Privacy Policy

01 Introduction

Yunnan Nutingnuan Network Technology Co., Ltd. (hereinafter referred to as "we," "us," or "our") is committed to protecting the privacy and security of the personal information of our users, customers, and website visitors. This Privacy Policy explains how we collect, use, disclose, store, and safeguard your information when you visit our websites, use our mobile applications, interact with our services, or otherwise engage with us.

We respect your right to privacy and strive to be transparent about the data we collect and how we handle it. Please read this Privacy Policy carefully to understand our practices regarding your personal data. By accessing or using our services, you acknowledge that you have read and understood this policy. If you do not agree with any part of this policy, you should discontinue use of our services immediately.

This Privacy Policy applies to all information collected through our digital platforms, communication channels, and offline interactions where this policy is referenced. We may update this policy from time to time, and we will notify you of any material changes by posting the updated version on this page and updating the "Effective Date" at the top.

02 Information We Collect

We collect various types of information in connection with the provision and improvement of our services. The categories of information we may collect include:

2.1 Personal Identification Information

When you register for an account, make a purchase, subscribe to a newsletter, or contact us, we may collect personal information that can be used to identify you, including but not limited to:

• Full name (first name and last name);
• Email address;
• Phone number;
• Postal or billing address;
• Government-issued identification (where required for verification or compliance purposes);
• Account username and password;
• Profile information such as avatar, preferences, and biography (if you choose to provide it).

2.2 Financial and Payment Information

When you make purchases or use paid services, we may collect payment-related information such as:

• Credit or debit card details (card number, expiration date, CVV code) — processed through PCI DSS-compliant third-party payment processors;
• Bank account information for direct transfers or refunds;
• Billing address and transaction history.

We do not store full payment card numbers on our servers. All payment processing is handled by our trusted third-party payment gateway providers who adhere to strict security standards.

2.3 Technical and Usage Data

When you access our website or services, we automatically collect certain technical information through cookies, log files, web beacons, and similar tracking technologies, including:

• IP address and geolocation data (approximate);
• Browser type and version;
• Operating system and device type;
• Pages visited, time spent on pages, click patterns, and navigation paths;
• Referring URL (the website you visited before ours);
• Unique device identifiers (such as IDFA or Android Ad ID).

2.4 Communications and Correspondence

We may collect information you provide when you communicate with us, including:

• Email correspondence with our support team;
• Live chat transcripts;
• Phone call recordings (where permitted by applicable law and with your consent);
• Survey responses and feedback submissions.

2.5 Sensitive Personal Data

We generally do not seek to collect sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health information, biometric data, or sexual orientation). If it becomes necessary to process such data for a specific purpose, we will obtain your explicit consent and process it in accordance with applicable legal requirements.

03 How We Collect Information

We collect information through the following methods and channels:

3.1 Information You Voluntarily Provide

The most common way we collect information is when you directly provide it to us. This occurs when you:

• Create or register an account on our platform;
• Place an order or request a service;
• Subscribe to newsletters, marketing emails, or SMS alerts;
• Fill out online forms or surveys;
• Contact our customer support team via email, phone, or live chat;
• Post comments, reviews, or other content on our platform;
• Participate in promotions, contests, or loyalty programs;
• Upload documents or provide information for verification purposes.

3.2 Automated Collection

When you use our website or applications, we and our third-party service providers automatically collect technical and usage information using:

• Cookies — small text files stored on your device to remember your preferences and enhance your experience;
• Web beacons / tracking pixels — tiny graphic images embedded in emails and pages that help us understand engagement;
• Log files — records of server activity that capture IP addresses, browser details, and timestamps;
• Analytics tools — such as Google Analytics and similar platforms that help us understand usage patterns;
• Session replay technology — (if used) to record user interactions for quality assurance and product improvement purposes.

3.3 Information from Third Parties

In certain circumstances, we may receive information about you from third-party sources, including:

• Social media platforms (when you log in via or link accounts with services such as WeChat, QQ, Weibo, Google, or Facebook);
• Payment processors who provide us with transaction confirmations and limited account details;
• Business partners and affiliates who share data in connection with joint offerings or services;
• Public databases and data brokers (only where legally permissible and for legitimate business purposes such as fraud prevention);
• Credit reference agencies (for credit checks, where applicable and with your consent).

3.4 Offline Collection

We may also collect personal information during offline interactions, such as at trade shows, business meetings, in-person events, or when you communicate with us via postal mail or telephone.

