01Data Controller
The data controller is Haikou Haochenxuan Trading Co., Ltd., registered at No. 161-13, Jinmao West Road, Jinmao Subdistrict (Zhongshan Subdistrict), Longhua District Haikou City Hainan Province 570125 China. For privacy matters, contact privacy@phaelun.com.
02Information We Process
Order data: name, contact details, billing and shipping information, order contents and fulfilment records.
Payment data: transaction identifiers and payment-status information. Card payments are processed through Stripe; we do not ask you to send full card credentials by ordinary email.
Customer service data: messages, support history, returns, refunds and complaint information.
Technical and cookie data: device, browser, network, security and cookie-related information where applicable.
03Data Security
We use reasonable technical and organisational safeguards designed to reduce the risk of unauthorised access, alteration, loss or disclosure of personal data, including protected connections and encryption in transit where appropriate.
Personal data is maintained in controlled storage environments with security measures appropriate to the type of information and the services used to operate the website.
Access to personal data is restricted to personnel and service providers who need it for legitimate operational purposes, with access controls intended to limit unnecessary use or disclosure.
Payment information is handled through Stripe and secure payment flows. We do not request full card numbers, CVV/CVC, PINs or security codes through ordinary support email.
04Purposes and GDPR Legal Bases
We process data to perform contracts, fulfil orders, provide customer support, process returns and refunds, protect the website, prevent fraud, comply with legal obligations and pursue legitimate business interests where permitted.
Where processing relies on consent, you may withdraw that consent at any time without affecting processing already carried out lawfully.
05Service Providers and Payment Processing
We may use service providers for hosting, fulfilment, customer support, security, communications and other operational needs. Stripe processes card payments.
Providers receive only the information reasonably necessary for their role and are expected to handle it in accordance with applicable contractual and legal requirements.
06Data Retention
We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including order fulfilment, accounting, dispute handling, fraud prevention and legal compliance.
07International Data Transfers
Because we serve international customers, personal data may be processed in countries other than your own. Where required, we use appropriate safeguards for international transfers in accordance with applicable data-protection law.
08Data Subject Rights
You may have rights of access, rectification, erasure, restriction, portability and objection, depending on applicable law.
Where processing is based on consent, you may withdraw consent.
You may also have the right to complain to a competent supervisory authority.
To submit a privacy request, contact privacy@phaelun.com.