Privacy Policy

Last Revised: October 1, 2025
Effective: October 1, 2025

Rongjin Era ("we", "us", "our", or the "Company") respects your privacy and is committed to protecting your personal information. This Privacy Policy describes how we collect, use, disclose, transfer, store, and otherwise process your personal information when you visit our website, create an account, make purchases, subscribe to communications, or otherwise interact with our services (collectively, the "Services"). By using our Services, you consent to the practices described in this Policy.

We process your personal information primarily in accordance with the Personal Information Protection Law of the People's Republic of China (PIPL). To serve our global users and mitigate legal risks, we also align with applicable international and local data protection laws, including but not limited to the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, the California Consumer Privacy Act (CCPA as amended by the CPRA), the South African Protection of Personal Information Act (POPIA), the Singapore Personal Data Protection Act (PDPA), the Japanese Act on the Protection of Personal Information (APPI), the Korean Personal Information Protection Act (PIPA), the Indian Digital Personal Data Protection Act (DPDP), the Thai Personal Data Protection Act (PDPA), the Indonesian Personal Data Protection Law, the Kenyan Data Protection Act, the Nigerian Data Protection Act, the Brazilian General Personal Data Protection Law (LGPD), the Australian Privacy Act, the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), and similar regulations in other jurisdictions. This approach ensures broad compliance and builds trust.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. We will post the updated version on our website with a revised effective date. If we make material changes, we will notify you by email (if we have your address) or through a prominent notice on the website before the changes take effect. Your continued use of the Services after the effective date constitutes your acceptance of the updated Policy.

We do not sell your personal information for monetary consideration. However, certain disclosures may qualify as "sales" or "sharing" under specific laws (e.g., CCPA), and we provide opt-out options as described below.

1. Information We Collect

We collect only the personal information that is necessary for providing our Services, enhancing your experience, and complying with legal obligations. "Personal information" means any data that identifies, relates to, describes, or could reasonably be linked to an identifiable individual, excluding anonymized or aggregated data that cannot be re-identified. We minimize data collection to what is essential and obtain consent where required by applicable laws. We conduct regular data protection impact assessments for high-risk processing activities to further mitigate risks.

1.1 Types of Information Collected

We collect the following categories of personal information, depending on your interactions with us:

Identifiers and Contact Information: Name, email address, postal address, phone number, username, password, and account details.
Commercial and Transaction Information: Purchase history, order details (e.g., items, quantities, prices), payment information (e.g., credit/debit card details, billing address; processed securely via third parties like PayPal or Stripe), shipping preferences, returns/exchanges, and any customs or tax-related data.
Internet or Other Electronic Network Activity Information: Browsing history, search history, interactions with our website (e.g., pages viewed, time spent, clicks, scrolling), referral sources, and device usage data.
Device and Technical Information: IP address, browser type and version, operating system, device type and identifiers (e.g., MAC address, mobile device ID), geolocation data (approximate, derived from IP address or with consent for precise location), access times, and network information.
Marketing and Communication Preferences: Subscription details, feedback, survey responses, product reviews, user-generated content (e.g., photos, comments), and preferences for receiving marketing materials.
Sensitive Personal Information: We do not intentionally collect sensitive information (e.g., racial or ethnic origin, religious beliefs, health data, biometric data, sexual orientation) unless voluntarily provided and necessary (e.g., for product customization or accessibility features). If collected, we obtain explicit consent and apply heightened protections as required by laws like PIPL, GDPR, POPIA, and PDPA. We do not use sensitive information for inferring characteristics without your consent.
Inferred or Aggregated Data: Data derived from your interactions (e.g., preferences inferred from browsing or purchase history) or anonymized/aggregated data used for analytics, research, and business insights. Aggregated data cannot identify individuals and may be shared without consent.

1.2 Sources of Information

Directly from You: When you register, place orders, subscribe, provide feedback, upload content, or contact support.
Automatically: Through cookies, pixels, web beacons, log files, and similar technologies that track your device and usage.
From Third Parties: Payment processors (e.g., PayPal, Stripe), shipping partners (e.g., DHL, UPS), analytics providers (e.g., Google Analytics), advertising networks, social media platforms (if you link accounts), and other service providers. We may also receive data from public sources or partners for fraud prevention or marketing.

We collect this information with your consent where required (e.g., for cookies under GDPR or PDPA) or based on legitimate interests (e.g., for fraud prevention under PIPL or APPI).

1.3 Consent Management

We use a robust consent management system to record and manage your preferences. You can review, update, or withdraw consents at any time through your account settings or by contacting us. Consents are granular (e.g., separate for marketing vs. analytics) to give you greater control.

2. How We Use Your Information

We use your personal information only for legitimate purposes and in accordance with applicable laws, including principles of legality, necessity, minimization, and transparency under PIPL and equivalent standards globally. Processing is based on one or more legal grounds, such as your consent, contractual necessity, legitimate interests (e.g., improving services, fraud prevention), or legal obligations.

