Privacy Policy

In this Privacy Policy, we specify how ctisland.shop (“Website” and any variation of the personal pronoun “we”) collects, uses, and discloses personal information of the User who visits the website or uses our services from the website or makes a purchase on the website at www.ctisland.shop (“Website”) or otherwise communicates with us in connection with the Website (collectively “Services”). For the purposes of this Privacy Policy, the term “User” refers to a user of the Services, whether a customer, a visitor to the website, or any other individual whose information we collect in accordance with this Privacy Policy.

You should carefully read this Privacy Policy.

Changes to this Privacy Policy

We may update this Privacy Policy, including to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Website, and then we will update the date of the last update of this Privacy Policy and take any other steps required by applicable law.

Collection and use of User's personal information

To provide Services, we collect personal information about the User from various sources specified below. The information we collect and use varies depending on how the User interacts with us.

In addition to the specific use cases outlined below, the information collected about the User may be used to communicate with the User, provide or improve the Services, comply with any applicable legal obligations, enforce any applicable terms of service, and protect or defend the Services, our rights, and the rights of our users or others.

Personal information collected

The types of personal information we obtain about the user depend on how the User interacts with the Site and uses our Services. The term "personal information" refers to information that identifies, relates to, or describes the User or may be associated with them. The following sections describe the categories and specific types of personal information we collect.

Information collected directly from the User

The information provided to us directly by the User through our Services may include:

• Contact details,In this, the name, address, phone number, and email address of the User.
• Order information,In this, the User's name and surname, billing address, shipping address, payment confirmation, email address, and phone number.
• Account information,In this, the username, password, security questions, and other information used for the security purposes of the User's account.
• Customer service information,In this information, which the User places in the communication conducted with us, for example by sending a message via the Services.

Some features of the Services may require the User to directly provide us with certain information about the User. The User is not obligated to provide such information, but doing so may prevent them from using or accessing those features.

Collecting useful information

We may also automatically collect certain information about the User's interaction with the Services (“Usage Data"). To this end, we may use cookies, pixels, and similar technologies ("Cookie files"). User Data may include information about the use and access of the Website and User Account by the User, including device information, browser information, network connection information, IP address information, and other information related to the User's interactions with the Services.

Information obtained from third parties

We may also obtain user information from third parties, including suppliers and service providers, who may collect information on our behalf, such as:

• Companies that operate the Site and Services, such as Shopify.
• Our payment processing entities that collect payment information (such as bank account information, credit or debit card information, or billing address) in order to process the User's payments for fulfilling the User's orders and delivering products or providing services that the User has ordered, in order to fulfill our obligations under the agreement with the User.
• When the User visits the Website, opens or clicks on the emails sent to them by us, or interacts with the Services or our advertisements, certain information may be automatically collected by us or third parties we work with using online tracking technologies, such as pixels, web beacons, SDKs, third-party libraries, and cookies.

Any information obtained by us from third parties will be processed in accordance with this Privacy Policy. Also, see the section below titledThird Party Sites and Links.

Use of User's Personal Information

• Delivery of products and provision of Services.We use the User's personal information to provide Services to them, fulfill our agreement with the User, including processing the User's payments, fulfilling the User's orders, sending the User notifications related to their account, purchases, returns, exchanges, or other transactions, creating and maintaining the User's account, and managing that account in other ways, carrying out shipments, facilitating returns and exchanges, and using other features related to the User's account. We may also enhance the User's shopping experience by allowing Shopify to match the User's account with other Shopify services that the User may choose to use. In such cases, Shopify will process the User's information in the manner specified in its Privacy Policy and Consumer Privacy Policy.
• Marketing and advertising.We may use the User's personal information for marketing and promotional purposes, such as sending marketing, advertising, and promotional information via email, SMS, or traditional mail, as well as displaying advertisements for products or services. This may include using the User's personal information to better tailor the Services and advertisements on the Website and other websites. If the User is a resident of the European Economic Area (EEA), the legal basis for these data processing activities is our legitimate interest in selling our products, in accordance with Article 6(1)(f) of the GDPR.
• Security and fraud prevention.We use the User's personal information to detect, investigate, or take appropriate action regarding potential fraudulent, illegal, or malicious activities. If the User decides to use the Services and registers an account, they are responsible for maintaining the security of their account credentials. We strongly recommend that the User does not share their access information with anyone, including their username and password. If the User believes their account has been compromised, please contact us immediately regarding this matter. If the User is a resident of the European Economic Area (EEA), the legal basis for these data processing activities is our legitimate interest in ensuring the security of our website for the User and other customers, in accordance with Article 6(1)(f) of the GDPR.
• Communication with the User and improvement of services.We use the User's personal information to provide appropriate service and improve our Services. It is in our legitimate interest to respond to the User's needs, provide effective services to them, and maintain business relationships in accordance with Article 6(1)(f) of the GDPR.

