1. Data Controller

NovaCheer Mall (operated by CIWWAY LIMITED) is the data controller responsible for the processing of your personal data.

Contact details:
CIWWAY LIMITED
RM 1105-5, 11/F BLK C PHASE 1 KWAI SHING IND BLDG
36-40 TAI LIN PAI RD, KWAI CHUNG, HONG KONG
Email: [email protected]
Tel: +852 6682 9420

Data Protection Point of Contact: For any privacy-related inquiries, please contact our designated privacy team at [email protected].

2. Information We Collect

We collect only the data necessary to fulfill orders and provide after-sales service:

• Order information: name, billing address, shipping address, email, phone number
• Payment information: processed securely by third-party payment providers (we do not store full payment details)
• Browsing data: IP address, browser type, device information, pages visited
• Cookies: see Section 4 below for details
• Child-related information: child's name and delivery details, provided only by a parent or legal guardian

3. How We Use Your Data

• Process and fulfill orders, including global shipping
• Send order confirmations, tracking updates and delivery notifications
• Provide customer service and handle returns or refunds
• Improve our product selection and website experience
• Prevent fraud and ensure website security
• Comply with legal obligations

Legal basis: We process your data based on contract performance (to fulfill your order), legal compliance, and our legitimate interests (to improve our services and prevent fraud).

4. Cookies & Analytics

We use cookies to enhance your shopping experience and analyze website traffic.

• Essential cookies: Required for basic site functionality (cart, checkout, login)
• Functional cookies: Remember your preferences and shopping selections
• Analytics cookies: Help us understand how visitors interact with our site

Google Analytics: We use Google Analytics to collect anonymized traffic data. Google Analytics uses cookies and stores information about your use of our Site. This data is transmitted to and stored by Google on servers in the United States. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

You can manage or disable cookies through your browser settings at any time. However, disabling essential cookies may affect site functionality.

5. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this Privacy Policy:

• Order data: Kept for 7 years to comply with tax and accounting obligations
• Customer service records: Kept for 2 years after the last interaction
• Marketing data: Retained until you withdraw consent
• Browsing data: Anonymized after 14 months

You may request deletion of your personal data at any time (see Section 8).

6. Payment Service Providers

We partner with trusted third-party payment processors to handle your transactions securely. These providers process your payment information in compliance with industry security standards (PCI DSS).

Our payment partners include:

• Stripe
• PayPal
• Other region-specific providers as offered at checkout

We do not store your full credit card details on our servers. Please refer to the privacy policies of our payment partners for details on how they handle your data.

7. Children's Data (Under 16)

NovaCheer Mall sells children's clothing and accessories, but our website is not directed at children under 16. We do not knowingly collect personal information directly from children.

• All orders must be placed by a parent, legal guardian, or adult with parental consent
• The only child-related information we collect is the child's name and delivery address, used exclusively for shipping purposes
• We do not collect any other personal information about children (e.g., age, gender, photos, interests)
• Parents or guardians may request access to, correction of, or deletion of any data related to their child by contacting us at [email protected]
• If we become aware that we have inadvertently collected personal information from a child without verified parental consent, we will delete that information promptly

8. Your Rights (GDPR & Global)

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we use your data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw your consent at any time where processing is based on consent
• Lodge a Complaint: File a complaint with your local data protection authority

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or alteration. These include:

• Encryption of data in transit (SSL/TLS certificates)
• Secure server infrastructure with access controls
• Regular security monitoring and vulnerability assessments
• Staff training on data protection and privacy
• Restricted access to personal data on a "need-to-know" basis

While no system is 100% secure, we continuously review and improve our security practices.

10. International Data Transfers

As we ship globally, your data may be transferred to countries outside your country of residence, including Hong Kong, the United States, and the European Union. When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Compliance with applicable data protection laws
• Partnering with service providers that are certified under frameworks such as the EU-US Data Privacy Framework

11. Third-Party Service Providers

We share your data with trusted partners who help us operate our business. These include:

• Shipping carriers: DHL, Royal Mail, and local delivery partners
• Payment processors: Stripe, PayPal and other region-specific providers
• Analytics services: Google Analytics
• Hosting & IT support: Website hosting and technical support providers

All third-party providers are contractually obligated to process your data only for specified purposes and in compliance with applicable privacy laws.

12. Marketing Communications

With your explicit consent, we may send you marketing emails about new collections, promotions, and updates. You can opt out at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Contacting us at [email protected]

We do not send marketing communications to children.

13. Policy Updates

We may update this Privacy Policy from time to time. Any material changes will be communicated via email or a prominent notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised.