Privacy policy

Effective date: 2026-11-01

1. Welcome to Kongshan

Welcome to Kongshan. This Privacy Policy explains what personal information we collect when you visit kongshan.shop or interact with us, how we use it, who we share it with, how long we keep it, and what rights you have over your data.

We believe in handling your data with the same care we bring to every order — with transparency and respect.

Who we are. Kongshan ("we," "us," or "our") is operated by 昆明山穹文化创意有限责任公司 (Kunming Shan Qiong Cultural and Creative Co., Ltd.), a company registered in the People's Republic of China and trading under the brand name Kongshan, with its registered address in Kunming, Yunnan 650000, China. For data protection purposes, 昆明山穹文化创意有限责任公司 (Kunming Shan Qiong Cultural and Creative Co., Ltd.) is the data controller.

Contact for privacy questions. Email us at hello@kongshan.shop for any privacy-related request, including access, correction, deletion, or opt-out. We respond within the timeframes required by applicable law (typically 30 days for GDPR requests, 45 days for CCPA requests, 15 working days for PIPL requests).

This Policy applies to: kongshan.shop, our marketing emails, our customer support channels, and any other service we operate that links to this Policy.

2. Information We Collect

We collect only the personal information we need to run Kongshan, fulfill your orders, communicate with you, and meet our legal obligations. We do not collect what we do not use.

What we collect When we collect it Why we collect it Legal basis (GDPR)
Name At checkout Ship your order; contact you about it Contract
Email address At checkout or newsletter signup Order confirmations, shipping updates, marketing (with consent) Contract + Consent
Shipping address At checkout Deliver your order Contract
Billing address At checkout Process payment; tax compliance Contract + Legal obligation
Phone number At checkout (optional) Shipping carrier delivery updates Contract
Payment information (card type, last 4 digits, billing country) At checkout Process payment Contract (full card numbers handled by our payment processor and never stored by us)
Account login (email + password) If you create an account Order history, faster checkout Contract
IP address Automatically when you visit Site security, fraud detection Legitimate interest
Browser and device type Automatically Site optimization Legitimate interest
Pages viewed and clicks Automatically Understand which products interest you Legitimate interest (analytics)
Order history After each purchase Customer support, returns Contract
Customer support messages When you contact us Resolve your inquiry Contract + Legitimate interest
Product reviews When you submit one Display to other shoppers (with consent) Consent
Photos you share with us When you submit them for review or social media Marketing (with consent) Consent

We do not collect: government ID numbers, Social Security numbers, biometric data, health data, or any special category data under GDPR Art 9.

3. How We Use Your Information

We use your personal information only for the purposes stated above. Specifically:

  • To process and fulfill your orders — including payment, packaging, shipping, and delivery confirmation
  • To communicate with you about your order, our products, and customer support inquiries
  • To send marketing communications (only if you opted in) — newsletter, new product announcements, occasional offers
  • To improve our website and products — understanding which products and pages are most popular
  • To prevent fraud and protect our customers — detecting suspicious orders, protecting against unauthorized account access
  • To comply with legal obligations — tax records, responding to lawful requests from authorities
  • To enforce our Terms of Service — investigating violations, protecting our rights

We will never:

  • Sell your personal information to third parties
  • Share your email with spammers or unrelated marketers
  • Use your data in ways you would not reasonably expect
  • Make automated decisions about you that have legal or significant effects

4. Legal Basis for Processing (GDPR / UK GDPR)

If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data only when we have a valid legal basis under GDPR Article 6 or UK GDPR Article 6:

  1. Contract — to fulfill our agreement with you when you place an order (taking payment, shipping, returns, customer support)
  2. Legal obligation — to comply with tax, accounting, anti-fraud, and other legal requirements
  3. Consent — for marketing emails, non-essential cookies, and anything else where we ask for your explicit opt-in (you can withdraw consent at any time)
  4. Legitimate interests — for site security, fraud prevention, basic analytics, and customer support, where our interest is not overridden by your rights and freedoms
  5. Vital interests (rare) — to protect someone's life
  6. Public task — does not apply to Kongshan

If we ever rely on a different legal basis, we will tell you in advance.

5. Sharing & Disclosure

We share your personal information only as needed to run Kongshan and serve you.

