Privacy Policy

A visit to Kirmelo creates different kinds of information for different reasons. The details needed to deliver a parcel are not the same as those used to keep a shopping cart working, and a message to customer support is different again. This notice distinguishes those activities so you can see what information is involved, why it is needed, and how to ask questions or exercise privacy rights.

Data Controller

For decisions about personal information used in operating this online store, the data controller is:

Data Controller: Hubei Xiuhuaxian Trading Co., Ltd.
Unified Social Credit Code (USCC): 91420302MAKF4BJD67
Registered Address: Building 7 (1-5)-1-A1, No. 23 Dongfeng Avenue, Dongcheng Development Zone, Maojian District, Shiyan, Hubei Province
Privacy Email: service@kirmelo.com
Contact Phone: +86 15592748316
Business Hours: Monday to Friday: 9:00 AM - 5:00 PM (UTC+8, China Standard Time)

This notice applies to https://kirmelo.com and customer communications with Kirmelo. Some payment, shipping or technology providers may determine the purposes of particular processing they perform independently; their own notices describe those separate responsibilities.

1. Information That Enters an Order Record

An order creates a record linking the goods purchased to a purchaser and a delivery destination. The information involved may include your name, shipping and billing addresses, email address, phone number, selected items, order value, payment status, transaction reference, fulfillment progress, tracking updates and any refund or dispute history. Some details are entered by you at checkout; subsequent records may arrive from a payment service, delivery provider or our order-processing systems.

We use these records to assess and fulfill the purchase, communicate changes, handle delivery and refund questions, reconcile transactions, and keep records required by law. We do not ask customers to send full payment-card information to our support email. Payment credentials submitted at checkout are handled through the payment functionality available for the transaction and its relevant providers.

2. Information You Give Outside Checkout

You may tell us something in an email, telephone conversation, return request, or other customer-service communication. We receive the contact details and content you choose to supply, together with relevant attachments such as photographs of a damaged product. We use these details to understand the request, verify that we are addressing the correct order, respond, and document a resolution where appropriate. Please avoid including passwords, full bank card numbers, or unrelated sensitive information in your messages.

If the store offers an account function, account information can also include login identifiers, account preferences and order history. Only the functions actually made available to you are relevant to your visit.

3. Information Generated While the Site Works

When a device connects to the store, web systems may record technical signals such as IP address, browser and device characteristics, general network-derived location, requested pages, time of access, referral source, and security or error events. Cart identifiers and other local browser storage can help maintain the continuity of a shopping session. These records can be used for site delivery, troubleshooting, security and preventing misuse, with additional uses subject to applicable privacy requirements.

Not every category of browser information identifies you by name. Some records may nevertheless qualify as personal information when they can reasonably be linked to an individual or device, and we treat them accordingly under applicable law.

4. Purposes and Legal Reasons

The reason for using information depends on the activity:

• Purchase and fulfillment: to receive an order, confirm its status, deliver goods and address payment or return issues. Where applicable, this relies on performing a contract or taking steps requested before one is made.
• Service correspondence: to answer questions, investigate reported problems and maintain necessary service records. Contractual necessity or an appropriately balanced legitimate interest may apply, depending on the request.
• Compliance and recordkeeping: to meet tax, accounting, legal disclosure and dispute-resolution duties. The applicable basis may be a legal obligation or another basis permitted by law.
• Fraud prevention and technical protection: to detect abuse, protect transactions and maintain a functioning store. This may rely on a legitimate interest assessed against individuals' rights or another lawful ground.
• Optional communications and technologies: marketing messages or non-essential tracking, when used, are handled on the consent or other lawful basis required in the relevant region.

Where a law requires us to identify a legal basis, we apply the basis appropriate to that purpose rather than treating every activity as consent-based. Consent, where relied upon, can be withdrawn for future processing without invalidating what was lawfully done before withdrawal.

