Cashop | Privacy Policy

CASHOP Privacy Policy

This Privacy Policy explains how Cashop (Hong Kong) Limited ("Cashop," "we," "us") collects and processes your personal data through the Cashop website, mobile applications, and any other services that refer to this Privacy Policy (collectively, the "Cashop Services").

By clicking or checking "agree," or by otherwise using the Cashop Services, you acknowledge that you have read and agree to this Privacy Policy. Where the collection or sharing of sensitive or cross-border data is involved, we will seek your separate and explicit consent. If we share your information with a third party, we will clearly identify the type of data shared, the recipient, the purpose of sharing, and how you may refuse such sharing.

Please read this Privacy Policy carefully. Provisions in bold relate to your rights and interests and therefore deserve special attention.

Table of Contents

A. Data Controller
B. What Personal Data Cashop Collects
C. Purposes of Collecting Personal Data
D. Partners Involved in Processing and Disclosure of Personal Data
E. Your Rights and Choices
F. Cross-Border Data Transfers
G. Policy Regarding Minors
H. Data Security and Retention
I. Updates to This Policy
J. Contact Us
K. Language Versions

A. Data Controller

Cashop (Hong Kong) Limited
NO.185-B37, G/F, BLOCK B, HANG WAI INDUSTRIAL CENTRE,
NO.6 KIN TAI STREET, TUEN MUN, NT, HONG KONG

B. What Personal Data Cashop Collects

We may collect the following types of personal data from or about you:

1. Information You Provide Voluntarily

When you use Cashop Services (including creating an account, browsing, checkout, or contacting customer service), we receive and store any information you provide.
You may choose not to provide certain information, but this may limit your ability to use some features of Cashop Services.
You may also log in using a third-party account (as displayed on the page), in which case we may obtain your third-party account name, email address, and profile picture.

Data Category

Description

Account and Profile Information

We collect your email address as your account credential and assign a user identification number (UID). If you register or log in via a third-party account (e.g., Google), you consent to our collection of associated profile data (avatar, username, and/or email). We may also collect your profile information (nickname, gender, date of birth, regional info) and account preferences.

Shopping Information

Includes your order details (order ID, time, product details, quantity), payment details (payment method, billing address), product specifications (size, color), and delivery details (recipient name, phone number, tax ID, passport or other ID documents as required for customs clearance).

Communications

When you contact our support team (via in-app chat, email, or social media), we record the communication history, including text, images, audio, or video exchanged, and related attachments.

User-Generated Content

Includes product reviews, ratings, and any images, videos, or metadata you upload when interacting with Cashop.

Social Media Data

If you join our affiliate or promotional programs, we may collect your contact and social media/website details (e.g., account handle, posts, or comments related to Cashop).

2. Information Collected Automatically

We automatically collect and store certain types of information about your use of Cashop Services, using cookies and other unique identifiers.

Data Category

Description

Device Information

Includes device model, operating system, network provider, language settings, Wi-Fi configuration (if auto-sync is enabled), cookies, and log data.

Usage Information

Includes traffic sources, pages viewed, interaction data (e.g., browsing, search, purchase history), items in cart, email open/click records, and diagnostics (system crash reports, performance logs).

General Location Data

We infer your approximate location based on your IP address.

3. Information from Other Sources

We may obtain your data from other sources, such as updated delivery addresses from logistics providers to ensure successful delivery.

We may also collect data from affiliate marketing activities, such as your name, ID number, phone number, stablecoin account, and payment details, which may be shared with cooperating service providers for settlement purposes.

We store your data in the Hong Kong Special Administrative Region of the People's Republic of China, retaining it for the shortest duration necessary to fulfill the purposes described, unless a longer retention period is required by law. After the retention period, data will be deleted or anonymized.

Data Category

Description

Payment Processors

We receive your name, email, billing address, phone number, and payment method details from third-party payment providers for transaction and fraud-prevention purposes.

Logistics Providers

Includes delivery progress and address updates necessary for order fulfillment.

Social Media Services

If you use a third-party account to register or log in, we may collect your username, avatar, and/or associated email address.

Cookies

We use necessary and optional cookies: necessary cookies enable core functions (e.g., display products in your preferred language), while optional cookies track metrics such as ad performance. For more details, refer to our Cookies Policy.