04 Use of Information

We use the information we collect for the following legitimate business purposes:

4.1 Provision and Operation of Services

• Creating and maintaining your user account;
• Processing transactions, orders, and payments;
• Delivering products, services, and digital content you have requested;
• Verifying your identity and eligibility to use our services;
• Providing customer support and responding to your inquiries;
• Communicating with you about your account, orders, and service updates.

4.2 Improvement and Development

• Analyzing usage trends and patterns to improve our website and services;
• Developing new features, products, and services based on user feedback and behavior;
• Conducting research and data analysis to enhance user experience;
• Troubleshooting technical issues and debugging errors;
• Testing and evaluating new system designs and interface layouts.

4.3 Communication and Marketing

• Sending transactional emails (order confirmations, shipping notifications, password resets);
• Sending promotional communications, newsletters, and special offers (with your consent where required by law);
• Conducting customer satisfaction surveys and market research;
• Personalizing content and advertisements based on your preferences and browsing history;
• Managing referral programs, loyalty rewards, and promotional campaigns.

4.4 Legal Compliance and Protection

• Complying with applicable laws, regulations, and legal processes;
• Responding to lawful requests from public authorities, including law enforcement and regulatory bodies;
• Enforcing our Terms of Service and other legal agreements;
• Detecting, preventing, and investigating fraud, abuse, security incidents, and illegal activities;
• Establishing, exercising, or defending legal claims;
• Protecting our rights, property, and safety, and those of our users and the public.

4.5 Legitimate Interests

We may process your personal information for purposes that are in our legitimate interests, provided that such processing does not override your rights and freedoms. Our legitimate interests include improving our services, maintaining the security of our platform, conducting business analytics, and engaging in direct marketing where permitted by applicable law.

05 Sharing and Disclosure of Information

We do not sell your personal information to third parties. We may share your information with the following categories of recipients under the circumstances described below:

5.1 Service Providers and Business Partners

We engage trusted third-party service providers to assist us in operating our business and providing services to you. These providers are contractually bound to process your data only on our instructions and to implement appropriate security measures. Categories of service providers include:

• Payment processors (e.g., Stripe, PayPal, Alipay, WeChat Pay) for transaction processing;
• Cloud hosting providers for data storage and infrastructure;
• Analytics providers for usage tracking and data analysis;
• Email and communication platforms for sending transactional and marketing messages;
• Customer support platforms for managing inquiries and tickets;
• Fraud detection and prevention services;
• Delivery and logistics partners for shipping products.

5.2 Legal and Regulatory Disclosures

We may disclose your personal information if we believe in good faith that such disclosure is necessary to:

• Comply with a legal obligation, court order, or governmental request;
• Respond to lawful requests from public authorities, including tax authorities, law enforcement, and regulators;
• Protect and defend our rights, property, or safety, or those of our users or the public;
• Enforce our Terms of Service, policies, or other contractual agreements;
• Investigate, prevent, or take action regarding suspected fraud, illegal activities, or security vulnerabilities.

5.3 Corporate Transactions

In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or the uses of your personal information, as well as any choices you may have regarding your information.

5.4 Aggregated and De-identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you. Such information may be used for research, analytics, marketing, and other business purposes without restriction.

5.5 With Your Consent

We may share your personal information with third parties for any other purpose disclosed to you at the time of collection, provided we have obtained your explicit consent to do so.

06 Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal and regulatory obligations, to resolve disputes, and to enforce our agreements.

6.1 Retention Periods

The specific retention periods depend on the nature of the data and the purpose of processing:

• Account information: Retained for the duration of your active account plus a reasonable period thereafter (typically 12 to 24 months) in case you wish to reactivate your account;
• Transaction data: Retained for the period required by applicable tax and accounting laws, which is typically 5 to 10 years depending on jurisdiction;
• Communications and support tickets: Retained for up to 3 years from the date of the last interaction;
• Marketing preferences and consent records: Retained until you withdraw your consent or unsubscribe, plus a short grace period to honor your preferences;
• Technical logs and analytics data: Retained for a period of up to 26 months;
• Data subject to legal hold: Retained for the duration of the hold and any associated legal proceedings.

6.2 Data Deletion

Upon the expiration of the applicable retention period, we will securely delete, anonymize, or destroy your personal information in accordance with our data destruction procedures. Where deletion is not immediately technically feasible (such as from backup systems), we will take reasonable steps to isolate the data and delete it as soon as technically practicable.

