Shogun.shop is responsible for the processing of personal data as described in this privacy policy.

Contact details:

Shogun.shop
[insert legal entity / company name]
[insert address]
[insert privacy / customer service email address]
[insert telephone number]
Chamber of Commerce number: [insert]
VAT number: [insert]

For questions about privacy or to exercise your GDPR rights, you can contact us using the contact details above.

Depending on how you use our website and services, we may process the following personal data:

• name;
• email address;
• telephone number;
• billing address;
• delivery address;
• order details;
• payment status, payment method and payment references;
• shipping details and track & trace information;
• customer communication via email, telephone, chat, WhatsApp or other contact channels;
• account details, if you create an account;
• data required for age checks, purchase checks, licence checks or membership checks;
• technical data, such as IP address, browser data, device data, cookie data and website usage;
• data required for administration, invoicing, customer service, returns, warranty, complaints handling and fraud prevention.

We do not always process all of these data. Which data we process depends on the product you buy, the legal requirements that apply to that product and the way in which you contact us.

We process personal data for the following purposes:

• processing, confirming and delivering orders;
• processing payments;
• shipping orders;
• creating and managing customer accounts;
• providing customer service;
• handling returns, warranty requests, complaints and repairs;
• complying with tax and administrative obligations;
• performing age checks for products that require a minimum age;
• performing purchase checks, licence checks or membership checks for regulated products;
• preventing fraud, misuse and unlawful sales;
• securing and improving our website and systems;
• analysing website usage and improving our services;
• sending service messages and, where permitted, marketing communications.

We only process personal data when there is a legal basis under the General Data Protection Regulation.

We use, among others, the following legal bases:

• Performance of a contract: for processing, delivering and handling your order.
• Legal obligation: for tax administration, invoices and obligations related to the sale, reservation, transfer or delivery of regulated products.
• Legitimate interest: for customer service, security, fraud prevention, internal control, protecting Shogun.shop and preventing unlawful sales.
• Consent: for processing activities that require consent, such as certain cookies or marketing communications.

For products that require age checks, membership checks or licence checks, we only process data that is necessary to verify whether we may lawfully sell, reserve, transfer or deliver the product to you.

For certain products, we must verify whether the buyer meets legal or safety requirements. This may include age verification, airsoft membership verification, licence verification or other purchase checks.

For these checks, we may use our LegalCat system. This system is designed for the secure upload and processing of documents required for purchase verification.

Examples of documents or data that may be requested include:

• an identity document or data from that document for age verification;
• an airsoft membership card, such as NABV, ACA or another relevant membership document where required;
• a licence, permit, authorisation, hunting licence or other proof required for regulated products;
• other data that is necessary to verify whether a purchase, reservation, transfer or delivery is legally permitted.

Uploaded identity, membership and licence files are stored temporarily and automatically deleted after 30 days through a lifecycle setting in AWS S3 EU-West. The uploaded document itself is therefore not kept for a long period.

A limited verification history may be retained, for example that a check was performed and approved, including the date, time, customer or order reference and type of check. We retain this verification history only insofar as necessary to demonstrate that we carefully checked whether the purchase, reservation, transfer or delivery was allowed.

We do not store a Dutch citizen service number (BSN) as a separate data field. The purpose of identity verification is not to process the BSN. If a BSN is visible on an uploaded document, we do not process it as a separate verification detail and the uploaded file is automatically deleted after 30 days. Where possible, we advise customers to cover non-necessary data, such as the BSN, when this is legally allowed.

Access to verification files and verification data is limited to employees who need these data for the verification process. Not all employees can access these data.

For airguns and similar products, minimum age requirements and other legal rules may apply. These rules can differ per country. We may therefore verify whether the buyer meets the applicable legal requirements before we process, reserve, transfer or deliver an order.

For this verification, we may process personal data such as name, date of birth, order details and, where necessary, data from an identity document. The purpose is solely to verify whether we may lawfully sell, reserve, transfer or deliver the product.

If an identity document is uploaded via LegalCat, the uploaded file is automatically deleted after 30 days. We may retain only a limited verification history to demonstrate that the check took place.