C. Purposes of Collecting Personal Data

We process your personal data to develop, support, and improve Cashop Services. Specific purposes include:

  • Account Creation and Maintenance
    To create and secure your account, verify identity (e.g., by sending one-time codes), and manage login access.
  • Order Fulfillment and Delivery
    To receive and process orders, deliver products, handle payments, communicate about orders, and assist in dispute resolution.
  • Providing, Troubleshooting, and Improving Services
    To optimize functionality, analyze performance, fix bugs, and enhance Cashop Services, sometimes through anonymized or aggregated data.
  • Personalized Recommendations
    To tailor product suggestions, offers, and interface preferences based on your interactions and purchase history.
  • Customer Communication and Support
    To respond to inquiries, send order updates, and manage support requests efficiently.
  • Advertising and Marketing
    To show you personalized promotions or advertisements related to Cashop products or services, consistent with legal requirements and your consent settings.
  • Fraud Prevention and Risk Management
    To detect, investigate, and prevent fraud or misuse, ensuring user and platform safety.
  • Legal Compliance
    To fulfill obligations under applicable laws (e.g., anti-fraud, customs, tax reporting, sanctions compliance).
  • Other Purposes with Consent
    Where additional uses arise, we will request your explicit consent and allow you to withdraw it at any time.

D. Partners Involved in Processing and Disclosure of Personal Data

We respect your privacy and never sell your personal data. Cashop may share your data only under the following conditions and with entities providing equal or higher levels of protection:

  1. Partner Merchants
    To complete your purchase, we share only necessary data (product specifications, customization, refund reasons) with sellers. Merchants do not receive your payment or device data.
  2. Third-Party Service Providers
    We engage contractors for delivery, email services, analytics, marketing, search results, payment handling, credit risk management, and customer service.
    These providers may access personal data only as needed for their functions and must comply with this Privacy Policy and applicable data laws.
  3. Payment Processors
    Shared data is limited to what is necessary to process payments, disputes, or refunds.
  4. Authorized Third Parties
    At your instruction or with your consent, we may share relevant data with third parties (e.g., when you share product links via social media).
    Please note that your activity on third-party platforms is also governed by their own terms and privacy policies.
  5. Business Transferees
    In mergers, acquisitions, or restructurings, user data may be transferred as a business asset under the same privacy obligations.
    We will notify you before any such transfer occurs.
  6. Other Users
    Depending on your account settings, your username and avatar may be visible to others, for example:
    • when participating in promotional events ("Refer a Friend");
    • when posting product reviews or ratings.
      You can disable such visibility via Account Settings → Profile Sharing.

E. Your Rights and Choices

Subject to applicable law, you may exercise the following rights concerning your personal data:

  • Right of Access and Data Portability
    View your information under "Settings" or request a downloadable copy in machine-readable format via the "Request Personal Data" page.
  • Right to Erasure
    Request deletion of your personal data by visiting the "Account Deletion" section.
  • Right to Rectification
    Update information (e.g., name, address, payment info) in "My Account" or contact support for other corrections.
  • Right to Object or Restrict Processing
    You may object to or limit data use, including advertising preferences, via "Notifications" or "Privacy Settings."
    Opting out of marketing communications does not affect your access to core services.
  • Email Marketing
    You may unsubscribe from promotional emails via the unsubscribe link or "Notifications" menu.
  • Push Notifications
    Disable marketing push notifications via device settings or My → Settings → Push Notifications.
  • Personalized Ads
    Adjust ad preferences under My → Settings → Privacy Settings.
  • Cookies and Similar Technologies
    You may delete or disable cookies through browser settings. Note: disabling cookies may affect service performance.
  • Third-Party Links
    Cashop is not responsible for third-party websites or services linked through our platform.
    Please review their privacy policies before providing any personal data.

F. Cross-Border Data Transfers

To provide Cashop Services, your data may be processed in and transferred to jurisdictions outside your own, including Hong Kong SAR, Mainland China, the United States, Japan, EU/EEA, the United Kingdom, Australia, Canada, and Türkiye.

Transfers are conducted only where lawful bases and adequate safeguards (e.g., encryption, contractual clauses, access control, pseudonymization) are in place.

  • Recipient Categories: service providers, business partners (merchants, payment gateways, logistics), auditors, regulators, and transferees.
  • Transfer Purposes: contract fulfillment (ordering, payment, customs clearance, delivery), customer support, compliance, risk management, or marketing (with consent).
  • Data Safeguards: Cashop executes data protection agreements or standard contractual clauses (SCCs/IDTA), and performs transfer impact assessments where required.

