DevtacEST. 2011
Make an Order
Privacy

Your data.

What we hold about you, why we hold it, who else sees it, and how to have it corrected or removed.

Last updated 28 August 2026

Who is responsible

This site is operated by DEVTAC Japan, business licence number 07236372, Hamamatsu Shi Minami ku Shimoecho 207, 430-0825, Japan. For anything in this notice, or to exercise any of the rights below, write to info@devtacdesigns.com.

What we hold, and why

We ask for as little as we can, and everything below is something this site actually stores. None of it is collected for advertising, and none of it is sold to anyone.

If you make an account

  • Your name and email address.
  • Your password, stored as a hash. We never hold the password itself and cannot tell you what it is.
  • A sign-in session. See Cookies below.

This is so you can sign in and see your own orders and invoices. An account is required to place an order, because the order, its status and its invoice live in it afterwards.

If you place an order

  • Your name, email address, telephone number, and organisation if you give one.
  • The delivery address and country.
  • The quantity, and anything you write in the notes: a head measurement, a deadline.
  • How you chose to pay, and for a bank transfer whether you are paying a deposit now and the balance on completion.
  • The helmet as you configured it, its price, and the five images the configurator rendered of your build.

We hold this to build and ship what you ordered, to invoice it, and to answer you about it afterwards. Under most data protection law the basis for it is the performance of a contract with you.

Export screening

Ballistic protective equipment is export-controlled in most jurisdictions. We use the destination country, and where necessary more, to confirm an order can lawfully be shipped. Where that is required of us the basis is a legal obligation rather than your consent, and we cannot ship without it.

If you ask to reset a password

We store a one-way hash of the reset link, valid for two hours and usable once. The link itself is never stored, so a copy of our database does not let anyone use a link that is still in flight.

If you use the contact form

Unless the page tells you otherwise, the contact form opens your own email program and sends nothing to this site. What you write reaches us as an ordinary email.

Cookies

This site sets one cookie, and only once you sign in. It is called devtac_session. It holds a random token that means nothing on its own, it is marked HttpOnly so scripts cannot read it, and it expires after thirty days. It exists so that you stay signed in from one page to the next.

There are no analytics, no advertising and no tracking cookies here, and no third-party scripts of any kind. Our fonts are served from our own server rather than a font network. The configurator may remember a build you are working on in your own browser's storage; that never reaches us unless you place the order.

Who else sees it

  • PayPal, if you choose to pay that way. You are handed to PayPal to pay, and what you give them is covered by their privacy policy rather than this one.
  • Our bank, if you pay by transfer. Your name and the order reference appear on it.
  • The carrier that delivers your order, which needs your name, address and telephone number.
  • Our email provider, which carries the order confirmation to you and to us.
  • The relevant authorities, where export control or the law requires it.

The gallery can embed videos from YouTube, but nothing is requested from YouTube until you press play. If you never press play, YouTube is never contacted.

Where it is kept

On our own server in Japan. We do not keep orders or accounts in a third-party cloud database. If you are in the European Economic Area or the United Kingdom, ordering therefore involves a transfer of your data to Japan, which the European Commission has recognised as providing an adequate level of protection.

How long we keep it

  • Your account — until you ask us to delete it.
  • Orders and invoices — for as long as we need them for warranty, which runs to five years on the ballistic frames, and for as long as accounting and tax law requires a record of a sale.
  • Reset links , two hours.
  • Sign-in sessions — thirty days, or until you sign out.

Your rights

You can ask us to show you what we hold about you, to correct it, to give you a copy, to delete it, or to stop using it. Write to info@devtacdesigns.com and we will answer within thirty days.

Deleting an account is not the same as deleting an order: where the law requires us to keep a record of a sale we keep the invoice and remove what we do not need. If you are in the EEA or the UK you also have the right to complain to your national data protection authority.

Security

Passwords are stored hashed, never in plain text. Sign-in sessions are random tokens that expire. Orders and invoices are readable only by the account that placed them, and by us.

While this site is served over plain HTTP, anything you type into it, your password included, crosses the network unencrypted. Until the address bar shows https://, please do not use a password here that you use anywhere else, and treat this site as unsuitable for confidential information.

Children

This site sells protective equipment to adults. It is not directed at children and we do not knowingly hold data about anyone under 18.

Changes

If we change how we handle your data we will change this page and the date at the top of it. Where the change is significant and we have your email address, we will tell you.