1. Data Collection Scope

We collect personal information that you provide directly to us when you interact with our website and services. The categories of personal data we may collect include:

• Identity and contact information: your name, email address, billing address, shipping address, and phone number.
• Order and transaction information: details of products purchased, order history, and purchase preferences.
• Payment information: payment card details or other payment data are processed exclusively by our third-party payment service providers (Stripe and PayPal). We do not store your full payment card numbers on our servers.
• Account information: username, password, and account preferences if you register an account with us.
• Communication data: records of your correspondence with our customer support team, including emails and chat logs.
• Technical and usage data: IP address, browser type, device information, pages visited, and browsing behavior on our site, collected through cookies and similar technologies.

2. Data Usage Purpose

We process your personal data for the following purposes, each based on a lawful ground under the GDPR:

• Order processing and fulfillment: to process your orders, arrange shipping, handle returns and refunds, and provide after-sales support. (Lawful ground: performance of a contract.)
• Customer service: to respond to your inquiries, resolve issues, and provide technical or product support. (Lawful ground: legitimate interests and performance of a contract.)
• Marketing communications: to send you newsletters, promotional offers, and product updates. We will only send marketing emails if you have given explicit consent. You may withdraw your consent at any time. (Lawful ground: consent.)
• Website improvement: to analyze usage patterns, improve our website functionality, and personalize your shopping experience. (Lawful ground: legitimate interests.)
• Legal compliance: to comply with applicable laws, regulations, tax requirements, and lawful requests from governmental authorities. (Lawful ground: legal obligation.)
• Fraud prevention and security: to detect and prevent fraudulent transactions and protect the security of our website and users. (Lawful ground: legitimate interests and legal obligation.)

3. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information to any third party for commercial purposes. We may share your personal data with the following categories of trusted service providers who assist us in operating our business:

• Payment gateways: Stripe and PayPal process payment transactions on our behalf. They receive your payment details and billing information necessary to complete purchases.
• Shipping and logistics providers: carriers and fulfillment partners receive your name, shipping address, and contact information to deliver your orders.
• Email service providers: platforms that help us send transactional emails and marketing communications (with your consent).
• Analytics tools: services such as Google Analytics that help us understand website traffic and user behavior. These tools may collect your IP address and browsing data.
• Hosting and IT infrastructure: our web hosting provider and cloud services that store and process data on our behalf.

All third-party service providers are contractually required to implement appropriate data protection measures and may only process your personal data in accordance with our instructions. We may also disclose your data when required by law or to protect our rights, property, or safety.

4. User Rights

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request correction of inaccurate or incomplete personal data.
• Right to Erasure (“Right to be Forgotten”): You can request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or when you withdraw consent.
• Right to Data Portability: You can request transfer of your personal data to another organization in a structured, commonly used, machine-readable format.
• Right to Restriction of Processing: You can request that we suspend processing of your personal data in certain circumstances, such as when the accuracy of the data is contested.
• Right to Object: You can object to processing of your personal data based on our legitimate interests, including profiling for direct marketing purposes.

To exercise any of these rights, please contact us at teafriendsupport@liubaocha.shop. We will respond to your request within 30 days. There is no fee for making a request, unless it is clearly unfounded or excessive. We may ask you to verify your identity before disclosing any personal data.

5. Cookie Policy

We use cookies and similar tracking technologies to enhance your browsing experience on our website. Cookies are small text files stored on your device that allow us to recognize your browser and remember certain information.

We use the following categories of cookies:

• Necessary cookies: These cookies are essential for the website to function properly, including session management, shopping cart functionality, and security. They cannot be disabled in our systems.
• Analytical/Performance cookies: These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously, enabling us to improve site performance.
• Marketing cookies: These cookies are used to deliver relevant advertisements and track the effectiveness of marketing campaigns. They may be set by us or our advertising partners.

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent. Please note that disabling necessary cookies may affect the functionality of our website, including the ability to complete purchases.

6. Data Retention Period

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, and reporting requirements:

• Order and transaction data: Retained for the period required by applicable tax and accounting laws (typically 7 to 10 years) to comply with financial record-keeping obligations.
• Customer account data: Retained for the duration of your account. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law.
• Marketing communications data: Retained until you unsubscribe or withdraw consent. You can unsubscribe from marketing emails at any time by clicking the “unsubscribe” link in any marketing email or by contacting us directly.
• Customer support correspondence: Retained for up to 3 years after the last interaction to ensure continuity of service and for quality assurance purposes.
• Technical and analytics data: Anonymized or aggregated data may be retained indefinitely for statistical and analytical purposes.

7. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

• Email: teafriendsupport@liubaocha.shop
• Contact form: Available through our Contact Us page at https://liubaocha.shop/contact-us/

We are committed to resolving any complaints about our collection or use of your personal data. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

8. Children’s Privacy

Our website and services are not intended for or directed at children under the age of 16. We do not knowingly collect or solicit personal information from children under 16. If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 16, please contact us immediately at teafriendsupport@liubaocha.shop.

Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (SSL/TLS), secure payment processing, access controls, and regular security assessments. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on this page and revising the “Last updated” date. We encourage you to review this policy periodically for the latest information on our privacy practices.