Scope of Application

Purpose of Collection and Processing of Personal Data

1. Types of Personal Data Collected

Depending on the business scenario, we may collect personal data including but not limited to name, contact information (email, phone number, address), payment information, order information, delivery information, product preferences, website browsing history, and cookie data. Sensitive personal data (such as race, religion, and health information) will never be collected unless we obtain your explicit consent and there is a legitimate business need.

2. Core Processing Purpose and Legal Basis

• (1) Fulfilling Contractual Obligations: To provide you with services such as the sale and delivery of bag products, we process your order information, delivery information, and payment information. The legal basis is "fulfilling contractual obligations to the data subject."
• (2) Obtaining Explicit Consent: To push information on new bag products, promotional activities, design news, and other marketing content to you, or to obtain your feedback on product design, we will obtain your explicit consent in advance, and you have the right to withdraw your consent at any time. The legal basis is "data subject consent."
• (3) Compliance with Legal Obligations: To meet legal requirements such as tax declaration, financial auditing, and product quality traceability, necessary transaction records and personal data are retained. The legal basis for this is "compliance with legal obligations."
• (4) Pursuit of Legitimate Interests: Data is processed for legitimate business purposes such as optimizing the user experience of the official website, improving the rationality of product design, and preventing commercial fraud, and will not harm your legitimate rights and interests. The legal basis for this is "the legitimate interests of the data controller."

Restrictions on the Use and Sharing of Personal Data

1. Data Use Restrictions

We strictly use personal data in accordance with the purposes stated in this policy. Without your explicit consent or legal permission, we will never use personal data for any purpose unrelated to the established purpose. If the purpose of data processing needs to be changed due to business development, we will inform you in advance and explain the reasons for the change to ensure that the changed processing purpose complies with GDPR requirements.

2. Data Sharing Restrictions

We promise not to sell or rent your personal data to any unrelated third party. Data will be shared with relevant parties only under the following specific circumstances, after strict review:

• (1) As required to fulfill contractual obligations: such as sharing receiving information with third-party logistics providers to complete product delivery, or sharing necessary payment information with payment institutions to complete transaction settlement;
• (2) With your explicit consent: such as sharing relevant design or order data with your designated partners at your request;
• (3) To comply with legal or regulatory requirements: such as providing relevant data as legally required by EU and member state regulatory agencies or judicial authorities;
• (4) To protect the legitimate rights and interests of all parties: such as necessary sharing to prevent fraud, safeguard the company's legitimate rights and interests, or protect the personal and property safety of you and others.

For all data sharing recipients, we will clarify their data protection obligations through data processing agreements, require them to take sufficient security measures, and supervise their data processing activities.

Storage and Cross-border Transfer of Personal Data

1. Storage Period

We adhere to the "storage limitation" principle and will only store your personal data for the shortest period necessary to achieve the data processing purpose. Upon expiration of the storage period, we will promptly process the relevant data through anonymization, deletion, or other methods, unless required by law or to protect legitimate rights.

2. Storage Security

We employ technical and managerial security measures compliant with GDPR requirements, including data encryption, access control, security audits, and contingency plans, to prevent unauthorized access, theft, alteration, or disclosure of personal data. We also regularly assess and upgrade our security measures to ensure their effectiveness.

3. Cross-border Transfers

If your personal data needs to be transferred outside the EU (including Xylon's non-EU branches or partners), we will strictly comply with GDPR cross-border transfer rules to ensure that the transfer process meets data protection requirements. Specific measures include, but are not limited to: transferring to countries or regions deemed by the European Commission to have an "adequacy protection level"; signing EU Standard Contractual Clauses (SCCs) with the recipient; implementing supplementary security measures such as encryption and anonymization; or obtaining your explicit consent (if applicable).

Core Rights of Data Subjects

Use of Cookies and Similar Technologies

Data Breach Notification

Policy Updates and Notifications

Contact Information