This policy explains what personal data LUYUN Tea 麓云茶号 (“LUYUN Tea”, “we”, “us”) collects when you use this website, why we collect it, and what rights you have over it.
We are the data controller for the personal data described here. Our contact for all privacy matters is [email protected].
What we collect
Information you give us
- Order data — name, email address, delivery address, phone number (optional), and the contents of your order. Required to fulfil a contract with you.
- Account data — email address and password, if you create an account. Optional; you can check out as a guest.
- Payment data — we never see or store your full card number. Card details go directly to our payment processors.
- Marketing data — your email address, if you tick the newsletter box at checkout or subscribe separately.
Information collected automatically
- Device and usage data — IP address, browser type and version, operating system, pages viewed, and how you reached us. Collected via cookies and similar technologies.
- Order and session data — your cart contents and checkout progress, so that an interrupted purchase can be resumed.
We do not collect special-category data, and we do not knowingly collect data from anyone under 16.
Why we use it, and our legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Taking payment and delivering your order | Order data, payment data | Performance of a contract |
| Sending order confirmations and shipping updates | Order data, email address | Performance of a contract |
| Handling returns, refunds and support requests | Order data, correspondence | Performance of a contract |
| Preventing fraud and card abuse | Order data, device data, IP address | Legitimate interests |
| Meeting tax, accounting and customs obligations | Order data | Legal obligation |
| Sending marketing email you asked for | Email address, order history | Consent (withdrawable at any time) |
| Measuring and improving the site | Usage data | Consent, or legitimate interests where permitted |
We do not use your data for automated decision-making that produces legal effects, and we do not build advertising profiles of you across other websites.
Who we share it with
We share personal data only with the service providers needed to run the shop. Each is bound by a data-processing agreement and may use your data only on our instructions.
| Provider | Role | Data shared |
|---|---|---|
| Stripe | Card payment processing | Name, email, billing address, order total |
| PayPal | Alternative payment processing | Name, email, delivery address, order total |
| [Carrier — e.g. DHL / 4PX] | Delivery | Name, delivery address, phone, parcel contents value |
| Klaviyo | Marketing email and order notifications | Email address, first name, order history |
| Cloudflare | CDN, WAF, bot protection | IP address, request metadata |
| Google Analytics 4 | Aggregate usage measurement | Pseudonymised usage data |
| [Hosting provider] | Site hosting and database | All data stored on the site |
| [Accountant / tax adviser] | Statutory accounting | Order and invoice data |
We never sell your personal data, and we do not share it with advertisers or data brokers.
We may disclose data where we are legally required to — for example in response to a valid court order or a customs query.
International transfers
We are based in China and use service providers in the United States and the European Union. When personal data leaves the EEA or the UK, we rely on Standard Contractual Clauses approved by the European Commission, together with a transfer-risk assessment, to ensure an equivalent level of protection.
You can request a copy of the safeguards we rely on by writing to [email protected].
How long we keep it
| Data | Retention |
|---|---|
| Order and invoice records | 7 years (tax and accounting obligation) |
| Account data | Until you delete your account, then 30 days |
| Support correspondence | 3 years from last contact |
| Marketing consent records | Until you unsubscribe, then 3 years as proof of consent |
| Analytics data | 14 months |
| Abandoned carts | 6 months |
When a retention period ends, we delete the data or irreversibly anonymise it.
Your rights
Depending on where you live, you may have some or all of the following rights:
- Access — get a copy of the personal data we hold about you.
- Rectification — correct data that is wrong or incomplete.
- Erasure — ask us to delete your data, where no legal obligation requires us to keep it.
- Restriction — ask us to stop processing your data while a dispute is resolved.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests, including profiling.
- Withdraw consent — unsubscribe from marketing at any time, using the link in any email or by writing to us.
- Non-discrimination (CCPA/CPRA) — California residents will not receive a lesser service for exercising privacy rights.
To exercise any of these, email [email protected]. We respond within 30 days and may ask you to verify your identity first. If you are unhappy with our response, you have the right to complain to your local supervisory authority.
Security
We protect your data with TLS encryption in transit, encryption at rest on our hosting provider, role-based access controls, two-factor authentication on all administrative accounts, and daily encrypted off-site backups. Payment card data never touches our servers.
No system is perfectly secure. If a breach affects your rights, we will notify you and the relevant authority without undue delay.
Cookies
We use cookies and similar technologies for the purposes described in our Cookie Policy. You can manage your preferences at any time using the cookie banner or the link in the site footer.
Changes to this policy
When we make a material change we update the “Last updated” date at the top of this page and, where the change affects how we use your data, notify subscribers by email. Continuing to use the site after a change means you accept the updated policy.
Contact
Data controller: LUYUN Tea 麓云茶号 Email: [email protected] Post: [Street address, Fuzhou, Fujian, China] EU representative (GDPR Art. 27): [Name and address, to be appointed before EU launch]