MIIRELLE INDUSTRIAL CO., LTD Privacy Policy

I. Scope of Application

This policy only applies to personal data collected and processed by us when users within the EU interact with us (including but not limited to visiting our website, purchasing menswear products, consulting, and submitting feedback). It does not apply to user data collected by third parties (such as logistics service providers and payment institutions). Please refer to the privacy policies of third parties yourself; we assume no responsibility for any third-party data processing.

II. Collection and Types of Personal Data

We strictly adhere to the GDPR principles of "lawfulness, legitimacy, necessity, and good faith," collecting only the personal data necessary to provide menswear-related services. We do not collect irrelevant information and ensure the data collection process is transparent and traceable, fully protecting your right to know.

(I) Core Data Collection Types

1. Essential Data: Your name, contact information (phone number, email), shipping address, and order information (product model, quantity, payment amount). This data is essential for completing product sales, delivery, and basic services. Without this data, we cannot provide you with the corresponding services.
2. Optional Data: Your menswear preferences, size selection, product feedback, and willingness to receive marketing information. You can choose whether to provide this data. Not providing this data will not affect your access to basic services; it is only used to optimize product design and improve service relevance.
3. Automatically Collected Data: When you visit our official website, we will automatically collect basic website access data (such as IP address, browsing history, page dwell time, and click behavior) through cookies and similar tracking technologies. This data is not linked to your personal identity and is only used for website optimization and service improvement, strictly complying with GDPR requirements regarding the transparency of cookie use, and will not be used for irrelevant purposes.

(II) Collection Methods

1. Proactive Submission: Personal information (such as name, contact information, shipping address, etc.) that you proactively fill in and submit when browsing products, submitting orders, consulting, or providing feedback, as well as personal information contained in messages sent during consultations;
2. Automatic Collection: Basic access data will be automatically collected when you visit the official website using cookies and similar tracking technologies. This data is not linked to your personal identity. Specific usage rules will be clearly stated when you visit the official website, and you can choose whether to allow it;
3. Third-Party Acquisition: With your explicit consent, necessary personal data related to services and transactions may be obtained from legal and compliant third parties (such as logistics and payment institutions). We will strictly review the source of third-party data, sign relevant agreements to ensure data security, and use the data only for the agreed service purposes.

III. Purpose and Legal Basis of Personal Data Processing

In accordance with Article 6 of the EU GDPR, we process your personal data solely for the following lawful purposes, within the agreed scope, ensuring that each processing action has a clear legal basis:

1. Fulfilling Contractual Obligations: Processing necessary data to complete services such as menswear product sales, order processing, and logistics delivery, ensuring smooth transaction completion. This is necessary to fulfill the service contract between you and us;
2. Providing Customer Service: Processing your contact information, feedback, and other data to respond to your inquiries, answer questions, handle after-sales needs, and protect your legitimate rights and interests;
3. Optimizing Services and Products: Analyzing your browsing history, preference data, product feedback, and website visit data to optimize the website experience, improve product design, enrich menswear categories, and meet your clothing needs. This is based on our legitimate interests and does not infringe upon your rights and freedoms;
4. Sending Marketing Information: With your explicit consent, we process relevant data and send you marketing content such as new menswear products and promotional activities. You may withdraw your consent at any time, and the processing will immediately cease upon withdrawal;
5. Fulfilling Legal Obligations: We comply with relevant UK and EU laws and regulations, process necessary data, respond to investigations and audits by regulatory agencies, and fulfill relevant legal obligations such as taxation and compliance.

IV. Use of Cookies and Similar Technologies

We strictly adhere to GDPR requirements regarding transparency in cookie use. Cookies are used solely to optimize the website experience and do not collect irrelevant data or disclose it to third parties. Specific details are as follows:

1. Necessary Cookies: Ensure the normal operation of core website functions (such as page loading and order submission). They cannot be turned off; turning them off will prevent the normal use of basic website services.
2. Analytics Cookies: Collect website visit data to optimize page layout and improve access smoothness. They are not linked to personal identity, and you can choose whether to allow them.
3. Marketing Cookies: Used to push personalized menswear-related marketing content. Your explicit consent is required for their use, and you can withdraw your consent at any time through the website settings.

