Privacy Policy

1. Introduction

This Privacy Policy describes how Shenzhen Zhenshijie Consulting Management Co., Ltd. (“we”, “us”, “our”) collects, uses, and protects the personal data of users (“you”) who visit and place orders on zoralshop.com (the “Website”). We are committed to protecting your privacy in accordance with Regulation (EU) 2016/679 (GDPR), which applies to the processing of personal data of individuals located in the European Economic Area (EEA), regardless of where the data controller is established.

2. Data We Collect

When you interact with our Website or place an order, we may collect the following personal data:

• Identity data: first name, last name.
• Contact data: email address, phone number.
• Delivery data: shipping address, country, postal code.
• Order data: products purchased, order value, order date, payment method (Cash on Delivery).
• Technical data: IP address, browser type, operating system, pages visited, referring URL, time and date of visit.
• Communication data: any messages you send us via email or contact forms.

We do not collect payment card data. All orders are fulfilled via Cash on Delivery (COD); no financial data is processed through our Website.

3. Legal Basis for Processing

4. How We Use Your Data

• To process and deliver your orders.
• To communicate order status, updates, and notifications.
• To respond to your inquiries and provide customer support.
• To comply with applicable legal and tax obligations.
• To detect and prevent fraud.
• To analyse Website usage and improve our services.
• To send promotional communications where you have given consent.

5. Data Sharing and Recipients

• Logistics and courier partners: to fulfil and deliver your orders.
• IT service providers: hosting, email, website infrastructure.
• Analytics platforms: for Website traffic analysis (e.g. Google Analytics).
• Advertising platforms: Meta Platforms, TikTok, for advertising purposes where applicable.
• Legal and regulatory authorities: when required by law.

We do not sell your personal data to third parties. All data processors are bound by appropriate data processing agreements.

6. International Data Transfers

As our company is established in the People’s Republic of China, your personal data will be transferred to and processed in China. Such transfers are carried out on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate safeguards pursuant to GDPR Chapter V, to ensure your data receives an adequate level of protection equivalent to that guaranteed within the EEA.

Additional transfers to other third-country service providers (e.g. Google, Meta) are equally governed by Standard Contractual Clauses or adequacy decisions where applicable.

7. Data Retention

• Order and transaction data: 5 years from the date of the transaction.
• Customer support communications: 2 years from resolution.
• Marketing data: until you withdraw consent or unsubscribe.
• Website analytics data: up to 26 months.

8. Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

• Right of access: to obtain a copy of your personal data we hold.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure: to request deletion of your data where no legal obligation requires retention.
• Right to restriction: to limit the processing of your data in certain circumstances.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at info@zoralshop.com. We will respond within 30 days. You also have the right to lodge a complaint with the supervisory authority of your country of residence within the EEA. A full list of EU data protection authorities is available at edpb.europa.eu.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with GDPR Article 32.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be published on this page with a revised effective date.

11. Contact