Regarding Policies on Personal Privacy

I. What information we collect and why

We adhere to the principle of "minimum necessity," collecting only the information required to achieve the purposes outlined below. "Necessary" information refers to data without which our core services cannot be provided; "optional" information refers to data that you may choose not to provide without affecting your access to our core services.

We do not collect your full credit card number or CVV/CVC security code, nor do we store them on our servers. Please refer to Section 3 of this notice for details on how credit card payment data is handled.

We will not use your personal information for purposes unrelated to those stated above. Should the need arise to use your information for a different purpose, we will obtain your consent again.

---

II. How We Use Your Information

1. Completing Transactions: Processing orders, facilitating payments, arranging delivery, and providing after-sales support or refunds.
2. Account Management & Customer Service: Verifying your identity, responding to inquiries, and handling complaints.
3. Security & Risk Management: Identifying unusual transactions, preventing fraud, and ensuring the security of our website.
4. Legal Compliance: Fulfilling statutory obligations, including those related to taxation, anti-money laundering, and consumer protection.
5. Marketing (only with your separate consent): Sending you product updates and promotional offers. You may withdraw your consent at any time via the unsubscribe link in our emails or by contacting us directly.

We will not deny you access to our core services simply because you choose not to provide optional information.

---

III. Specific Provisions Regarding Credit Card Information

1. We do not access or store full credit card numbers.
All credit card payments are processed through third-party payment service providers (such as Stripe, Adyen, or others) that comply with the PCI DSS (Payment Card Industry Data Security Standard). The payment page is provided directly by the payment service provider; your full card number, expiration date, and CVV/CVC are "tokenized" within your browser, ensuring that our servers never come into contact with the original card number.

2. CVV/CVC codes are never stored.
In accordance with PCI DSS, CVV/CVC codes must not be stored in any form—even in encrypted format—following the completion of authorization. We strictly adhere to this requirement.

3. We retain only non-sensitive payment information.
After a payment is completed, we retain only the card type, the last four digits of the card number, and the expiration date (as provided by the issuing bank) for the purposes of processing refunds and resolving transaction disputes. This information is stored in an encrypted format, and access to it is strictly restricted.

4. Storing card details for future payments requires your separate consent. If you choose to save your card for future payments, this feature is implemented by the payment service provider through tokenization; we do not store the full credentials that could be used to initiate transactions. We will obtain your explicit, separate consent when you select the "Save card" option. You may remove any saved payment methods at any time via your account settings.

5. Transmission Security.
Payment pages are required to use TLS 1.2 or higher (TLS 1.3 is recommended) for encrypted transmission; "mixed content" is prohibited. Information regarding payment service providers and their PCI DSS compliance status can be viewed here: [Link].

Separate Consent: Before you submit your credit card information for the first time, we will obtain your separate consent via a dedicated checkbox. Please refer to the "Separate Consent Text for Payment Process" section at the end of this document for the specific wording.
|||| How do we protect your information?
In other words, we implement various security measures, including the use of secure servers. All sensitive/credit information provided is transmitted via Secure Socket Layer (SSL) technology and then encrypted within our payment gateway provider's database. Access is restricted to those who have special access rights and are required to keep the information confidential.