Privacy Policy

This store and website, including all associated information, content, features, tools, products and services, are operated to deliver a curated shopping experience for you (the Customer) (“the Service”). This store is powered by Shopify, which enables us to provide the Service to you. This Privacy Policy describes how we collect, use and disclose your personal information when you visit or use our Service, make purchases or other transactions through our Service, or otherwise communicate with us. In the event of any conflict between our Terms of Service and this Privacy Policy, this Privacy Policy shall govern the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By accessing and using any part of the Service, you acknowledge that you have read and understand the collection, use and disclosure practices for your information described herein.

Personal Information We Collect or Process

When we refer to “personal information”, we mean information that identifies you or another individual, or that can reasonably be linked to you or another individual. Personal information does not include anonymously collected or de-identified data which cannot identify or reasonably be associated with you. Depending on how you interact with the Service, your place of residence, and what is permitted or required by applicable law, we may collect or process the following categories of personal information, including inferences derived from such information:

• Contact information: your name, billing address, shipping address, phone number and email address.
• Financial information: credit card, debit card and financial account numbers, payment card details, account information, transaction records, payment methods, payment confirmations and other payment-related details.
• Account information: your username, password, security questions, preferences and settings.
• Transaction information: items you view, add to cart, save to wishlist, purchase, return, exchange or cancel, together with your historical transaction records.
• Communications with us: information included in messages you send us, such as support inquiries.
• Device information: details about your device, browser, network connection, IP address and other unique identifiers.
• Usage information: data about your interactions with the Service, including how and when you browse or engage with our store.

Sources of Personal Information

We may obtain personal information from the following sources:

• Directly from you: when you create an account, access or use the Service, contact us or otherwise provide your personal details.
• Automatically through the Service: collected from your device when you use our products or visit our website, including via cookies and similar tracking technologies.
• From our service providers: when we engage third-party providers to run technical functions, and where they collect or process your personal information on our behalf.
• From our partners and other third parties.

How We Use Your Personal Information

We may use your personal information for the purposes below, based on your interactions and the services you use:

• To provide, customise and improve the Service. We use your personal information to fulfil our contract with you, process payments, arrange delivery, remember your preferences and saved items, send account notifications, complete purchases, returns, exchanges and other transactions, create and maintain your account, organise shipping, support return and exchange requests, enable product reviews, and build a personalised shopping experience such as product recommendations relevant to your purchases. This may involve using your information to refine and enhance our Service.
• Marketing and advertising. We use your personal information for promotional purposes, including sending marketing communications by email, SMS or postal mail, and serving online advertisements on our Service or third-party websites. Ads may be tailored based on your past purchases, cart activity and other browsing behaviour on our store.
• Security and fraud prevention. We use your personal information to verify your account, deliver secure checkout and shopping experiences, detect, investigate and respond to suspected fraudulent, unlawful, unsafe or malicious activity, safeguard public safety and protect the integrity of our Service. If you register an account, you are responsible for safeguarding your login credentials. We strongly advise you not to share your username, password or other access details with any third party.
• Communications with you. We use your personal information to deliver customer support, respond to your requests, deliver the Service effectively and maintain our business relationship.
• Legal compliance. We process personal information to comply with applicable laws, respond to valid legal requests from law enforcement or government authorities, investigate or participate in civil discovery, pending or active litigation or other adversarial proceedings, and investigate or enforce potential breaches of our terms or policies.

How We Disclose Personal Information

We may disclose your personal information to third parties for legitimate purposes consistent with this Privacy Policy, including the scenarios below:

• Disclosure to Shopify, vendors and other service providers acting on our behalf, for services such as IT administration, payment processing, data analytics, customer support, cloud storage, fulfilment and shipping.
• Disclosure to business and marketing partners for marketing and advertising services. For example, we use Shopify to support personalised advertising from third-party providers based on your activity across merchants and websites. Our marketing partners will use your information subject to their own privacy notices. Depending on your location, you may have the right to opt out of such sharing for targeted advertising. You may exercise this opt-out right at: https://xinyuestore.com/pages/data-sharing-opt-out
• Disclosure where you instruct, request or consent to the transfer of information to a third party, for example to arrange shipment, or when you use social media widgets or sign-in integrations.
• Disclosure to our affiliates, or otherwise within our corporate group.
• Disclosure in connection with corporate transactions such as a merger or insolvency; to satisfy legal obligations including subpoenas and warrants; to enforce our Terms of Service or policies; and to protect the Service, our rights, and the rights of our users and other parties.