6.3 Account Closure

If you close your account, we will deactivate your account and delete your personal information within a reasonable timeframe, subject to our data retention obligations described above. Please note that some information may remain in our backup systems for a limited period after deletion.

07 Data Security

Protecting your personal information is a top priority. We implement a comprehensive set of technical, organizational, and administrative security measures designed to safeguard your data against unauthorized access, alteration, disclosure, destruction, or loss.

7.1 Technical Security Measures

• Encryption: All data transmitted between your browser and our servers is encrypted using Transport Layer Security (TLS) protocols. Sensitive data at rest is encrypted using industry-standard AES-256 encryption;
• Firewalls and intrusion detection: We maintain network firewalls and intrusion detection/prevention systems to monitor and block unauthorized access attempts;
• Access controls: Strict role-based access controls ensure that only authorized personnel have access to personal information on a need-to-know basis;
• Regular security audits: We conduct periodic vulnerability assessments, penetration testing, and security audits of our systems and infrastructure;
• Secure development lifecycle: Our development teams follow secure coding practices and conduct code reviews to minimize security vulnerabilities.

7.2 Organizational Security Measures

• Data protection training: All employees receive regular training on data protection, privacy, and security best practices;
• Confidentiality agreements: Employees and contractors with access to personal data are bound by confidentiality obligations;
• Incident response plan: We maintain a documented incident response plan to promptly address and mitigate any data security incidents;
• Vendor due diligence: Third-party service providers who process data on our behalf are evaluated for their security practices and contractually bound to maintain adequate safeguards.

7.3 Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant regulatory authorities as required by applicable law. Our notification will include the nature of the breach, the categories of data involved, the measures we have taken to address the breach, and recommendations for protecting your information.

7.4 Limitations

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we continuously work to maintain and improve our security practices.

08 Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information. We are committed to facilitating the exercise of these rights in accordance with applicable data protection laws.

8.1 Right to Access

You have the right to request confirmation of whether we process your personal information and, if so, to access that information along with details about the processing, including the categories of data processed, the purposes of processing, the recipients of the data, and the retention period.

8.2 Right to Rectification

You have the right to request the correction of inaccurate or incomplete personal information we hold about you. We will make the corrections promptly upon verification.

8.3 Right to Erasure (Right to be Forgotten)

You have the right to request the deletion of your personal information in certain circumstances, including when the data is no longer necessary for the purpose for which it was collected, when you withdraw your consent, or when the processing is unlawful.

8.4 Right to Restrict Processing

You have the right to request that we restrict the processing of your personal information in certain situations, such as when you contest the accuracy of the data or when the processing is unlawful but you do not want the data deleted.

8.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, machine-readable format and to request that we transmit it directly to another controller where technically feasible.

8.6 Right to Object

You have the right to object to processing of your personal information for direct marketing purposes at any time. You may also object to processing based on our legitimate interests, unless we demonstrate compelling legitimate grounds that override your interests.

8.7 Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

8.8 Right to Lodge a Complaint

If you believe we have violated your data protection rights, you have the right to lodge a complaint with a supervisory authority in your country or region. We encourage you to contact us first so we can attempt to resolve your concern directly.

8.9 How to Exercise Your Rights

To exercise any of the rights described above, please contact us using the information provided in Section 14 of this policy. We will respond to your request within the timeframe required by applicable law (typically 30 days). We may need to verify your identity before processing your request, and we may request additional information to confirm your identity.

09 Cookies and Tracking Technologies

Our website uses cookies, web beacons, and similar tracking technologies to enhance your browsing experience, analyze website traffic, and serve personalized content and advertisements.

9.1 What Are Cookies?

Cookies are small text files that are stored on your device (computer, tablet, or mobile phone) when you visit a website. They allow the website to recognize your device, remember your preferences, and provide a more personalized experience. Cookies may be set by the website you visit ("first-party cookies") or by third parties such as analytics and advertising providers ("third-party cookies").

9.2 Types of Cookies We Use

• Essential / Strictly Necessary Cookies: These cookies are required for the basic functioning of our website. They enable core features such as security, network management, and account authentication. Without these cookies, our website cannot function properly. No consent is required for these cookies.
• Functional / Preference Cookies: These cookies remember your preferences and choices (such as language, currency, or region) to provide a more convenient and personalized experience. They may also remember changes you have made to text size, fonts, and other customizable parts of the website.
• Analytics / Performance Cookies: These cookies collect information about how visitors use our website, including which pages are visited most often, how users navigate the site, and whether they encounter error messages. The data collected is aggregated and anonymized, and is used solely to improve the performance and usability of our website.
• Advertising / Targeting Cookies: These cookies are used to deliver advertisements that are more relevant to you and your interests. They also limit the number of times you see an ad and help measure the effectiveness of advertising campaigns. These cookies may be placed by our advertising partners through our website.
• Social Media Cookies: These cookies are set by social media platforms (such as WeChat, Weibo, Facebook, Twitter, or LinkedIn) when you use their sharing features on our website. They may track your browsing activity across websites and build a profile of your interests.