5. The Parties Involved in Providing the Store

Kirmelo is delivered using Shopify commerce technology. In carrying out an order, information can be made available to the service providers relevant to that activity, including payment and checkout services, shipment and delivery providers, technical hosting or support providers, and professional advisers when necessary. A lawful request from a competent authority may also require disclosure. We limit disclosures according to the role involved and the obligations that apply.

Some providers act under our instructions; others may have separate legal purposes and responsibilities. For Shopify's own consumer-facing processing and rights information, consult the Shopify Consumer Privacy Policy. The identity of any other recipient depends on the payment, shipping and optional services actually used for an order.

6. Browser Controls, Cookies and Similar Storage

A browser can store small pieces of information that support site functions, including maintaining a cart, preserving a session or protecting a checkout. Additional technologies may be used for measurement, personalization or marketing where those functions are active. Whether a technology is essential and what permissions it requires depend on its purpose and the laws applicable to the visitor.

Your browser usually offers settings to delete or restrict cookies. Restricting storage can interrupt functions that rely on it. Where consent is legally required for non-essential technologies, the appropriate consent and preference mechanism should allow you to make the required choice. When a cookie-choice control is provided on the site, you can use it to change applicable preferences; you can also write to our privacy email with questions about the choices available to you.

7. Promotional Contact and Advertising Rights

If you request or agree to receive promotional messages, your contact details and preference may be used to send them according to applicable law. You may ask to stop promotional emails using the unsubscribe method supplied with the message, where offered, or by contacting us. Messages needed for a purchase or customer-service case may still be sent.

Certain laws give residents a right to opt out of the sale or sharing of personal information, or of processing used for targeted advertising. Where these rights apply to an activity involving the store, you may submit a request to service@kirmelo.com and use any applicable privacy-choice feature made available on the site. Browser-based preference signals, including Global Privacy Control where legally recognized, are handled according to applicable law.

8. Where Information May Be Processed

Our operating company is based in China, and the technology and delivery activities involved in online commerce can span several countries. Personal information may be transmitted to or processed in a country other than the one where you live. Data-protection standards and public-authority access rules can differ by jurisdiction. Where a specific cross-border transfer safeguard or legal mechanism is required, that requirement applies to the transfer.

9. How Long Different Records Matter

An unfinished browsing session may need information for only a limited operational period; an order, by contrast, can lead to records needed for fulfillment, returns, accounting or dispute handling. Customer messages may be retained while an issue is open and for an appropriate subsequent recordkeeping period. A marketing opt-out preference may need to be kept so that the choice is respected. Retention is based on the relevant purpose, mandatory legal periods and any legitimate ongoing need; information is then deleted or de-identified when appropriate.

10. Safeguards and Limits of Online Security

We seek to use reasonable administrative and technical measures appropriate to the information handled and the risks involved, including access controls and the use of service providers with relevant security responsibilities. Internet transmission and electronic storage are not completely risk-free. If you suspect that an order, account or message has been accessed improperly, contact us without disclosing your password.

11. Making a Privacy Request

Depending on your location, applicable legislation may allow you to ask for access to personal information, correction of inaccurate details, deletion, restriction or objection to processing, a portable copy, or information about disclosure. You may also have specific rights concerning advertising uses, consent withdrawal, appeals or complaints to a regulator.

Send your request to service@kirmelo.com and tell us what you would like to exercise. We may request reasonable information to establish that the request comes from the right person or an authorized representative. We will respond within legally required periods, explain any legally permitted limitation, and honor non-discrimination protections where they apply. Requests involving Shopify's independent processing may also be directed through Shopify's privacy resources.

12. Children, External Pages and Policy Revisions

This general retail website is not aimed at children who cannot lawfully use the service or provide the relevant information without required consent. If you believe information from a child was obtained contrary to applicable law, notify us. A link to an external website leads to an independently operated service, whose privacy notice should be reviewed separately.

We may revise this Privacy Policy as our actual practices or legal requirements change. The updated text will be made available through the site. Where the law requires a separate notice or permission for a material change, we will follow that requirement. Questions about this notice or the processing of your personal information can be sent to the Data Controller contact details above.