Providing and Managing Services: To create and manage accounts, process orders, handle payments, fulfill shipping and deliveries, manage returns/exchanges/refunds, provide customer support, verify identity, and resolve disputes. This includes fraud detection and transaction verification. (Legal basis: Contractual necessity.)
Personalization and Improvement: To personalize your experience (e.g., recommend products based on browsing or purchase history), analyze usage patterns, conduct A/B testing, improve website functionality, develop new products, and enhance service quality. (Legal basis: Legitimate interests or consent.)
Marketing and Communications: With your consent, to send promotional emails, SMS, newsletters, or notifications about offers, new products, events, or updates. This may include personalized ads or retargeting via third-party platforms, and automated messages such as cart reminders. You can opt-out at any time (e.g., reply "STOP" to SMS, click unsubscribe in emails, or adjust preferences in your account). We do not use automated decision-making with legal effects without your consent. This aligns with our Terms & Conditions on communications and ensures transparency in all interactions. (Legal basis: Consent.)
Legal Compliance, Security, and Protection: To comply with laws (e.g., tax reporting, customs requirements), respond to legal requests or authorities, prevent fraud or illegal activities, protect our rights/property/safety and those of users/third parties, and enforce our policies. (Legal basis: Legal obligations or legitimate interests.)
Analytics, Research, and Business Operations: To conduct internal analytics, research, audits, and reporting using aggregated or anonymized data. This helps us understand trends, optimize operations, and make data-driven decisions. (Legal basis: Legitimate interests.)

If we intend to use your information for a new purpose not described here, we will notify you and obtain your consent where required.

3. How We Share Your Information

We do not sell, rent, or trade your personal information for monetary gain. Sharing is limited to trusted parties for the purposes described above, with appropriate safeguards, and in compliance with cross-border transfer requirements under PIPL and other laws (e.g., GDPR's standard contractual clauses, POPIA's prior authorization, PDPA's binding agreements). We require recipients to use the information only as permitted and to protect it adequately.

Service Providers and Vendors: With third parties that assist us, such as payment processors (e.g., PayPal, Stripe for secure transactions), shipping and logistics partners (e.g., DHL, UPS for delivery), IT and cloud service providers (e.g., for hosting and analytics like Google Analytics), marketing agencies, fraud detection services, and customer support tools. These parties are bound by contracts ensuring confidentiality, data security, and compliance with applicable laws. We share only the minimum necessary information.
Affiliates and Business Partners: Within our corporate group or with partners for joint promotions, collaborations, or operational support, subject to equivalent protections.
Legal and Regulatory Purposes: To comply with legal obligations, respond to subpoenas, court orders, or government requests; prevent harm, fraud, or illegal activities; or in emergencies to protect life or safety. We may also disclose information to enforce our rights or defend against claims.
Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or similar corporate event, your information may be transferred as a business asset to the new entity, subject to applicable laws and with notice where required.
With Your Consent: For any other purpose you explicitly approve, or as directed by you (e.g., sharing with a third-party app you connect).

For international data transfers (e.g., from your jurisdiction to our servers in China, the US, EU, or other regions), we implement safeguards such as standard contractual clauses, binding corporate rules, adequacy decisions, or explicit consent, as required by PIPL, GDPR, APPI, PDPA, POPIA, and similar laws. We conduct transfer impact assessments where necessary to ensure equivalent protection levels. We only transfer data to countries with adequate protection levels or under approved mechanisms to minimize cross-border risks. Note that certain content (excluding credit card information) may be transferred unencrypted over networks and adapted for technical requirements.

4. Data Security and Retention

We implement reasonable administrative, technical, organizational, and physical security measures to protect your personal information from unauthorized access, loss, misuse, alteration, disclosure, or destruction. These include encryption (e.g., SSL/TLS for data in transit, with credit card data always encrypted), access controls, firewalls, regular security audits, employee training on data protection, and pseudonymization where appropriate. Payment information is encrypted and not stored on our servers; it is handled by PCI-DSS compliant third parties. We conduct annual third-party audits of our security measures to ensure ongoing effectiveness.

However, no method of transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security against all risks, including cyberattacks or transmission errors. You are responsible for maintaining the confidentiality of your account credentials (e.g., passwords) and using secure networks. In the event of a data breach, we will notify you and relevant authorities as required by applicable laws (e.g., within 72 hours under GDPR). We disclaim any warranties regarding the security of the Services and assume no liability for data loss or breaches, except as required by law.

Data Retention: We retain your personal information only as long as necessary for the purposes described in this Policy, or as required by law (e.g., 7 years for tax records under Chinese law, or longer for legal claims under PIPL or GDPR). When no longer needed, we securely delete or anonymize it. Factors influencing retention include the nature of the data, ongoing contractual relationships, legal obligations, and potential disputes. You can request deletion as described in Section 5.

5. Your Rights

You have rights over your personal information under applicable data protection laws. These rights are not absolute and may be subject to exceptions (e.g., for legal obligations, public interest, or if the request is manifestly unfounded or excessive). We do not discriminate against you for exercising your rights (e.g., no denial of services or price increases). To exercise your rights, contact us using the details in Section 9. We will verify your identity (e.g., via email confirmation or account details) and respond within the legally required timeframe (e.g., 30 days under GDPR/PIPL, 45 days under CCPA, extendable if complex). Requests are free, but we may charge a reasonable fee for excessive or repetitive requests. You can appoint an authorized agent with verifiable proof.