9.3 Cookie Duration

• Session cookies: Temporary cookies that expire when you close your browser;
• Persistent cookies: Cookies that remain on your device for a specified period or until you manually delete them.

9.4 Managing Cookies

You can control and manage cookies in several ways. Most web browsers allow you to view, block, or delete cookies through the browser settings. Please note that if you disable or reject cookies, some features and functionality of our website may be impaired or unavailable.

• Browser settings: You can configure your browser to accept all cookies, reject all cookies, or notify you when a cookie is set. Each browser (Chrome, Firefox, Safari, Edge, etc.) has different cookie management procedures;
• Cookie consent tool: When you first visit our website, we display a cookie consent banner that allows you to accept or decline non-essential cookies. You can change your preferences at any time through the cookie settings panel;
• Opt-out platforms: For advertising cookies, you can opt out through industry opt-out platforms such as the Network Advertising Initiative (NAI) or the Digital Advertising Alliance (DAA).

9.5 Do Not Track

Some browsers have a "Do Not Track" (DNT) feature that signals to websites that you do not want your online activities tracked. Our website does not currently respond to DNT signals as there is no consistent industry standard for interpreting them. We will reassess this practice as standards evolve.

10 Third-Party Services and Links

Our website and services may contain links to third-party websites, applications, plugins, and services that are not owned or controlled by us. This includes links to social media platforms, payment gateways, content delivery networks, and advertising partners.

10.1 Third-Party Links

We provide links to third-party websites for your convenience and information. When you click on a third-party link, you will leave our website and be directed to a website over which we have no control. We are not responsible for the privacy practices or content of such third-party websites. We encourage you to review the privacy policies of any third-party services you use.

10.2 Third-Party Services Integrated Into Our Platform

We integrate certain third-party services into our platform to enhance functionality. These may include:

• Social media login: If you choose to log in via a social media account (e.g., WeChat, QQ, Google, Facebook), that platform will share certain information with us as governed by their privacy policy;
• Payment gateways: When you make a payment, you will be redirected to a third-party payment page. Those processors are independent data controllers and their privacy policies govern how they handle your payment data;
• Mapping services: Embedded maps from providers such as Google Maps, Baidu Maps, or Amap may collect your location data and usage information;
• Video and media players: Embedded content from platforms like YouTube, Youku, or Vimeo may set cookies and collect viewing data in accordance with their own privacy policies.

10.3 Social Media Features

Our website may include social media features, such as the "Share" button or interactive mini-programs. These features may collect your IP address and which page you are visiting on our site, and may set a cookie to enable the feature to function properly. Your interactions with these features are governed by the privacy policy of the company providing the feature.

10.4 No Endorsement

Inclusion of any third-party link or service does not imply endorsement or approval by Yunnan Nutingnuan Network Technology Co., Ltd. We encourage you to be aware when you leave our website and to read the privacy policies of each and every website you visit.

11 Children's Privacy

Our services are not directed to individuals under the age of 18 (or the age of majority in their jurisdiction). We do not knowingly collect personal information from children without verifiable parental consent.

11.1 Policy Regarding Minors

In compliance with applicable laws, including the Children's Online Privacy Protection Act (COPPA) in the United States and similar regulations in other jurisdictions, we implement the following protections:

• We do not knowingly collect, use, or disclose personal information from children under 13 years of age without obtaining verifiable parental consent;
• We do not condition a child's participation in any activity on the disclosure of more personal information than is reasonably necessary;
• We provide parents with the ability to review the personal information we have collected from their child, request deletion, and refuse further collection or use;
• Users under the age of 18 may require parental or guardian consent to use certain features of our services.

11.2 What to Do If We Learn of Unauthorized Collection

If we become aware that we have inadvertently collected personal information from a child without appropriate consent, we will take prompt steps to delete that information from our systems. If you believe that a child may have provided us with personal information without parental consent, please contact us immediately using the information in Section 14 so we can investigate and take appropriate action.