V. Storage and Cross-Border Transfer of Personal Data

We strictly adhere to key GDPR compliance requirements and implement effective security measures to ensure the security of your personal data during storage and transfer:

1. Storage Requirements: Your personal data will be primarily stored on compliant servers within the EU. If storage in the UK (an EU adequacy-certified country), GDPR regulations will be strictly followed. Data will be stored for the "minimum necessary period," with transaction and post-sales data retained for 7 years after the service ends. Access data will be de-identified and retained for 3 months; after these periods, it will be securely deleted or anonymized.
2. Security Protection: We employ encryption, access control, and security auditing technologies and management measures to prevent data leakage, tampering, and misuse. We conduct regular data security risk assessments and address security vulnerabilities promptly.
3. Cross-Border Transfer: Cross-border transfers will only be conducted within the limits permitted by GDPR. Transfers to the UK can be made directly. Transfers to non-EU adequacy-certified countries will require a compliant data processing agreement, encryption measures, and your explicit consent to ensure data security.

VI. Sharing and Disclosure of Personal Data

We will never sell or rent your personal data to unrelated third parties. We will only share necessary data with necessary third parties within the scope permitted by GDPR, and we strictly control the scope of sharing:

1. Partner Service Providers: We will share the minimum data required to complete services (such as delivery address and payment status) with necessary partner service providers such as logistics and payment providers. We will sign data processing agreements, clarify their rights and responsibilities, require them to strictly comply with this policy and GDPR requirements, and regularly monitor their compliance;
2. Legal Requirements: We will respond to legal instructions from EU and UK regulatory agencies and courts, disclose necessary data in accordance with the law, and fulfill our legal obligations;
3. Rights Protection: To protect the legitimate rights and interests of us, you, or third parties (such as preventing fraud), we will disclose necessary data without violating GDPR requirements;
4. Business Changes: In the event of business changes such as mergers or acquisitions, your personal data will be legally transferred as business assets. We will notify you in advance to ensure that the transferee continues to comply with this policy and GDPR requirements and protects your data security.

VII. Your Personal Data Subject Rights (Granted by GDPR)

Under the EU GDPR regulation, as a personal data subject, you are entitled to the following rights, and we will facilitate your exercise of these rights without imposing unreasonable obstacles:

1. Right to Know: You have the right to request information regarding the collection, use, storage, and sharing of your personal data. We will provide a clear response within one month.
2. Right to Access: You have the right to request a copy of the personal data you submitted. One copy will be provided free of charge; additional copies may incur a reasonable administrative fee.
3. Right to Correction: If you discover errors in your personal data (such as incorrect name or address), you have the right to request that we correct them promptly. We will complete the correction within seven business days after verification.
4. Right to Erasure (Right to Be Forgotten): Under legal circumstances such as the data processing purpose being achieved or your withdrawal of consent, you have the right to request that we delete your personal data. We will complete the deletion within one month after verification (unless otherwise stipulated by law).
5. Other Rights: You also have the right to restrict processing, the right to data portability, the right to object, and the right to file a complaint. If you believe that our data processing practices violate the GDPR, you may file a complaint with the Data Protection Authority (DPA) of your Member State.

VIII. Our Responsibilities and Commitments

1. We will strictly comply with the EU GDPR and relevant UK regulations, establish and improve our data protection management system, designate specific personnel to be responsible for data protection, and conduct regular data protection training for our employees.
2. We will take effective security measures to prevent the leakage of personal data. In the event of a data breach, we will report it to the relevant regulatory authorities within 72 hours. For high-risk breaches, we will promptly notify you and take remedial measures.
3. We will not use automated decision-making to infringe upon your rights. We will update this Privacy Policy regularly and notify you through our official website after updates. Continued use of the service constitutes your agreement to the updated policy.
4. We will respond promptly to your requests to exercise your rights, without delay or rejection of reasonable and legitimate applications, and will do our utmost to protect your legitimate rights and interests.