Your data, handled with care.

01Introduction

This Privacy Policy explains how duphouse (“we”, “us”, “our”) collects, uses, discloses and protects personal data when you visit our website, place an order, submit an OEM/ODM inquiry or otherwise interact with us.

It is prepared with reference to the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA), the Hong Kong Personal Data (Privacy) Ordinance (PDPO) and accepted international practice. It is a general description of our practices and does not constitute legal advice.

By using our website or services, you acknowledge the practices described in this Policy. Where a more specific notice applies to a particular service (for example, at checkout or in a project agreement), that notice prevails to the extent of any conflict.

02Data Controller and Scope

We are [Duphouse Ltd.], with our registered office at [KOWLOON, HONG KONG]. For the purposes of the GDPR we act as the controller of the personal data described in this Policy, and you may contact us at [service@duphouse.com].

This Policy covers visitors to our website, retail customers, and representatives of business clients who use our OEM/ODM manufacturing services. It does not apply to third-party websites or services linked from our website, which are governed by their own policies.

03Information We Collect

• Information you provide. When you place an order, create an account or contact us, we collect the information you choose to provide: name, billing and shipping address, email address, telephone number, account details, order details, product preferences and the content of your communications with us.
• OEM/ODM inquiries. For business clients, we collect company name, business contact details, project specifications, and any designs, artwork or materials you choose to share with us for a project.
• Payment data. We do not store full card numbers. Payment is processed by our payment service providers, and card data is handled under their own security programs.
• Information collected automatically. When you visit the website, we may record technical data such as your IP address, device and browser type, pages visited, referring page and time of access, together with cookie data as described in Section 6.

04How We Use Your Information

• to process and deliver orders, including payment, shipping, delivery and returns;
• to manage accounts and provide customer support;
• to respond to OEM/ODM inquiries and administer manufacturing projects;
• to send transactional communications, such as order confirmations and delivery updates;
• to send marketing communications where we have your consent or another lawful basis, and to honour opt-out requests;
• to improve our website, products and services, and to measure their performance;
• to detect, prevent and investigate fraud, misuse and security incidents; and
• to comply with legal and regulatory obligations and to enforce our Terms and Conditions.

05Legal Bases for Processing (GDPR)

Where the GDPR applies, we process personal data on the following bases:

• Performance of a contract — processing orders, providing services and administering projects;
• Legitimate interests — operating and improving our business, responding to inquiries, preventing fraud and marketing to business clients;
• Compliance with legal obligations — accounting, tax and regulatory requirements; and
• Consent — where we rely on it (for example, for marketing where required and for non-essential cookies), which you may withdraw at any time.

06Cookies and Similar Technologies

We use cookies and similar technologies to make the website work and to understand how it is used. Essential cookies are required for core functionality, such as the shopping cart, checkout and security. Analytics and preference cookies help us understand how visitors use the site.

For visitors in jurisdictions with stricter rules (such as the EEA and UK), we aim to obtain consent before loading non-essential cookies, and we provide controls through your browser settings and, where available, a cookie banner. You may disable cookies at any time; some features of the website may not function correctly without them.

07How We Share Information

We disclose personal data only as needed for the purposes described in this Policy:

• Service providers — hosting, payment processing, shipping and fulfilment, analytics and customer support providers, under appropriate confidentiality and security arrangements;
• Professional advisers and authorities — where required by law, regulation or legal process, or where necessary to protect our rights or the rights of others;
• Corporate transactions — in connection with a merger, acquisition, reorganization or sale of assets, subject to appropriate confidentiality; and
• With your consent — where you have asked us to share information in a particular way.

We do not sell personal data (see Section 11).

08International Transfers

Our business is based in China, where our production facilities are located, and we may use service providers located in other countries. Your personal data may therefore be processed outside your country of residence.

Where the GDPR or other transfer rules apply, we seek to rely on appropriate safeguards, including standard contractual clauses where applicable, and we apply protective measures appropriate to the data involved. If you would like further detail about the safeguards used, contact us at [service@duphouse.com].

09Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy, for the duration of any contractual relationship, or as required by applicable law.

Order records are generally retained for the period needed for accounting, warranty and legal purposes. Inquiry, account and marketing records are reviewed periodically and deleted or anonymized when no longer needed.

10Your Privacy Rights

Depending on your location, you may have the following rights, prepared with reference to the frameworks listed in Section 1:

• GDPR — the right to access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent;
• CCPA/CPRA — the right to know, the right to delete, the right to correct, the right to opt out of the sale or sharing of personal information, the right to limit the use of sensitive personal information, and the right to non-discrimination for exercising these rights; and
• Hong Kong PDPO — the right to access and correct personal data.

To exercise any of these rights, contact us at [service@duphouse.com]. We will verify your identity and respond within the timeframes required by applicable law (generally one month under the GDPR, and 45 days under CCPA/CPRA). We may ask for information reasonably needed to confirm your request, and authorized agents may submit requests on your behalf where permitted by law.

11Do Not Sell or Share (CCPA/CPRA)

We do not sell personal data, and we do not knowingly share personal data for cross-context behavioral advertising as those terms are defined under CCPA/CPRA. We disclose personal data only to service providers and other recipients described in Section 7, under appropriate arrangements. If our practices change, we will update this Policy.

12Marketing and Communications

Where we send marketing communications, you may opt out at any time by using the unsubscribe link in each email or by contacting us at [your contact email]. Transactional messages — such as order confirmations and delivery updates — are not marketing, and we will continue to send them where necessary to perform our contract with you.

13Children’s Privacy

Our website is not directed to minors. We do not knowingly collect personal data from anyone under the age of 18, and we do not market to children. If you believe that a child has provided us with personal data, please contact us at [service@duphouse.com] and we will delete it as soon as practicable.

14Security

We apply reasonable technical and organizational measures to protect personal data against unauthorized access, loss or alteration, including access controls and encryption in transit where appropriate. Payment data is processed by our payment service providers under their own security programs.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you become aware of a security concern affecting your data, please contact us promptly.

15Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page indicates the current version. Material changes will be reflected on this page and, where appropriate, notified to you.

16Contact Us

For privacy questions, requests or complaints, contact us at [service@duphouse.com].