5.1 Service providers (sub-processors)

Who What they do What they receive Where they operate Their Privacy Policy
Shopify Inc. E-commerce platform, hosting, checkout All order data you submit at checkout Canada, USA, EU shopify.com/legal/privacy
Shopify Payments (powered by Stripe / PayPal / Adyen, depending on your country) Payment processing Card details, billing address, amount USA, Ireland, EU stripe.com/privacy / paypal.com/privacy
Third-party fulfillment partner Order fulfillment: pick, pack, ship your order Name, shipping address, phone number, product list China (Under our data processing agreement; not publicly listed)
Cloudflare (or equivalent CDN) Site performance, security, DDoS protection IP address Global cloudflare.com/privacypolicy
Email service provider (e.g., Shopify Email) Sending order confirmations, shipping updates, optional marketing Email address, name USA, EU shopify.com/legal/privacy

We do not use any third-party advertising, analytics, or behavioral marketing tools (no Google Analytics, no Meta Pixel, no Klaviyo, no Tidio) as of the effective date of this Policy. If we add any of these in the future, we will update this Policy and notify you.

5.2 We do not sell your information

We do not sell, rent, or trade your personal information to third parties for money or anything else of value. We also do not "share" your personal information for cross-context behavioral advertising as that term is defined under California law.

5.3 Other situations when we share

  • Legal compliance — if we receive a valid court order, subpoena, or legal request from a government authority
  • Fraud investigation — if we reasonably suspect fraud or other illegal activity
  • Business transfers — if Kongshan is sold, merged, or substantially all of its assets are transferred (we will notify you)
  • With your consent — for any other purpose disclosed at the time of collection

6. International Data Transfers

Because we operate globally and use service providers in multiple countries, your personal information may be transferred to, stored, and processed in countries other than your own. Specifically:

  • Your order data is stored on Shopify's servers (Canada / USA)
  • Your payment data is processed by Shopify Payments sub-processors (USA, EU)
  • Your shipping data is sent to our third-party fulfillment partner in China for order fulfillment
  • Your IP address may be processed by our CDN provider (global)

When your data is transferred outside your home jurisdiction, we rely on the following safeguards:

  • For transfers from EU/UK/EEA to the US/Canada: Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914), and Shopify's Data Processing Addendum
  • For transfers to China (our fulfillment partner): SCCs + contract terms requiring our partner to protect your data to GDPR-equivalent standards, and only use it for the specific order you placed
  • For transfers from China to anywhere: PIPL Standard Contract or Personal Information Protection Certification

By using Kongshan, you acknowledge that your data may be transferred internationally. We take steps to ensure your data remains protected wherever it is processed.

7. Data Retention

We keep your personal information for as long as needed to provide our services and comply with our legal obligations. After that, we securely delete or anonymize it.

Type of data How long we keep it Why
Order records (name, address, items, payment record) 7 years from order date Tax, accounting, and consumer protection laws
Customer support messages 3 years from last contact Resolve disputes, improve service
Account profile (if you created one) Until you delete it + 30 days Account functionality
Marketing subscription Until you unsubscribe Honor your consent
Anonymized analytics (if any) 26 months Industry standard (Google Analytics default)
Cookie identifiers 12 months GDPR + Google Consent Mode v2 recommendation
Backup data Up to 90 days Disaster recovery

When the retention period ends, we delete the data from our active systems within 30 days and from backups within 90 days.

8. Your Rights

You have rights over your personal information. The rights available to you depend on where you live.

8.1 If you are in the EEA, UK, or Switzerland (GDPR / UK GDPR)

You have the right to:

  • Access — request a copy of the personal data we hold about you (Art 15)
  • Rectification — ask us to correct inaccurate or incomplete data (Art 16)
  • Erasure ("right to be forgotten") — ask us to delete your data, subject to certain exceptions (Art 17)
  • Restriction — ask us to limit how we process your data while we resolve a complaint (Art 18)
  • Portability — receive your data in a machine-readable format (Art 20)
  • Object — object to processing based on legitimate interests or for direct marketing (Art 21)
  • Withdraw consent — at any time, where processing is based on consent (Art 7(3))
  • Lodge a complaint with your local data protection authority (Art 77)

How to exercise these rights: Email hello@kongshan.shop with your request. We will respond within 30 days (extendable to 3 months for complex requests, with notice).

Local supervisory authorities:

8.2 If you are in California (CCPA / CPRA)

You have the right to:

  • Know — what personal information we have collected about you, the categories, sources, purposes, and third parties we share with (up to 2 requests per 12-month period)
  • Delete — request deletion of your personal information, subject to certain exceptions
  • Correct — request correction of inaccurate personal information
  • Opt out of sale or sharing — even though we do not sell or share your data, you can still exercise this right
  • Limit use of sensitive personal information — we do not collect sensitive PI
  • Non-discrimination — we will not penalize you for exercising your privacy rights

How to exercise these rights:

  • Email hello@kongshan.shop
  • Use the "Do Not Sell or Share My Personal Information" link in our website footer (when active)
  • Submit a request through the contact page on our website

Response time: We will acknowledge receipt within 10 business days and respond substantively within 45 days (extendable by 45 days with notice).

