Privacy policy
YAXIN TRADING CO. LIMITED, trading as KAOLENNE, is responsible for the personal information we use to operate this store, fulfill orders and answer requests. This policy explains those uses and the choices available to you. Our registered address and privacy contact are listed below.
Our store is hosted on Shopify. This is one privacy policy for our U.S. and European markets, with regional rights explained in section 7. It covers KAOLENNE's processing; payment providers and Shopify may also process information for their own purposes under their privacy notices. Using our website does not, by itself, constitute consent to optional advertising or marketing.
1 Information we collect
| Category | Examples and source |
|---|---|
| Contact and account information | Name, email, telephone number, billing and delivery addresses, and account details you provide |
| Order and payment records | Purchased items, amounts, discounts, transaction identifiers, payment status and limited payment details supplied by the payment provider |
| Delivery and support information | Dispatch and delivery status, return requests, messages and photographs supplied by you or our fulfillment partners |
| Device and website information | IP address, browser and device details, pages requested, timestamps and necessary cookie or session identifiers collected through the store |
| Privacy choices | Requests, consent choices where relevant, identity-verification information and records needed to honor those choices |
Payment credentials are submitted through the payment provider's checkout. Please do not send full card numbers or security codes by email. We use payment confirmations and limited transaction details to manage orders; providers handle their own payment processing.
We obtain information directly from you, through the store, and from Shopify, payment providers and fulfillment partners. Information needed for payment, delivery or an order-related inquiry is necessary to provide that service. Optional information is not a condition of buying a product.
2 Purposes and legal bases
For processing subject to the EU or UK GDPR, we use the following bases as applicable:
| Purpose | Basis |
|---|---|
| Take payment, fulfill orders, arrange returns and answer purchase-related questions | Performance of a contract or steps you request before a contract |
| Secure the store, prevent fraud and resolve operational problems | Our legitimate interests in protecting customers and operating a reliable business, balanced against your rights |
| Keep records required under applicable EU or UK law | Compliance with the relevant legal obligation |
| Meet applicable non-EU or non-UK recordkeeping duties and establish or defend claims | Legitimate interests in lawful business administration and legal claims, where this basis is appropriate under the applicable regime |
| Optional tracking or marketing if introduced | Consent where required; any other permitted basis will be identified before that processing starts |
We limit each use to the information reasonably needed. You may object to processing based on legitimate interests. An objection to direct marketing will be honored without requiring you to justify it.
3 Who receives information
We disclose information as needed to Shopify for hosting, checkout and store operations; PayPal or the card payment processor selected at checkout; U.S. warehouse operators, carriers and customs agents for delivery and returns; and email, hosting or security providers supporting the store.
We may provide relevant information to accounting or professional advisers, or to authorities where lawfully required. If the business is transferred, any transfer of personal information must have an appropriate legal basis and protections; we will give notice where required.
Providers processing information on our behalf must use it for the agreed service and under appropriate safeguards. A provider acting independently has its own privacy responsibilities. See Shopify's Consumer Privacy Policy and PayPal's Privacy Statement for their practices.
4 Cookies and planned services
The store uses cookies and similar technologies needed for functions such as shopping-cart continuity, checkout, security and saving privacy choices. Blocking all cookies in your browser may prevent some of these functions from working. Disabling a data-sharing feature does not remove all cookies.
At this policy date, KAOLENNE has not enabled Google Analytics, Google Ads tracking, Meta Pixel, third-party marketing automation, or third-party customer-support and review apps. These are planned services. Before enabling them, we will update this notice, identify their purposes and recipients, and provide any required consent or opt-out controls.
Where prior consent is required, optional tracking will remain inactive until you choose to allow it, and you will be able to withdraw consent through an accessible cookie-preferences control. Necessary cookies do not depend on optional marketing consent. We will not treat continuing to browse as consent.
We do not currently use customer information for cross-context behavioral advertising or sell it for money. If future tools constitute a sale, sharing or targeted advertising under applicable privacy law, we will provide the required notice, choice and recognized opt-out signal handling before that processing begins.
If email or SMS marketing is introduced, we will obtain any legally required permission and provide an effective unsubscribe method. Withdrawing marketing permission will not stop essential order communications.
5 International processing
Our business is registered in Hong Kong and orders are fulfilled in the United States. Information may be accessed or processed in those locations and other countries where our service providers operate. These countries may have different data-protection laws from your country.
