Privacy Policy
This policy explains what personal data we collect when you use our online shop, why we collect it, who we share it with, and the rights you have. It applies to the website operated by Shanghai Chaozu Trading Co., Ltd..
Last updated: 2026-08-08
1. Who is responsible
The controller responsible for processing your personal data is:
Shanghai Chaozu Trading Co., Ltd.
Room J, 3rd Floor, Building 2, No. 501 Pan'an Road, Jiading District, Shanghai
Email: [email protected]
For any question about data protection, or to exercise the rights described in section 7, please write to [email protected].
2. What we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account data: email address, display name, password (stored only as a one-way hash, never in clear text) | Creating and securing your account, signing you in, sending verification codes | Performance of a contract, Art. 6(1)(b) |
| Delivery data: recipient name, street address, city, province, postal code, country, contact email | Shipping your order and keeping a record of what was agreed | Performance of a contract, Art. 6(1)(b) |
| Order and payment data: items ordered, prices, order numbers, payment status | Processing and fulfilling your order, invoicing, accounting | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Usage data: pages and products viewed, a device identifier stored in your browser | Understanding which products interest our visitors so we can improve the shop | Legitimate interest, Art. 6(1)(f) |
| Customer service data: the content of chat conversations with our support assistant | Answering your questions and resolving order issues | Contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) |
| Email data: recipient address, delivery status, bounces and complaints | Sending order notifications, verification codes and, if you opted in, marketing emails; keeping a suppression list so we stop mailing addresses that bounce or complain | Contract, Art. 6(1)(b); consent for marketing, Art. 6(1)(a) |
| Fraud prevention data: delivery address and email address checked against our internal block lists | Preventing fraudulent and abusive orders | Legitimate interest, Art. 6(1)(f) |
We do not buy personal data from third parties, and we do not sell your data to anyone.
3. Payment
Payments are handled by PayPal. Your card or bank details are entered on the payment provider side and never reach our servers. We only receive the result of the transaction and a payment reference.
4. Service providers we use
We use a small number of processors that handle data strictly on our instructions:
- PayPal — payment processing.
- Our email delivery provider — sending transactional and marketing email and reporting delivery results.
- Cloudflare R2 — hosting product images and attachments.
- 17TRACK — retrieving parcel tracking events for your shipment.
- Google (Gemini and Cloud Translation) — generating product descriptions and translations, and powering the support assistant.
Some of these providers process data outside the European Economic Area, including in the United States. Where that happens, the transfer is covered by the European Commission Standard Contractual Clauses or an adequacy decision.
5. Storage in your browser
We do not use tracking cookies. Your sign-in token and a device identifier used for usage statistics are stored in your browser local storage. Clearing your browser storage removes both; clearing the sign-in token will simply sign you out.
6. How long we keep data
- Account data — for as long as your account exists.
- Order, invoice and payment records — for the retention period required by commercial and tax law, which is normally up to 10 years. These records cannot be deleted earlier, even on request.
- Usage data — up to 24 months.
- Support conversations — up to 24 months.
- Suppression list entries (addresses that bounced or complained) — kept indefinitely, because their purpose is to make sure we never email that address again.
7. Your rights
Under the GDPR you have the right to access your data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent at any time.
How to make a request: send an email to [email protected] from the address registered with your account, telling us what you would like us to do. A member of our team reviews and carries out every request manually — we deliberately do not automate account deletion, so that no account is ever removed by mistake. We will respond within one month.
Please note that when we erase an account, records we are legally required to retain (orders, invoices, payment records) are kept until their statutory retention period expires, and your email address is retained as an irreversible hash so that the deletion cannot be silently undone by re-registering.
You also have the right to lodge a complaint with your local data protection supervisory authority.
8. Marketing email
We only send marketing email if you asked us to. Every marketing message contains a one-click unsubscribe link and an unsubscribe header your mail app can act on. Unsubscribing takes effect immediately and does not affect order-related messages such as confirmations and shipping notices.
9. Changes to this policy
If we change how we handle personal data, we will update this page and the date shown at the top.