青岛远旭轩商贸有限公司 (hereinafter referred to as "we") fully understands the importance of personal data protection. This Privacy Policy aims to clearly explain, in accordance with the relevant provisions of the EU General Data Protection Regulation (GDPR), how we collect, use, store, transfer, and protect your personal data in the process of designing, producing, selling, and providing related services for our bags, as well as your relevant data subject rights. This policy applies to both EU residents and EU customers who do business with us.

Please read and understand this Privacy Policy carefully before using our products or services. If you do not agree to any part of this policy, please immediately stop using our products and services.

I. Scope of Application

This Privacy Policy applies to your personal data collected and processed by us in the following ways: 1. Information you actively submit when visiting our official website (zonerise.shop) or using our online and offline services; 2. Information generated during your business dealings with us (including but not limited to order placement, consultation, and after-sales service); 3. Other information related to you that we collect within the scope of legality and compliance.

This policy does not apply to personal data collected by third-party platforms or service providers. We are not responsible for the privacy practices of third parties, and we recommend that you carefully read their privacy policies.

II. Types of Personal Data We Collect and Their Purposes

We strictly adhere to the principles of "legality, loyalty and transparency, specific objectives, and limitations on data collection" when collecting personal data. We only collect information necessary to achieve specific business objectives and will not collect additional data beyond the scope of those objectives. The specific types of personal data we collect and their uses are as follows:

(I) Necessary Identification and Contact Information

This includes your name, email address, phone number, and shipping address. The purpose of collecting this information is to complete core business processes such as order processing, goods delivery, and after-sales communication, ensuring that we can accurately provide you with bag products and related services. If you do not provide this necessary information, we will be unable to complete the above business operations.

(II) Transaction and Order Information

This includes the model, quantity, price, payment method, order number, and order time of the bag products you purchased. We collect this information to track order status, process payment settlements, provide order inquiry services, and provide evidence for subsequent after-sales rights protection.

(III) Website Usage and Device Information

This includes your IP address, browser type, operating system version, access time, accessed pages, device identifier, etc. We collect this information through legal technical means to optimize website performance, improve user experience, analyze website usage, and prevent cybersecurity risks.

(IV) Marketing and Communication Information

This includes your preferences for handbag products, participation in marketing activities, and consultation records. We will only collect this information with your explicit consent to use it for personalized product information, promotional activities, and other marketing messages, or to improve our product design and service quality.

III. Basis for Processing Personal Data

In accordance with GDPR, we process your personal data based on the following legal grounds: 1. To fulfill our contractual obligations to you (such as completing order transactions, providing after-sales service, etc.); 2. Based on your explicit consent (such as receiving marketing information, participating in promotional activities, etc.), which you have the right to withdraw at any time; 3. To comply with obligations stipulated by laws and regulations; 4. To protect the legitimate rights and interests of us or others (such as preventing fraud, handling disputes, etc.).

IV. Storage and Protection of Personal Data

(I) Storage Period

We will only store your personal data for the period necessary to achieve the purposes described in this policy. After this period, we will take measures such as anonymization or secure deletion, unless otherwise stipulated by laws and regulations or there are other legitimate reasons for retention. For example, order-related data will be retained for at least 5 years after the transaction is completed to address possible after-sales rights protection and compliance inspections; marketing-related data will be immediately discontinued and deleted after you withdraw your consent.

(II) Security Protection Measures

We attach great importance to the security of personal data and have established a comprehensive security protection system, taking a series of technical and management measures to ensure the security, availability, confidentiality, and integrity of data. Specifically, these include: 1. Using encryption technology to transmit and store data to prevent unauthorized access; 2. Restricting data access permissions, authorizing only relevant personnel to access personal data in the performance of their duties; 3. Regularly conducting cybersecurity training and risk assessments, and promptly fixing potential security vulnerabilities; 4. Developing data security emergency plans to deal with possible data breaches and other emergencies.

V. Rights of Data Subjects

According to the GDPR, you, as a data subject, enjoy the following rights, and we will provide necessary support and assistance for you to exercise these rights:

• Right of Access: You have the right to request us to confirm whether we are processing your personal data and to obtain a copy of the data and related processing information;
• Right of Correction: If you find that the personal data we process for you is inaccurate or incomplete, you have the right to request us to correct or supplement it;
• Right of Erasure (Right to Be Forgotten): Under certain circumstances (such as when the purpose of data processing has been achieved, you withdraw your consent, or our processing violates laws and regulations), you have the right to request us to erase your personal data. However, the exercise of this right is subject to restrictions stipulated by laws and regulations, except in cases involving compliance with legal obligations or the protection of public interests;
• Right to Restrict Processing: In specific circumstances (such as when you object to the accuracy of the data, or when there is a dispute regarding our processing practices), you have the right to request that we restrict the processing of your personal data;
• Right to Data Portability: You have the right to request that we provide your personal data in a structured, commonly used, and machine-readable format, and the right to transfer such data to other data controllers;
• Right to Object: You have the right to object to our processing of your personal data for marketing purposes or other legitimate interests. We will promptly cease the relevant processing upon receiving your objection request (unless there are sufficient grounds for objection).

If you wish to exercise any of the above rights, please contact us using the contact information provided at the end of this policy. Upon receiving your request, we will verify and process it within the timeframe stipulated by GDPR and promptly provide you with feedback on the results.

VI. Sharing and Transfer of Personal Data

We promise not to share your personal data indiscriminately. We will only share or transfer your personal data in the following specific circumstances, strictly in compliance with GDPR regulations:

• To complete order processing and goods delivery, we will share necessary receiving information (such as name, address, phone number, etc.) with third-party logistics service providers. However, we will enter into a data processing agreement with the third party, requiring them to process the data only for the agreed purpose and take appropriate security measures.
• To comply with laws and regulations or respond to legitimate requests from judicial or regulatory authorities, we will disclose necessary personal data to relevant departments.
• With your explicit consent, we will share your personal data with third parties for the specific purposes you have agreed to.
• In the event of business changes such as mergers, acquisitions, or bankruptcy liquidation, your personal data may be transferred to relevant third parties as part of business assets. We will notify you in advance and ensure that the third party complies with the relevant provisions of this Privacy Policy.

If your personal data needs to be transferred outside the EU, we will ensure compliance with GDPR requirements regarding cross-border data transfer and take appropriate safeguards (such as signing standard contractual terms and ensuring the recipient has sufficient compliance certification) to ensure the security and compliance of data transmission.

VII. Data Breach Notification

In the event of a data breach involving your personal data that poses a high risk to your data rights and freedoms, we will notify the relevant EU data protection authorities within 72 hours of discovery. If the data breach may seriously affect your legal rights, we will also notify you promptly, informing you of the countermeasures we have taken and the protective measures available.