For a restricted international transfer, we must use a valid transfer mechanism, such as an applicable adequacy decision or approved contractual safeguards with any required supplementary measures. EU standard contractual clauses, and the relevant UK transfer instrument for UK data, may be used where applicable. You may request information about the safeguards and a copy subject to necessary redactions.
[TO COMPLETE BEFORE PUBLICATION: Identify the actual transfer mechanisms covering Shopify, the selected payment processor, U.S. fulfillment partners and access by the operating team. Name any required EU or UK representative and provide their contact details. Do not describe an unsigned safeguard as already in place.]
6 Retention
We retain personal information according to its purpose and applicable legal requirements, rather than retaining every customer record indefinitely.
- Transaction, invoice and accounting records required under Hong Kong tax law are generally kept for at least seven years after the relevant transaction. We retain only the data needed for those records and keep it longer only where another applicable obligation or legal hold requires it.
- Account information is kept while the account is active. After closure, we remove or anonymize information no longer needed, while separating any records still required for orders, accounting or legal claims.
- Support and return records are kept until the issue is resolved and for the applicable complaint, payment-dispute or legal-claim period. The relevant transaction, claim type and jurisdiction determine that period.
- Security logs are kept for the time needed to investigate and address security or fraud risks. An incident-related record may be retained while that incident or a resulting claim remains open.
- Privacy-request records and minimal suppression records are kept as needed to demonstrate compliance and prevent an unwanted communication or processing activity from restarting.
When a purpose and any required retention period end, we delete or irreversibly anonymize the information. A retention obligation may limit deletion of specific records; it does not justify continued marketing use. Contact us for the retention criteria relevant to your information.
7 Your rights and requests
Your rights depend on the law that applies to your information and our processing. You will not be penalized for exercising a protected privacy right.
EU and EEA residents and UK residents
Where the EU or UK GDPR applies, you may request access, correction, deletion, restriction or portability, subject to the applicable conditions and exceptions. You may object to processing based on legitimate interests and to direct marketing. Where we rely on consent, you may withdraw it without affecting earlier lawful processing. The purposes, legal bases and international-processing information above apply to these requests.
United States residents
Where applicable state privacy law covers our business and your request, you may have rights to know or access, correct, delete or receive a portable copy of personal information, and to opt out of sale, sharing or targeted advertising as defined by that law. An authorized agent may act for you where permitted. If a right to appeal applies, you may appeal a refusal using the contact process below. Our current and planned advertising practices are described in section 4; listing a statutory right does not mean that we currently engage in that activity.
Switzerland and other locations
Applicable local rights remain available, including requests for information, access and correction and any other rights provided by local law. Contact us using the process below.
How to submit a request
Email info@kaolenne.com with the subject Privacy Request, or contact us by telephone or post. We may request proportionate information to verify your identity or an authorized agent's authority. Do not send unnecessary identity documents. If we cannot fulfill all or part of a request, we will explain the lawful reason and any appeal route available to you. You may send an appeal to the same email address with the subject Privacy Appeal.
We normally acknowledge messages within one business day. The legal response period is separate: EU and UK GDPR requests are generally answered within one month, with a lawful extension and notice where permitted. U.S. state-law and other requests follow the deadlines applicable to them.
You may complain to your competent data-protection authority, including your local EEA authority, the UK Information Commissioner's Office, the Swiss FDPIC, or the Hong Kong Privacy Commissioner, as applicable. You do not have to contact us first to exercise a right to complain.
8 Security and children
We use reasonable organizational and technical measures appropriate to the information we handle and restrict access to people and providers who need it. No system is completely secure. Contact us promptly if you suspect misuse of information connected with an order.
The store is intended for general adult retail shopping and is not directed at children. We do not knowingly seek children's personal information for marketing. If you believe a child has supplied information without appropriate authorization, contact us so we can review and take the action required by law.
9 Changes and privacy contact
We update this notice when our practices change and display the updated date. Where required, we provide additional notice or obtain consent before a new use. A policy update does not itself authorize a new use of information.
KAOLENNE is operated by YAXIN TRADING CO. LIMITED.
Registered address: RM 1011, 10/F, THE CLOUD, 111 TUNG CHAU STREET, TAI KOK TSUI, HONG KONG.
Email: info@kaolenne.com. Phone: +86 19186889072.
Customer service: Monday to Friday, 9:00 AM to 5:00 PM; Saturday, 10:00 AM to 3:00 PM. All times are fixed UTC-8 throughout the year, with no daylight saving adjustment. We normally reply within one business day. Email can be sent at any time. Saturday customer service does not add a warehouse processing day.