1. Introduction

2. What Personal Information We Collect

2.1 Information you actively submit

• Account info: Username, email address, login password, mobile phone number
• Order & delivery info: Full name, shipping address, billing address, postal code
• Payment data: Credit/debit card last 4 digits, payment amount, transaction records (we do NOT store full card numbers; payment is processed by third-party payment providers such as PayPal, Stripe)
• Customer service records: Chat history, emails, complaint content
• User-generated content: Product reviews, photos, comments you post on our site

2.2 Automatically collected technical data

• Device data: IP address, browser type, operating system, device model, screen resolution
• Usage data: Pages viewed, dwell time, cart records, click behavior, search keywords
• Location data: General regional location (based on IP, no precise GPS unless you authorize)
• Cookies & tracking pixels: Google Analytics, social media pixels (Facebook, TikTok) for website optimization and advertising

3. Legal Basis for Processing Data (GDPR Compliance)

1. Performance of contract: Process your name, address, payment info to fulfill orders, arrange delivery and after-sales service.
2. Your consent: Send marketing emails/SMS, use non-essential tracking cookies; you may withdraw consent anytime.
3. Legitimate interest: Prevent fraud, website security, optimize product recommendations, improve site functions.
4. Legal compliance: Respond to official law enforcement requests, tax and customs requirements.

4. How We Use Your Personal Data

• Complete order processing, payment verification, logistics tracking and delivery arrangement
• Create and manage your member account, save order history and shopping preferences
• Reply to customer inquiries, handle returns, refunds and complaints
• Send order updates, logistics notifications via email or SMS
• Provide personalized product recommendations based on browsing records
• Send promotional newsletters, discount information (only with your explicit opt-in)
• Detect fraud, unauthorized login, cyber risk to protect your account security
• Analyze website traffic to optimize page layout, product categories and user experience
• Comply with customs, tax and local regulatory requirements for cross-border shipments

5. Sharing & Disclosure of Your Information

1. Payment service providers (PayPal, Stripe, etc.): Process payment transactions under strict PCI DSS encryption standards.
2. Logistics & freight partners: Provide delivery address to arrange global shipping, customs clearance.
3. Technical service vendors: Website hosting, analytics tools, cloud storage, customer service systems (all signed data processing agreements).
4. Legal mandatory disclosure: When required by court order, government authority, tax or customs law.
5. Business transfer: If our company undergoes merger, acquisition or asset sale, user data will be transferred with binding privacy obligations.

6. Data Retention Period

• Order & delivery data: Retain for [5] years for tax, customs and after-sales dispute resolution.
• Member account data: Keep until you submit a deletion request to close your account.
• Marketing contact info: Keep until you unsubscribe or withdraw marketing consent.
• Cookie tracking data: Store for a maximum of 12 months.
  When data is no longer needed, we will permanently delete or anonymize all records.

7. Data Security Protection

• End-to-end SSL encryption for all website access and checkout pages
• Tokenization for payment data, full credit card details never stored on our server
• Password encrypted storage, regular system security updates and vulnerability scanning
• Staff confidentiality agreements, limited access permission to user data
  If a data leakage risk occurs, we will notify affected users and relevant regulatory authorities as required by law.

8. Your Privacy Rights

Users in EU/UK/EEA (GDPR Rights)

1. Right to access: Request a copy of all personal data we store about you
2. Right to rectification: Correct inaccurate name, address or contact information
3. Right to erasure (“Right to be Forgotten”): Request full deletion of your account and data
4. Right to restriction of processing: Pause marketing or tracking data collection
5. Right to data portability: Export your order and personal data in readable format
6. Right to object: Refuse personalized advertising and data analysis based on legitimate interest
7. Right to withdraw consent: Unsubscribe marketing emails, disable non-essential cookies at any time

Users in California, USA (CCPA Rights)

How to Exercise Rights

9. Cookie Policy Supplement

1. Necessary cookies: Required for login, cart storage, checkout functions, cannot be disabled.
2. Non-essential cookies: Analytics, advertising tracking. You can reject them via the cookie pop-up banner when entering the site. Disabling non-essential cookies will not affect normal shopping functions.

10. Cross-border Data Transfer

11. Policy Updates