Privacy policy & cookie notice

1. Who is responsible for your data

The data controller is POBXBX, No. 24 Huandao Road, Humen Town, Dongguan, Guangdong 523900, China. For any privacy question, including data subject requests, write to [email protected]. We respond to requests within 30 days.

2. What we collect and why

Data	Why we need it	Legal basis
Name, delivery address, email address, phone number	To process, dispatch and deliver your order and to send order and dispatch confirmations	Performance of a contract
Payment confirmation data (transaction ID, last four digits, billing country). We never receive or store full card numbers	To take payment, prevent fraud and handle refunds	Performance of a contract; legitimate interests
Order history and return history	To handle returns, exchanges, repairs and warranty claims	Performance of a contract; legal obligation
Email address, if you opt in to marketing	To send newsletters about new arrivals, restocks and offers	Consent (withdrawable at any time)
Device, browser and page-view data, IP address	To run the shop securely, measure aggregate traffic and fix errors	Legitimate interests; consent for non-essential cookies
Correspondence with customer care	To answer your enquiry and keep a record of the resolution	Legitimate interests

We do not sell your personal data, and we do not use it to make automated decisions that produce legal effects for you.

3. How long we keep data

• Order and invoice records: seven years, to meet tax and accounting obligations.
• Customer care correspondence: three years from the last contact.
• Marketing consent records: until you unsubscribe, plus six months as proof of consent.
• Server and analytics logs: 26 months, in aggregated form where possible.
• Abandoned-cart data: 30 days, unless you complete the order.

4. Who we share data with

We share the minimum necessary with the following categories of processors, each bound by a data processing agreement:

• Payment providers — bank transfer and PayPal, which we arrange with you over WhatsApp. Card and wallet payments are handled entirely inside PayPal's PCI-DSS compliant environment; this website never collects card details.
• Carriers — tracked postal services, DHL Express and FedEx, to deliver your parcel and provide tracking.
• Hosting and infrastructure — a static hosting provider and a content delivery network that serve this website.
• Email and customer support tools — to send transactional and, with your consent, marketing email, and to manage support tickets.

Some processors are located outside the European Economic Area. Where that is the case we rely on the European Commission's Standard Contractual Clauses, plus additional technical measures such as encryption in transit.

5. Cookies and local storage

This site uses a very small amount of browser storage. The following is stored locally in your browser only and is never transmitted to us:

Name	Type	Purpose	Duration
pobxbx_currency_v1	Local storage	Remembers your USD or EUR choice	Until you clear it
Cookies	—	This site sets no cookies of its own and runs no analytics, advertising or payment trackers	—

Delete the local storage entry above at any time from your browser settings — your currency choice will simply be forgotten. If we later add analytics or a mailing list, a cookie consent banner that blocks non-essential scripts until the visitor agrees will be added first, and this table will be updated.

6. Security

The site is served over TLS (HTTPS) and forces encrypted connections. Orders are taken over WhatsApp: message content is visible only to the person handling that chat and to WhatsApp itself, under WhatsApp's own terms. No card or bank details are ever collected on this website — payment is arranged separately with you in the chat. We keep encrypted backups and review access quarterly. No system is perfectly secure, but we notify affected individuals and supervisory authorities of a personal data breach where the law requires it.

7. Your rights

Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data deleted ("right to be forgotten"), subject to our legal record-keeping duties.
• Restrict or object to certain processing, including direct marketing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent for marketing at any time, using the unsubscribe link in any email.
• Lodge a complaint with your local supervisory authority. EU and UK residents can complain to the authority in their country of residence; California residents have additional rights under the CCPA/CPRA, including the right to opt out of the sale or sharing of personal information — we do not sell personal information.

To exercise any of these rights, email [email protected] with enough detail for us to identify your order. We may ask for proof of identity to protect your data. There is no charge unless a request is manifestly unfounded or repetitive.

8. Children

This shop is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with data, contact us and we will delete it.

9. Changes to this notice

We may update this notice to reflect changes in our practices or the law. The "last updated" date at the top will always reflect the current version, and material changes affecting existing customers will be communicated by email.

10. Contact

• Privacy requests[email protected]
• Customer care[email protected]
• PostalPOBXBX, No. 24 Huandao Road, Humen Town, Dongguan, Guangdong 523900, China