11.3 Parental Rights

Parents or legal guardians have the right to:

• Review the personal information we have collected from their child;
• Request deletion of their child's personal information;
• Refuse to allow further collection or use of their child's information;
• Withdraw any previously provided consent.

To exercise these rights, please contact us at support@nutingnuan.shop with the subject line "Children's Privacy Inquiry."

12 International Data Transfers

As a company operating in China with users and customers around the world, we may transfer your personal information to countries other than your country of residence. This section explains how we handle international data transfers in compliance with applicable data protection laws.

12.1 Where We Store and Process Data

Our servers and primary data processing facilities are located in the People's Republic of China. We may also engage service providers and cloud infrastructure located in other jurisdictions, including but not limited to Singapore, the United States, Japan, and the European Union, for purposes such as data backup, content delivery, and analytics.

12.2 Transfer Safeguards

When we transfer personal information from the European Economic Area (EEA), Switzerland, the United Kingdom, or other jurisdictions with strict data protection laws to countries that have not been deemed to provide an adequate level of data protection, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission or relevant authorities;
• Binding Corporate Rules (BCRs) where applicable for intra-group transfers;
• Data Processing Agreements (DPAs) with our service providers that include data transfer and protection provisions;
• Supplementary measures such as encryption, pseudonymization, and access controls to ensure an equivalent level of protection.

12.3 Cross-Border Data Transfer Under Chinese Law

In compliance with the Personal Information Protection Law (PIPL) of the People's Republic of China, we undertake the following measures when transferring personal information outside of China:

• Conducting a personal information protection impact assessment before any cross-border transfer;
• Obtaining your separate consent for the cross-border transfer of your personal information, where required by law;
• Entering into a legally binding contract with the overseas recipient specifying the purpose and method of processing, the types of data transferred, and the measures for protecting the data;
• Informing you of the name and contact information of the overseas recipient, the purpose and method of processing, the types of personal information transferred, and the methods and procedures for exercising your rights against the overseas recipient;
• Complying with any security assessment, certification, or standard contract requirements mandated by the Cyberspace Administration of China (CAC).

12.4 Your Consent

By using our services and providing your personal information, you acknowledge and agree that we may transfer your data to countries outside your country of residence in accordance with this Privacy Policy and applicable law. If you have any questions or concerns about international data transfers, please contact us.

13 Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal obligations, or the regulatory environment. When we make material changes, we will take appropriate steps to notify you.

13.1 Notification of Changes

• Website notice: We will post the updated Privacy Policy on this page with a revised "Effective Date" at the top;
• Email notification: For material changes that significantly affect your rights or how we handle your data, we will send an email notification to the primary email address associated with your account (if you have one);
• In-app notification: For users of our mobile applications, we may display a notification within the app requesting you to review the updated policy.

13.2 What Constitutes a Material Change

Examples of material changes include, but are not limited to:

• Changes in the types of personal information we collect;
• Changes in how we use or share your information;
• Changes in our data retention practices;
• Changes in the third parties with whom we share data;
• Changes in your rights under this policy;
• Changes in our legal basis for processing personal information.

13.3 Your Continued Use

Your continued use of our services after the effective date of any updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with the updated policy, you should stop using our services and contact us to exercise your rights regarding your personal information. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

13.4 Previous Versions

We will maintain an archive of previous versions of this Privacy Policy for your reference. If you would like to access a previous version, please contact us and we will provide it to you.

14 Contact Information

If you have any questions, concerns, complaints, or requests regarding this Privacy Policy or our data handling practices, please do not hesitate to contact us. We are committed to addressing your inquiries promptly and transparently.

14.1 Data Controller

The entity responsible for the collection and processing of your personal information under this Privacy Policy is:

14.2 Data Protection Officer (DPO)

We have appointed a Data Protection Officer to oversee compliance with data protection laws and this Privacy Policy. You can reach our DPO directly by email at support@nutingnuan.shop with the subject line "FAO: Data Protection Officer."

14.3 Response Time

We will acknowledge receipt of your privacy-related inquiry within 3 business days and will respond substantively within 30 calendar days. If we need additional time to process your request due to complexity or volume, we will inform you of the reason for the delay and the expected response timeframe, which will not exceed 60 calendar days from the date of your original request.

14.4 Complaints

If you are unsatisfied with our response to your privacy inquiry or complaint, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. For users in the European Economic Area, you may contact your local data protection authority. For users in China, you may contact the Cyberspace Administration of China (CAC) or relevant local authorities.

We value your trust and will work diligently to resolve any concerns you may have regarding your privacy and data protection.