Specific legal and safety requirements may apply to certain airsoft products. In some countries, an airsoft device may only be purchased, possessed or used if certain conditions are met. This may include membership of a recognised airsoft association, such as NABV, ACA or another relevant organisation.

When ordering airsoft products, we may therefore verify whether you meet the requirements for purchase, reservation, transfer or delivery. For this purpose, we may process your name, contact details, order details, date of birth and data from an airsoft membership card or comparable proof.

The purpose of this processing is to prevent airsoft products from being sold, transferred or delivered to persons who do not meet the applicable requirements.

Uploaded airsoft membership or other verification files are temporarily stored via LegalCat and automatically deleted after 30 days. We may retain only a limited verification history, for example that the check was approved.

Strict legal rules apply to firearms, ammunition and other licence-required products. These products cannot be fully ordered online and delivered to your home through Shogun.shop. Where such products are available, they can only be reserved or requested. The actual verification, transfer and handover will take place in accordance with applicable law and, where required, in-store.

Such products may only be sold, transferred or delivered when legally permitted and when the buyer has the correct licence, permit, authorisation, hunting licence, consent or other required proof.

When you reserve or request a licence-required product, we may process additional personal data and documents to verify whether the reservation, purchase, transfer or delivery is lawful. This may include:

• name and contact details;
• address details;
• order, request or reservation details;
• product details;
• data from a licence, permit, authorisation, hunting licence or other proof;
• any data required for registration, transfer, administration or legal verification.

We process these data only for purchase verification, legal compliance, administration, safety and the prevention of unlawful sales.

Uploaded licence files are temporarily stored via LegalCat and automatically deleted after 30 days, unless a specific legal obligation requires us to retain certain data for longer. Administrative data, invoices and necessary transaction documentation may be retained for longer where this is legally required or necessary.

Our standard procedure is that identity, membership and licence documents are submitted through LegalCat. This is the channel designed for this purpose.

If uploading via LegalCat does not work due to a technical issue, please contact our customer service. We will first try to resolve the upload problem or offer a secure alternative route.

Submitting identity, membership or licence documents via regular email or WhatsApp is not our preference, because these channels are less suitable for processing sensitive documents.

If, in exceptional cases, we receive such documents via email or WhatsApp, we limit access to the data, use them only for the necessary verification and delete the received file as soon as possible after processing from the relevant communication channel, insofar as this is technically possible.

To process payments, we use payment service providers such as Pay. and other payment partners that are available in the checkout. Depending on the payment method selected, payment data are processed that are necessary to execute, confirm, check and administratively process the payment.

We do not receive all full payment details, such as full bank or card details. We may process data such as payment status, payment reference, order number, amount and selected payment method.

To deliver orders, we share necessary data with shipping partners, including PostNL and other carriers where applicable. This may include your name, delivery address, email address, telephone number where needed, order details and shipping information.

These data are used to deliver your order, provide track & trace information and resolve any delivery issues.

For our financial administration, we may use systems such as AFAS. In our administration, we process invoice data, order data, payment data, customer data and data required for tax obligations.

Invoices and basic administration are generally retained for 7 years because we are legally required to do so.

Our website, systems and technical environment are managed with support from technical partners, including Vendic. In the context of hosting, maintenance, development, security and support, Vendic may have access to personal data insofar as necessary.

For temporary storage of uploaded identity, membership and licence files, we use AWS S3. These files are automatically deleted after 30 days through a lifecycle setting.

We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, misuse and unauthorised alteration.

When you contact us by email, telephone, chat, WhatsApp or another channel, we process the data required to answer your question or handle your request.

We may retain customer communication for customer service, evidence, quality control, training, dispute handling and improvement of our services.

If you send us sensitive documents through a communication channel, such as an identity document, airsoft membership card or licence, we use these only for the purpose for which you sent them. We delete such documents as soon as possible after processing from the relevant channel, insofar as technically possible.

We ask you to submit sensitive documents preferably only through the LegalCat system designed for this purpose.

We use cookies and similar technologies to make our website work properly, improve your user experience, analyse website usage and, where permitted, better tailor marketing.

We may use tools such as Google Analytics 4 to understand how visitors use our website and to improve our services.

For cookies that require consent, we ask for consent through our cookie banner. You can change or withdraw your cookie preferences through the settings on our website or through your browser.

