Privacy Policy

1. Who is responsible

The data controller for this website is Hengyangshi Cuihuan Maoyi Youxian Gongsi, Room 1004, No. 176 Huangcha Road, Huangchaling Street, Yanfeng District, Hengyang, Hunan 421200, China. You can reach us at HXYcuihuan@163.com. We have not appointed a Data Protection Officer; privacy questions go to the same address.

2. What we collect and why

Enquiries (contact form and email)

When you write to us we collect your name, email address, subject, message and any product reference you include. We use this only to answer you and to keep a record of the correspondence. Legal basis: our legitimate interest in responding, and where the enquiry concerns a purchase, the performance of a contract.

Orders and payments

When you buy from us we collect your name, email address, delivery address and the items you order, so we can process, ship and support the order and issue records. Card payments are handled entirely by Stripe on their own pages: your card number, expiry and CVC are given to Stripe, not to us. We receive an order reference and the payment status, and we never store card details on our systems. Legal basis: performance of a contract, and our legal obligation to keep accounting records.

Newsletter

If you sign up, we store your email address and the date of consent to send you product news and offers, on the basis of your consent. You can withdraw it at any time through an unsubscribe link or by emailing us.

Your cart on this device

Your cart is stored in your own browser's local storage so it survives a page refresh. It contains only product codes and quantities. Nothing is transmitted to us until you check out, and clearing your browser data removes it.

Analytics

We use privacy-friendly, cookie-free analytics to count page views and see which products are viewed. It records aggregate information such as the page URL, referrer, country and device type. It does not build a profile of you across other websites and we do not sell data.

Server logs

Our hosting provider processes standard technical request data (IP address, timestamp, user agent) to deliver the site and defend it against abuse. These logs are kept briefly.

3. Cookies

This site sets no advertising or tracking cookies, and no cookie is required for the cart or checkout. The only thing saved in your browser is a small flag that remembers you dismissed the notice at the bottom of the page, plus your cart. If we later add a tool that requires cookies, we will ask for your consent first through a consent banner.

4. Who else processes your data

We keep the number of processors to a minimum. Each is bound by a written agreement covering security, permitted purposes and deletion:

• Cloudflare — hosting, content delivery and network security for this website.
• Stripe — payment processing. Stripe is an independent controller for the payment data it collects on its own pages and publishes its own privacy terms.
• Our fulfilment and carrier partners — to pick, pack and deliver your order. They receive your name, delivery address, phone number for delivery contact and the parcel contents.
• Our email provider — to send and receive enquiry, order and newsletter messages.

5. Disclosure to authorities

We may disclose personal data where we are legally required or permitted to, for example to respond to a valid request from a public authority or to prevent fraud.

6. International transfers

We are based in China, and our hosting, payment and email providers may process data in countries outside your own, including China, the United States and the European Union. Where personal data of EU or UK residents is transferred, we rely on the providers' standard contractual clauses and equivalent safeguards. For Australian customers, we handle personal information consistently with the Australian Privacy Principles.

7. How long we keep it

Enquiry correspondence is kept for up to 24 months. Order and payment records are kept for as long as tax and commercial law requires (typically five to seven years from the end of the financial year). Newsletter consent records are kept until you unsubscribe. You may ask us to delete any of it sooner.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent. California residents have equivalent rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them. We do not sell or share personal data for advertising.

To exercise any of these rights, email HXYcuihuan@163.com. We respond within 30 days. If you are in the EU or UK and are not satisfied with our response, you may complain to your local supervisory authority.

9. Security

The site is served over HTTPS with HSTS enabled, and all interfaces that touch personal data run over encrypted connections. Accounts that can reach your data are protected with two-factor authentication. No method of transmission or storage is perfectly secure, and we do not hold card data or government identifiers at all.

10. Children

This site is aimed at adults. We do not knowingly collect personal data from children.

11. Changes to this policy

If we change how we handle personal data, we will update this page and change the date at the top. Material changes will be highlighted on the site.