Our Relationship with Shopify

The Service is hosted by Shopify. Shopify collects and processes personal information about your access and use of the Service to provide and improve the Service. Information you submit to the store is transmitted and shared with Shopify and other third parties, which may be located outside your country of residence. Additionally, we use Shopify enhanced features that combine data from your interactions with our store, other merchants and Shopify. Shopify may use this collected personal information to deliver these enhanced functions. In these circumstances, Shopify acts as the data controller for this processing, including responding to your privacy rights requests related to this data. To learn more about Shopify’s handling of personal data and your rights, please visit: https://www.shopify.com/legal/privacy/app-users. Subject to your location, you may exercise certain rights relating to your personal information here: https://privacy.shopify.com/en.

Third-Party Websites and Links

Our Service may contain links to websites and online platforms operated by third parties. If you follow a link to an external site not owned or controlled by us, please review its own privacy, security and terms policies. We make no representations or guarantees regarding the privacy, security, accuracy, completeness or reliability of these external sites. Information you share on public or semi-public platforms, including third-party social networks, may be visible to other users of the Service or those platforms and may be used by us or third parties without restriction. The inclusion of a link does not constitute endorsement of that platform, its content or its operator.

Children’s Data

The Service is not intended for children. We do not knowingly collect personal information from children who have not reached the age of majority under local law. If you are a parent or guardian and believe we hold information belonging to your child, please contact us using the details below and request deletion. As of the effective date of this Privacy Policy, we have not knowingly “sold” or “shared” (as defined under applicable law) personal information of individuals under the age of 16.

Security and Data Retention

Please note that no security measure is entirely infallible, and we cannot guarantee absolute security. Data transmitted to us may be at risk during transfer. We recommend that you avoid sending sensitive or confidential information over insecure communication channels. The period for which we retain your personal information depends on multiple factors, such as whether the data is required to maintain your account, deliver the Service, satisfy legal obligations, resolve disputes or enforce contracts and policies.

Your Rights and Choices

Subject to your jurisdiction, you may have some or all of the rights below. These rights are not absolute and only apply in certain circumstances. We may decline a request where permitted by law.

• Right of access: you may request access to the personal information we hold about you.
• Right to deletion: you may request erasure of your stored personal information.
• Right of rectification: you may request correction of inaccurate personal information.
• Right to data portability: in limited circumstances and subject to exceptions, you may obtain a copy of your personal data and request transfer to another controller.
• Opt-out of sale or sharing for targeted advertising: depending on your location, you may opt out of sale or sharing of your personal information for purposes qualifying as targeted advertising under local privacy legislation. You can exercise this opt-out at https://xinyuestore.com/pages/data-sharing-opt-out. If you visit our site with a Global Privacy Control (GPC) signal enabled, we will treat this as an opt-out request for your browser and device, where applicable. Where we can link the device sending the signal to a Shopify account, the opt-out will also apply to that account. You can find more about Global Privacy Control at https://globalprivacycontrol.org/. We do not recognise other “Do Not Track” signals sent by browsers or devices.
• Manage communication preferences: you may receive promotional emails, and you may unsubscribe at any time via the unsubscribe link included in those messages. If you unsubscribe, we may still send non-promotional emails related to your account or orders.

If you reside in the United Kingdom or the European Economic Area, and subject to statutory exceptions and restrictions, you also have the following rights:

• Right to object to processing and right to restriction of processing: you may request us to stop or limit processing for certain purposes.
• Right to withdraw consent: where processing is based on your consent, you may withdraw that consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

You may exercise these rights by following instructions on our Service or contacting us via the details below. For Shopify-processed data and related rights, visit https://privacy.shopify.com/en. We will not discriminate against you for exercising your privacy rights. We may verify your identity before fulfilling your request, as permitted or required by law. You may appoint an authorised agent to submit requests on your behalf. Before processing a request from an agent, we require proof of authorisation and may verify your identity directly with you. We will respond to valid requests within the timeframe required by applicable law.

Complaints

If you are dissatisfied with how we process your personal information, please contact us using the details below. Depending on your residence, you may appeal our decision or submit a complaint to your local data protection authority. If you are located in the EEA, you can find the list of competent supervisory authorities at: https://edpb.europa.eu/about-edpb/about-edpb/members

International Data Transfers

Your personal information may be transferred, stored and processed outside the country where you reside. Where we transfer personal information outside the EEA or the United Kingdom, we rely on approved transfer mechanisms such as the European Commission Standard Contractual Clauses, or equivalent UK contractual clauses where applicable, unless the destination country has been recognised as providing an adequate level of data protection.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time due to changes in our practices or for operational, legal or regulatory reasons. Revised versions will be posted on this website with an updated effective date, and notice will be provided where required by law.

Contact Information

If you have questions about our privacy practices or this Privacy Policy, or wish to exercise your rights, please email us at sales@xinyuetoy.com. Additional contact details are available in our Contact Information Policy. For applicable data protection law, we are the data controller for your personal information.