When you subscribe to our newsletter or give consent for marketing communications, we may use your email address and preferences to send you offers, updates and information.

You can unsubscribe at any time via the unsubscribe link at the bottom of our emails or by contacting us.

We may inform existing customers by email about similar products or services, insofar as this is legally permitted. We always offer an opt-out option.

We share personal data only when this is necessary for our services, legal obligations, security or business operations.

We may share data with, among others:

• Vendic, for hosting, technical management, development and support;
• Pay. and other payment service providers, for payment processing;
• PayPal and other payment partners, where selected by the customer;
• PostNL and other shipping partners, for shipping and delivery;
• AFAS, for accounting and financial administration;
• AWS S3, for temporary storage of verification files;
• Google Analytics 4, for website analytics;
• IT, security and support providers;
• government authorities, regulators or law enforcement authorities when we are legally required to do so.

Where required, we enter into data processing agreements or appropriate contractual arrangements with processors and service providers.

We aim to process personal data as much as possible within the European Economic Area.

Some service providers, such as international cloud, analytics or IT service providers, may process personal data outside the European Economic Area. If this happens, we ensure that appropriate safeguards are used, such as contractual arrangements, standard contractual clauses or other available data protection mechanisms.

For our core processes around orders, payments, shipping, accounting and verification, we aim for processing within the European Economic Area where possible.

We do not keep personal data longer than necessary for the purpose for which the data were collected, unless we are legally required to keep data for longer.

We generally apply the following retention periods:

• Invoices and basic administration: 7 years due to tax obligations.
• Order and customer data: as long as necessary for orders, service, warranty, administration, dispute handling and legal obligations.
• Uploaded identity, membership and licence files: automatic deletion after 30 days through AWS S3 lifecycle.
• Verification history: as long as necessary to demonstrate that an age, membership or licence check was carried out carefully.
• Customer service communication: as long as necessary for answering questions, service, evidence, dispute handling and quality control.
• Cookie and analytics data: according to the settings of the relevant cookies and analytics tools.
• Newsletter data: until you unsubscribe or until we no longer need the data.

We take appropriate technical and organisational measures to protect personal data. These include:

• limited access to personal data based on role and necessity;
• secure systems and connections;
• access management for employees;
• use of specialised systems such as LegalCat for sensitive verification files;
• automatic deletion of uploaded identity, membership and licence files after 30 days;
• agreements with processors and technical partners;
• internal work instructions for handling sensitive documents;
• periodic review of processes and security measures.

Despite our measures, no system can guarantee complete security. If we discover a data breach that creates risks for individuals, we will act in accordance with the applicable legal notification obligations.

We do not make fully automated decisions within the meaning of Article 22 GDPR that have legal effects for you or similarly significantly affect you.

We do not use data from identity, membership or licence checks for profiling. These data are used only to verify whether a purchase, reservation, transfer or delivery can lawfully take place.

Website analytics may be used to improve our website and services, but are not used to make automated legal or similarly significant decisions about you.

Under the GDPR, you have several rights. You can ask us to:

• give you access to the personal data we process about you;
• correct inaccurate data;
• delete data;
• restrict processing;
• object to certain processing activities;
• transfer data to you or another party;
• withdraw consent, when processing is based on consent.

You can submit your request using our contact details. We may ask you to confirm your identity, so that we can be sure that we provide data to the right person. We will not ask for more data than necessary.

We generally respond to your request within one month. If a request is complex or if we receive many requests, we may extend this period as allowed under the GDPR. In that case, we will inform you in time.

In some cases, we may not be able to fully comply with a request, for example when we are legally required to retain certain data or when data are necessary for administration, verification, security, dispute handling or legal obligations.

If you believe that we do not handle your personal data properly, we ask you to contact us first. We will try to find a solution together.

You also have the right to file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with another competent data protection authority in your country.

We may update this privacy policy when our services, systems, legislation or processes change. The most recent version is always available on our website.

Last updated: 15 June 2026

Do you have questions about this privacy policy or about how we handle personal data? Please contact us via:

Shogun.shop
[insert privacy / customer service email address]
[insert telephone number]
[insert address]