Privacy Policy
This policy explains what personal data MadeInCN Shop collects when you visit this website or place an order, why we collect it, how long we keep it, and what you can ask us to do with it. It applies to consumers in the European Union, the United Kingdom, Israel, the United States and everywhere else we ship to; where the GDPR applies, we follow it.
1. Who is responsible for your data
The data controller is Changsha Xilin E-Commerce Co., Ltd. (trading as MadeInCN Shop), Room 1412, Building 1, Xiangjiang International, No. 89 Yuelu Avenue, Yinpenling Street, Yuelu District, Changsha City, Hunan Province, China. Contact: madeincnshop@126.com.
For product safety and regulatory matters inside the European Union, our appointed representative is PROCONSEIL FR, 200 rue de la Croix Nivert, 75015 Paris, France, SophieDupont@proconseilfr.com. That address is a regulatory liaison point, not a data-protection or returns address.
2. What we collect
- You give us: name, e-mail address, shipping and billing address, phone number, order contents, and any message you send us.
- Created by your order: order number, amounts, currency, tax lines, payment status, tracking numbers.
- Collected automatically: IP address, browser and device type, referring page, pages viewed, and cookie identifiers.
- Payment data: handled by the payment provider. We receive the result (paid, declined, refunded) and a masked account identifier — never your full card number.
We do not ask for and do not want special-category data (health, religion, political opinions, biometric data). Please do not send it to us.
3. Why we use it, and on what legal basis
- To perform your contract (GDPR Art. 6(1)(b)): taking payment, picking and packing, shipping, customs paperwork, handling returns and warranty claims.
- To meet legal obligations (Art. 6(1)(c)): tax and accounting records, product-safety traceability, responding to lawful requests from authorities.
- Our legitimate interests (Art. 6(1)(f)): keeping the site working and secure, preventing fraud and abuse, defending legal claims, and measuring aggregate shop performance in a way that does not identify you.
- Your consent (Art. 6(1)(a)): analytics cookies, advertising cookies, and marketing e-mails. Consent is optional, recorded, and can be withdrawn at any time without affecting your order.
We do not carry out automated decision-making that produces legal effects about you, and we do not build behavioural profiles for sale.
4. Cookies and similar technologies
Cookies are grouped by purpose. Only the first group is set before you make a choice.
| Category | What it does | Examples | Set before consent? |
|---|---|---|---|
| Strictly necessary | Keeps your cart, session, chosen language and chosen currency working, and remembers your cookie choice. | WooCommerce session cookies, pll_language, yay_currency_widget, mic_consent |
Yes — the site cannot function without them |
| Analytics | Tells us which pages and products are viewed, so we can fix or drop what does not work. Aggregated; we do not use it to identify individuals. | Google Analytics 4 (_ga, _ga_*) |
No — only after you accept |
| Advertising | Measures whether an ad led to a purchase and limits how often you see the same ad. | Google Ads conversion tags | No — only after you accept |
Changing your mind. The banner appears on your first visit and stores your answer for twelve months. To change or withdraw it at any time, use Cookie settings — this re-opens the banner on the page you are reading. Clearing site data in your browser has the same effect. Withdrawing consent stops future collection; it does not make past processing unlawful.
If you decline, analytics and advertising scripts are not loaded at all — we do not load them “switched off” and hope the vendor honours a flag.
5. Payments
Payments are processed by PayPal and by card networks reached through PayPal. The provider is an independent controller of the payment data it collects; its own privacy notice applies. We never see or store your full card number.
6. Who else sees your data
We do not sell personal data and we do not share it for cross-context behavioural advertising. We share the minimum necessary with:
- Payment providers — to take payment, refund it, and handle chargebacks.
- Carriers and fulfilment partners — name, address, phone and order contents, because a parcel cannot be delivered without them. This includes the customs declaration, which by law states the contents and value.
- Our e-mail, hosting and analytics providers — strictly to run the shop and, for analytics, only after your consent.
- Authorities — where we are legally required to respond.
7. Your rights
If you are in the EU/EEA or the UK you have the right to: access your data and receive a copy; correct inaccurate data; have data erased; restrict or object to processing; receive your data in a portable format; and withdraw consent at any time. California residents have equivalent rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them.
Write to madeincnshop@126.com with the subject “Data request”. We answer within one month, and we may ask one clarifying question to make sure we are talking to the right person — we will not ask for a passport copy for a routine request. If we cannot fulfil a request we will tell you why.
If you believe we handled your data unlawfully you may complain to your national supervisory authority (for example the CNIL in France, the ICO in the UK, or the authority in your country of residence). You do not have to complain to us first.
8. How long we keep it
- Order, invoice and tax records: 10 years, because tax and accounting law requires it.
- Support conversations: 24 months from the last message.
- Analytics data: 14 months in Google Analytics, then deleted automatically.
- Consent record: 12 months, then we ask again.
- Abandoned carts: 6 months.
9. Security
The site runs over HTTPS. Access to order data is limited to the people who need it to fulfil orders. No system is perfectly secure, but we do not keep payment credentials on our servers at all, which removes the most valuable target.
10. Children
The shop is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.
11. Transfers outside your country
We operate from China and ship worldwide, so your data is processed outside your country of residence, including in China and the United States (where our e-mail and analytics providers operate). Where the GDPR applies, transfers rely on the European Commission’s Standard Contractual Clauses with our processors, plus the technical measures described in section 9.
12. Changes
We update this policy when what we actually do changes. The effective date below always reflects the current version; material changes are announced in the cookie banner or by e-mail to customers with an account.
13. Contact
E-mail: madeincnshop@126.com · WhatsApp: +86 166 7310 9418 · Address: Room 1412, Building 1, Xiangjiang International, No. 89 Yuelu Avenue, Yinpenling Street, Yuelu District, Changsha City, Hunan Province, China.
Effective date: 2026-11-01. Version 3.