For EU/UK Users (GDPR / UK GDPR)

If you directly provide data to Cashop's controller in Mainland China, this may not constitute a "cross-border transfer" under GDPR.
Nevertheless, we maintain security controls (encryption, minimization, access restrictions).
When data is further transferred abroad, we rely on SCCs/IDTA and may provide summaries or copies upon request.

For Japan Users (APPI)

Before transferring your data abroad, we will:

  • Inform you of the recipient country and its data protection framework;
  • Describe our security measures;
  • Obtain your consent when required, or contractually ensure equivalent safeguards;
  • Preserve your rights to withdraw consent and review transfer records.

For Users in the U.S., Australia, Canada, Türkiye, and Other Regions

We ensure equivalent protection via binding contractual commitments or legally recognized mechanisms.
Where consent or registration is required, we will comply accordingly.

G. Policy Regarding Minors

Cashop Services are intended for a general audience and not directed toward minors. We may sell children's products, but only for purchase by adults or under adult supervision.

Eligibility and Parental Consent

Users under 18 years of age may use Cashop Services only with the consent and appropriate supervision of a legal guardian.
We may request reasonable proof of such consent when necessary.

Right of Cancellation for Minors

Contracts concluded by minors without parental consent may be canceled under applicable law.
If we have reasonable grounds to suspect that an order was placed by a minor without such consent, we reserve the right to cancel or suspend fulfillment and to verify the situation with both the user and guardian.

Personal Data of Minors

We do not knowingly collect personal data from minors under 18 without guardian consent.
If we become aware that we have inadvertently collected such data, we will suspend processing and delete or anonymize the information.
Guardians may exercise, on behalf of the minor, rights to access, rectify, delete, restrict processing, or withdraw consent.

Contact and Account Deletion

Guardians or users may request account deletion or raise inquiries regarding minors' data by contacting us as described in Section J (Contact Us).
After lawful verification, we will respond appropriately.

H. Data Security and Retention

We attach great importance to the security of your personal data and have implemented a series of technical and organizational measures to prevent loss, theft, misuse, unauthorized access, disclosure, alteration, or destruction, including but not limited to:
encryption, access controls, least-privilege principles, zero-trust segmentation, staff and contractor management, logging and auditing, backups, and disaster recovery systems.

When processing payment information, we comply with the Payment Card Industry Data Security Standard (PCI-DSS).
You should also take reasonable precautions, such as using a strong, unique password for your Cashop account, not re-using credentials across websites, and signing out after use on shared devices.

Data Retention Principles

We retain personal data only for as long as necessary to fulfill the purposes of collection, perform contracts, comply with laws and regulations, or resolve disputes.
After the retention period, we delete or anonymize data.
If immediate deletion is impracticable (e.g., backups or audits), data will be securely isolated until statutory deadlines expire.

Data Category

Typical Retention Period

Account and Transaction Records

Up to 7 years after account closure, to meet legal, tax, regulatory, or audit obligations, or longer if required for dispute resolution.

Customer Service Records

Up to 2 years after the last interaction, unless the case remains open or extension is necessary.

Marketing Preferences and Consents

Retained until consent is withdrawn or data is no longer needed; proof of consent may be stored longer for evidentiary purposes.

Technical and Security Logs

Retained 12 months unless extended for investigations of system or security incidents.

Data Breach Notification

If a security incident occurs that may harm individuals' rights (e.g., exposure of sensitive data, financial-loss risk, or large-scale leakage), we will:

  • Report to the relevant supervisory or data-protection authority within the statutory timeframe;
  • Promptly notify affected individuals of the nature, impact, and remedial measures;
  • Keep full incident records and implement corrective and preventive actions.

I. Updates to This Privacy Policy

We reserve the right to amend this Privacy Policy at any time.
When material changes occur, we will update the "effective date," publish a notice within the Service, or provide other legally required notifications.
Unless otherwise stated, amendments take effect upon publication.
We encourage you to review this Privacy Policy regularly to stay informed of updates.

J. Contact Us

If you have any questions, comments, or concerns regarding this Privacy Policy or your personal data, please contact us:

Email: privacy@cashop.com
Postal Address: NO. 185-B37, G/F, BLOCK B, HANG WAI INDUSTRIAL CENTRE, NO. 6 KIN TAI STREET, TUEN MUN, NT, HONG KONG

Please specify "Privacy Policy" in the subject line and describe your inquiry in detail.
We will respond within 15 days.
We may not reply to communications unrelated to this Policy or your personal-data rights.

K. Language Versions

If any discrepancy or inconsistency arises between the Chinese version and any translated version of this Privacy Policy, the Chinese version shall prevail.