This notice explains, in general terms, what personal data we handle when you visit this site or place an order, the legal bases on which we do so, and the rights you have over your data. It does not create any contractual obligation beyond what is required by applicable data-protection law.
The data controller is SUMI / 墨 (“SUMI”, “we”). For questions about this notice or to exercise your rights, see the Contact section below. If you have an active order, the most reliable channel is to reply directly to your order confirmation email — that thread already carries the order context.
You are responsible for ensuring that the data you provide is accurate and up to date. We are not responsible for the consequences of inaccurate or out-of-date information you submit.
We share personal data only with categories of recipients needed to operate the store. The list of specific providers may change from time to time without notice; the categories below remain stable.
We do not sell personal data for monetary consideration. A current list of named processors can be requested via the Contact section.
Some of our processors are based outside the EEA / UK (notably the United States, Canada and other jurisdictions where our partners operate). Where this is the case, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or Addendum, a valid adequacy decision (e.g. the EU–US Data Privacy Framework where the recipient is self-certified), or another lawful transfer mechanism. Copies of the safeguards are available on request.
We keep personal data only for as long as is necessary for the purposes set out in this notice and to comply with our legal, accounting and reporting obligations. The criteria we use are:
We use technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse and alteration, including transport encryption (TLS) and access controls. However, no system is perfectly secure. You acknowledge that you transmit data to us at your own risk and you are responsible for keeping any password or access credentials confidential.
We use the following categories of cookie. Analytics and marketing cookies are blocked by default and only loaded after you accept via the cookie banner. You can change your choice anytime via “Cookie preferences” in the footer.
Where supported, we honour the Google Consent Mode v2 signal. Until you accept analytics cookies, we do not load any analytics or advertising tag — no measurement requests are sent. When you accept, the same consent signal is forwarded so that downstream tags treat your data accordingly.
To exercise any right, see the Contact section. We respond within the period required by applicable law (one month under GDPR, extendable by two further months where requests are complex or numerous). We may need to verify your identity before acting on a request, and we may decline manifestly unfounded or excessive requests as permitted by law.
If you are a California resident, you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the “sale” or “sharing” of personal information for cross-context behavioural advertising. We do not sell personal information for money. To opt out of any sharing for advertising purposes, set your cookie banner to “Necessary only” or send a Global Privacy Control signal — we honour it where supported. We do not discriminate against you for exercising any CCPA right.
The site is not directed at children under the age of majority in their country of residence and we do not knowingly collect personal data from them. If you believe a minor has provided us with personal data without parental consent, please contact us and we will delete it.
The site may link to or embed content from third-party sites or services. Their data practices are governed by their own privacy notices. We are not responsible for, and make no representations about, the content, privacy practices or security of any third-party site or service.
We may update this notice from time to time to reflect changes in our processing, our service providers, or applicable law. The version in force is the one published on this page. Where a change is material, we will use reasonable efforts to highlight it at the top of the page or notify you by other appropriate means.
For privacy-related requests, the most reliable channel is the contact form, which routes to the studio inbox. If you have an active order, replying to your order confirmation email is faster as it already carries the order context. A postal address for formal data-protection correspondence will be published here as the studio scales.
Last updated: 2026.