to deliver your order: name, address and, where needed for delivery notifications, email address or telephone number.
• Our email provider (Google), for customer service correspondence.
• Providers of apps we use inside Shopify, only as far as the app needs the data for its function.
• Accountant and tax authorities, where required for our administration and legal obligations.
• Authorities, only where the law obliges us to.

We do not exchange personal data for money. The Shopify processing described above may qualify as sharing or sale under some US privacy laws.

Transfers outside the European Economic Area

Shopify provides its services to us through Shopify International Ltd. in Ireland, but it and its sub-processors also process data outside the EEA, in particular in Canada and the United States. Transfers to Canada are covered by the European Commission's adequacy decision for Canada; transfers within the Shopify group are covered by Shopify's Binding Corporate Rules, which were approved by European data protection authorities; other transfers are covered by the Commission's Standard Contractual Clauses. Google processes email data in the United States and other countries on the basis of the EU–US Data Privacy Framework and, where that does not apply, Standard Contractual Clauses. You can ask us for more information about these safeguards or for a copy of them at the email address above.

How long we keep your data

• Orders and invoices: 7 years after the end of the financial year, as required by Dutch tax law. Records of sales to consumers in other EU countries that we report through the EU One Stop Shop VAT scheme must be kept for 10 years.
• Customer service messages: as long as needed to handle your question and for up to 2 years afterwards, unless the message belongs to an order record.
• Newsletter subscription: until you unsubscribe. After that we keep only a record that you unsubscribed, so that we do not email you again.
• Security and fraud data: kept by Shopify with the order for as long as the order record exists; we do not keep separate copies.
• Cookie choices: up to 12 months, after which we ask again.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict processing, to receive your data in a portable format, and to withdraw consent at any time without affecting earlier processing. To use these rights, email stayescape99@gmail.com. We may ask you to confirm your identity, and we respond within one month. Exercising your rights is free and never affects the service you receive.

Right to object. Where we process your data on the basis of our legitimate interest (customer enquiries, legal claims, security and fraud prevention), you may object at any time on grounds relating to your situation; we then stop unless we have compelling grounds that outweigh your interests. You may always object to the use of your data for direct marketing, and we will then stop without exception; the unsubscribe link in every newsletter does this immediately.

You can also lodge a complaint with a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl. Supervisory authorities of other EEA countries are listed here.

Visitors from the United States

We do not exchange personal data for money. If you want to make sure that no data about you is shared for targeted advertising, you can record this on our Your Privacy Choices page; we also treat a Global Privacy Control signal from your browser as such a request. This page is separate from the cookie preferences described above.

Children

The store is not directed at children. If you are under 16, please ask a parent or guardian to place the order and to give any consent on your behalf. If you believe a child has given us personal data without that permission, contact us and we will delete it.

Security

The store and checkout run on Shopify's secured infrastructure and connections to the store are encrypted. Within our business only the owner has access to customer data; the service providers listed above have access only as far as they need it for their task. No system is completely secure; if a data breach is likely to put you at risk, we inform you and the supervisory authority as the law requires.

Links to other websites

The store may link to websites and social media platforms we do not control. Their own privacy policies apply to what they do with your data.

Changes to this policy

We update this policy when our practices or the law change. The date at the top shows the latest version, and we announce important changes in the store or by email.