Privacy Policy

1. Scope of Personal Information Collected

For the purposes of this policy, "Personal Information" refers to any data that identifies, relates to, or can reasonably be linked to an individual. It does not include completely anonymized or de-identified datasets that can no longer be used to identify a specific person. Depending on your interactions with CamelliaX, we may collect and process the following categories of information:

• Contact & Registration Data: Your full name, residential or billing address, shipping destination, primary phone number, and email address.
• Financial & Transaction Details: Credit/debit card numbers, encrypted payment tokens, account data, transaction histories, purchase amounts, and payment confirmations.
• Account Credentials: Usernames, account preferences, custom settings, and security questions.
• Customer Engagement History: Products viewed, items added to shopping carts or wishlists, returns, exchanges, cancellations, and comprehensive historical purchase records.
• Communications & Support: Any information, text, or files you transmit to us via customer support forms, email correspondence, or live chat.
• Device & Network Identifiers: IP addresses, unique device identifiers, browser types, operating system versions, and structural network details.
• Behavioral & Usage Data: Metrics on how you navigate our storefront, page response times, scroll depth, and temporal patterns of your interactions with our Services.

2. Core Sources of Information

We aggregate personal data through several operational streams:

• Direct Submission: Information you voluntarily provide when registering an account, placing orders, or contacting our support team.
• Automated Telemetry: Data captured passively by our infrastructure when you interact with our website, utilized through cookies, tracking pixels, and related diagnostic scripts.
• Service Providers & Contractors: Data from professional vendors who operate on our behalf, including payment gateways, logistics partners, and data analytics firms.
• Strategic Third Parties: Information shared by marketing partners, social networks, or commercial affiliates in compliance with data privacy regulations.

3. Purpose of Processing Personal Data

CamelliaX deploys your information to fulfill operational, marketing, and legal requirements, including:

• Service Delivery and Contract Fulfillment: Processing transactions, managing customer accounts, routing logistics for shipment, handling returns/exchanges, and displaying customer-generated reviews.
• Personalization of Experience: Utilizing algorithmic inferences to recommend targeted skincare solutions and tailor our digital presentation to your specific preferences.
• Marketing and Promotional Outreach: Deploying personalized advertisements, managing promotional email campaigns, and distributing SMS updates regarding new product arrivals or brand developments based on your shopping behavior.
• Security and Fraud Prevention: Validating account credentials, protecting payment corridors, identifying malicious actors, and preventing financial fraud or unauthorized platform access.
• Regulatory Compliance & Legal Actions: Adhering to statutory rules, responding to subpoenas or judicial requests, and defending or enforcing our corporate intellectual property and legal policy frameworks.

4. Disclosure and Sharing of Personal Data

We do not sell your personal data for cash. However, to execute our Services efficiently, we disclose data to selected external entities under strict confidentiality frameworks:

• The Shopify Platform: Bottom-tier data hosting and operational support systems managed by Shopify Inc.
• Operational Service Providers: Specialized entities managing payment processing, cloud storage, inventory tracking, package delivery, and customer service portals.
• Marketing and Enterprise Partners: Advertising networks and social platforms that display tailored advertisements based on cross-context behavioral tracking. You may opt out of these personalized ad practices where applicable by utilizing our regional opt-out tool.
• Corporate Affiliates: Shared internal databases across our corporate group or parent entities for unified operations.
• Corporate Transitions & Legal Safeguards: Parties involved in asset mergers, corporate restructurings, or bankruptcy actions; or when mandated to protect the physical safety, rights, or property of CamelliaX, its users, or the general public.

5. Architecture and Integration with Shopify

As a storefront hosted on Shopify, your personal information is processed through their cloud architecture, which may involve cross-border data transfers to secure servers located outside your jurisdiction. CamelliaX also implements Shopify’s advanced optimization features, which synthesize customer telemetry across multiple merchants to detect fraud and refine target audiences. In these specific processing contexts, Shopify acts as a joint data controller. To review Shopify's independent data compliance architecture, please consult the Shopify Consumer Privacy Policy.

6. Third-Party Ecosystems and Hyperlinks

Our website may feature external hyperlinks leading to third-party digital environments. CamelliaX exerts no operational control over, and assumes no liability for, the privacy metrics, terms, or data integrity of external websites. We encourage you to evaluate the privacy protocols of those separate environments prior to submitting personal information.

7. Protection of Minors

Our Services are directed exclusively toward adult consumers. We do not intentionally compile or store data concerning individuals who have not attained the age of majority within their legal jurisdiction. If a parent or guardian discovers that a minor has provisioned personal details to CamelliaX, please contact us immediately to initiate permanent erasure protocols.

8. Data Security and Retention Metrics

We implement enterprise-grade technical safeguards designed to shield your files from unauthorized entry or destruction. However, no digital transmission channel or storage matrix can be certified as completely infallible. We strongly advise against sending highly confidential payment or personal credentials via unencrypted text or email channels.

We preserve personal profiles only for the duration required to satisfy operational goals, execute contractual agreements, resolve administrative disputes, or comply with relevant accounting and legal limitation periods.

9. Global Consumer Privacy Rights

Depending on your state or national residency, you may possess specific legal entitlements regarding your personal files, subject to statutory exceptions:

• Right of Access & Portability: The right to demand comprehensive disclosure of the personal profiles we maintain about you and receive them in a structured, machine-readable format.
• Right of Rectification: The right to compel the correction of inaccurate, outdated, or incomplete data elements.
• Right of Erasure: The right to demand the permanent deletion of your accumulated personal data from our active databases.
• Right to Opt Out of Targeted Advertising: The right to direct us not to share your information for cross-context behavioral advertising. Our platform automatically respects Global Privacy Control (GPC) signals broadcasted by your browser.
• Right of Restriction & Objection: (Specific to UK/EEA residents) The right to restrict specific high-volume processing operations or object to profiling practices.

To exercise any of the aforementioned rights, please contact our privacy compliance team using the credentials below. We do not penalize or discriminate against any consumer for exercising their privacy rights.

10. Regulatory Enquiries & Contact Channels

For inquiries regarding our privacy posture, or to submit a formal right request, please reach out via the following channels:

Email: support@camelliax.com

Corporate Office: Room A113, Building 211, Tian'an Technology Development Building, Panyu Energy-saving Science Park, 730 Yingbin Road, Donghuan Street, Panyu District, Guangzhou, Guangdong 510000, China

For the purposes of international data protection laws, CamelliaX operates as the primary Data Controller for your information.