Your rights include:

Right to Be Informed / Access / Know: To receive details about the personal information we hold, how we process it, and with whom we share it. Under CCPA, California residents can request disclosures twice per year.
Right to Correction / Rectification: To update or correct inaccurate or incomplete information.
Right to Deletion / Erasure: To request deletion of your information, subject to exceptions (e.g., for completing transactions, legal compliance, or internal uses like fraud prevention). We will also instruct our service providers to delete where applicable.
Right to Portability: To receive your information in a structured, commonly used, machine-readable format and transfer it to another controller where technically feasible.
Right to Object / Restriction of Processing: To object to processing based on legitimate interests or restrict it (e.g., while we verify accuracy or legality). Under GDPR/POPIA, this includes direct marketing objections.
Right to Withdraw Consent: To withdraw consent at any time for consent-based processing (e.g., marketing), without affecting prior lawful processing.
Right to Opt-Out of Sale / Sharing / Targeted Advertising: We do not sell data for money, but you can opt-out of any "sharing" for cross-context behavioral advertising or targeted ads (e.g., via Global Privacy Control (GPC) signals, which we honor, or by contacting us). Under CCPA, this includes opting out of sensitive information use. We have not sold or shared personal information of minors under 16 without affirmative authorization.
Right to Limit Use of Sensitive Personal Information: To restrict processing of sensitive data to necessary purposes only.
Right to Non-Discrimination: We will not penalize you for exercising your rights.
Right to Lodge a Complaint: If unsatisfied with our response, contact your local data protection authority (e.g., Cyberspace Administration of China for PIPL, ICO for UK/GDPR, Information Regulator for South Africa/POPIA, PDPC for Singapore/PDPA).

For CCPA: California residents have enhanced rights; we verify requests and provide disclosures in a portable format. For GDPR (EEA/UK): Additional rights include automated decision-making challenges; we conduct data protection impact assessments for high-risk processing.

6. Children's Privacy

Our Services are not directed to or intended for children under 16 years old (or the local age of majority, e.g., 18 in some jurisdictions). We do not knowingly collect, use, or disclose personal information from minors without verifiable parental consent. If we become aware that we have collected such information, we will promptly delete it. Parents or guardians who believe we have collected their child's information should contact us to request review and deletion. We comply with laws like COPPA (US) and GDPR Article 8.

7. Third-Party Links, Cookies, and Tracking Technologies

Our website may contain links to third-party sites or services (e.g., social media, payment gateways). We are not responsible for their privacy practices, content, or security. We encourage you to review their policies before interacting. We disclaim any liability for third-party actions or omissions.

We use cookies and similar tracking technologies (e.g., pixels, web beacons, SDKs) to enhance functionality, analyze usage, personalize content, and deliver targeted ads. Cookies are small files stored on your device.

Cookie Categories

Category	Description	Examples	Duration
Strictly Necessary	Essential for website operation (e.g., session management, security).	Session cookies for login.	Session (deleted when browser closes)
Performance / Analytics	Measure site performance and usage (e.g., visitor counts, page views).	Google Analytics cookies.	Persistent (up to 2 years)
Functional	Remember preferences (e.g., language, region).	Preference cookies.	Persistent (up to 1 year)
Targeting / Advertising	Deliver personalized ads based on interests.	Remarketing cookies from Google Ads.	Persistent (up to 1 year)

We obtain consent for non-essential cookies where required (e.g., via cookie banner under GDPR or PDPA). You can manage cookies through your browser settings (e.g., block or delete them), but this may affect site functionality. We honor Do Not Track (DNT) signals and Global Privacy Control (GPC) for opting out of targeted advertising. For Google Analytics opt-out, visit https://tools.google.com/dlpage/gaoptout. We do not track users across third-party sites without consent.

8. Your Choices and Opt-Outs

In addition to the rights in Section 5, you can:

Update your account preferences or communication settings at any time.
Unsubscribe from marketing emails or SMS by following instructions in messages.
Disable cookies or tracking as described above.
Use tools like GPC to opt-out of data sharing for advertising.

9. Contact Us

For questions, rights requests, complaints, or to report a breach, contact our Data Protection Officer: Email: privacy@rongjinera.com

We aim to respond within 30 days (or as required by law). If unresolved, you may contact your local data protection authority.

10. Additional Disclosures and Exemptions

No Absolute Guarantees: While we take reasonable steps to protect your data, we cannot guarantee against all risks, including cyberattacks or transmission errors. You use our Services at your own risk.

Company Rights: We reserve the right to suspend or terminate accounts for violations, update this Policy without prior consent (with notice for material changes), and enforce our policies.

Indemnification: You agree to indemnify us against claims arising from your misuse of the Services or violation of this Policy. This includes claims related to inaccurate information you provide or unauthorized use of your account.

Governing Law: This Policy is governed by the laws of the People's Republic of China, without regard to conflict of laws principles. Disputes shall be resolved in accordance with our Terms & Conditions, including arbitration in Guangzhou, China, under CIETAC rules.