Authorized agents: You may designate an authorized agent to make a request on your behalf by submitting a signed written authorization. We may need to verify your identity directly with you.

8.3 If you are in mainland China (PIPL)

You have the right to:

  • Know how your personal information is processed (知情权)
  • Decide — control and decide how your personal information is processed (决定权)
  • Access and copy your personal information (查阅复制权)
  • Correct or supplement inaccurate or incomplete data (更正补充权)
  • Delete your personal information in certain circumstances (删除权)
  • Withdraw consent at any time (撤回同意权)
  • Request explanation of our personal information processing rules (请求解释权)
  • Lodge a complaint with the Cyberspace Administration of China (投诉权)

Cross-border transfer: Your order data will be transferred from China to our Shopify/CDN systems outside China for fulfillment. By placing an order from mainland China, you consent to this cross-border transfer. We have executed Standard Contracts for cross-border personal information transfer where required.

Response time: We will respond within 15 working days.

8.4 Other jurisdictions

If you are in another jurisdiction with similar privacy rights (Canada, Australia, Brazil, Japan, etc.), you can email hello@kongshan.shop and we will work with you to honor your rights under your local law.

9. Cookies & Tracking

We use cookies and similar technologies to make kongshan.shop work, remember your preferences, and understand how you use the site.

Cookie type Examples Why we use it Your consent
Strictly necessary Session ID, cart contents, security token Make the site work, prevent fraud Not required (essential)
Functional Language preference, recently viewed products Remember your preferences Usually not required
Analytics (Currently none — see Section 5) Understand site usage Required (Consent Mode v2)
Marketing (Currently none — see Section 5) Targeted advertising, remarketing Required (explicit opt-in)

We do not currently use any third-party cookies for analytics or marketing. If you see any third-party cookies in your browser, please report them to hello@kongshan.shop.

Your choices: You can control cookies through your browser settings. Disabling certain cookies may affect site functionality. We respect "Do Not Track" signals to the extent required by law, but most browsers do not currently send DNT signals.

10. Data Security

We take the security of your personal information seriously. Our safeguards include:

  • Encryption in transit: All data exchanged between you and our site is encrypted using TLS 1.2 or higher
  • Encryption at rest: Sensitive data is encrypted in our service providers' databases
  • PCI DSS compliance: Our payment processor is PCI DSS Level 1 certified; full card numbers are never stored on Kongshan or Shopify servers
  • Access control: Only authorized personnel and service providers can access your data, and only on a need-to-know basis
  • Regular security reviews: We review our security practices and update them as threats evolve
  • Breach notification: If we learn of a data breach that affects your personal information, we will notify you and the relevant authorities within the timeframes required by law (typically 72 hours for GDPR, 60 days for some US states)

Despite our best efforts, no system is 100% secure. We cannot guarantee absolute security of your data. By using Kongshan, you accept this risk.

11. Children's Privacy

Kongshan is not directed to children under the age of 16 (in the EU) or 13 (in the US). We do not knowingly collect personal information from children.

If we learn we have collected personal information from a child without verifiable parental consent, we will delete it as soon as possible. If you believe a child has provided us with personal information, please contact hello@kongshan.shop and we will take immediate action.

12. Changes & Contact

12.1 Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. For material changes, we will:

  • Post a prominent notice on our website at least 14 days before the change takes effect
  • Send an email notification to subscribers (if you are on our marketing list)

Continued use of Kongshan after the effective date of any change constitutes your acceptance of the updated Policy.

12.2 How to contact us

For any privacy question, request, or complaint, please contact us:

  • Email (privacy): hello@kongshan.shop
  • Email (general): hello@kongshan.shop
  • Mail: 昆明山穹文化创意有限责任公司 (Kunming Shan Qiong Cultural and Creative Co., Ltd.) (trading as Kongshan), Kunming, Yunnan 650000, China
  • Manage your data choices: Your Privacy Choices

We aim to respond to all privacy requests within the timeframes required by applicable law.

12.3 How to lodge a complaint with a regulator

If you are unhappy with how we handle your data, you have the right to lodge a complaint with your local data protection authority. We would, however, appreciate the chance to address your concerns before you approach a regulator — please email us first.

Appendix: Version History

Version Date Changes
v1.0 2026-08-12 Initial Privacy Policy published
v1.1 2026-08-12 Generalized fulfillment partner references; removed specific supplier name from sub-processor table
v1.3 2026-11-01 Legal entity corrected to Kunming Shan Qiong Cultural and Creative Co., Ltd.; data-controller contact details updated

This Policy is governed by the laws of the People's Republic of China and applicable data protection laws (GDPR, UK GDPR, CCPA/CPRA, PIPL).

This Policy is issued by Kongshan and describes how personal data is handled for orders placed through this store.