Cookie files

Our Website, like many other websites, uses cookies. We use Cookies to provide and improve the Website and Services (including remembering User actions and preferences), conduct analyses, and better understand User interactions with the Services (in our legitimate interest related to administering and improving and optimizing the Services). Additionally, we may allow third parties and service providers to use cookies on the Website to better tailor services, products, and advertisements on the Website and other websites.

Most browsers automatically accept cookies by default, but the User can set the browser to delete or reject Cookies using the browser controls. Please note that deleting or blocking Cookies may negatively affect the User's experience and may cause some Services, including certain features and overall functionality, to work improperly or become unavailable. Additionally, blocking Cookies may not fully prevent us from sharing information with third parties, such as our advertising partners.

Disclosure of personal information

Under certain circumstances, we may disclose the User's personal information to third parties for the purposes related to the execution of the contract, for lawful purposes, and for other reasons, subject to the provisions of this Privacy Policy. These circumstances may include the sharing of personal information:

• To delivery companies or other third parties that provide services on our behalf (e.g., IT management services, payment processing, data analysis, customer service, cloud data storage, fulfillment, and shipping).
• Business and marketing partners to provide services and display advertisements to the User. Our business and marketing partners will use the User's information in accordance with their own Privacy Policy.
• When the User instructs us to disclose or otherwise agrees to our disclosure of certain User information to third parties, e.g., for the shipment of User products or in connection with the User's use of social media widgets or login integrations, with the User's consent.
• In our legally justified interest in conducting a successful business, to our affiliated entities or otherwise within our group of companies.
• Due to a business event, such as a merger or bankruptcy, in order to comply with all applicable legal obligations (including responding to subpoenas, search warrants, and similar requests), to fulfill any relevant service terms, and to protect or defend the Services, our rights, and the rights of our users or others.

We disclose the following categories of personal information and sensitive personal information regarding users for the purposes specified above in the points."How we collect and use users' personal information" i "How We Disclose Personal Information":

Category	Recipient categories
Identification information, e.g. basic contact details and specific information about orders and accounts. Commercial information, e.g. order information, purchase information, and customer service information Information regarding the Internet and similar online activities, e.g. User Data Geolocation information, e.g., locations determined based on IP address or other technical means	Suppliers and third parties that provide services on our behalf (e.g., internet service providers, payment processors, order fulfillment or customer service partners, and data analytics service providers) Business and marketing partners Affiliates/Affiliates

We do not use or disclose the User's sensitive personal information without their consent or for the purpose of inferring the User's characteristics.

With the User's consent, we share personal information for the purpose of conducting advertising and marketing activities in the following manner.

Third-Party Sites and Links

The website may contain links to websites or other online platforms operated by third parties. If the User uses these links to visit sites that are not owned by our affiliate partners/associates, they should review the applicable privacy and security policies and other relevant provisions of those sites. We do not guarantee or assume any responsibility for the privacy or security of such sites, including the accuracy, completeness, or reliability of the information contained on those sites. Information posted by the User in public or semi-public areas, including information shared by the User on third-party social media platforms, may also be visible to other users of the Services or those platforms without restrictions on their use as specified by us or a third party. Our posting of such links does not in itself imply any endorsement of the content on such platforms or their owners or operators, unless specified within the Services.

Children's data

The services are not intended for use by children, and we do not knowingly collect any personal information from children. If the User is a parent or guardian of a child who has provided us with their personal information, they may contact us using the information provided below to request its deletion.

As of the effective date of this Privacy Policy, we have no actual knowledge that we “share” or “sell” (as defined by applicable law) personal information of individuals under the age of 16.

User Information Security and Retention

It should be noted that no security measures are perfect or impenetrable and that we cannot guarantee "perfect security." Furthermore, any information transmitted to us by the User may not be secure during transmission. We recommend avoiding the use of unsecured channels to transmit confidential or sensitive information to us.

The length of time personal information of the User is retained depends on various factors, such as whether this information is needed for managing the User's account, providing Services, fulfilling legal obligations, resolving disputes, or executing other provisions of applicable agreements and policies.

User Rights

Depending on the User's place of residence, they may be entitled to some or all of the rights listed below related to their personal information. However, these rights are not absolute and may only apply in specific circumstances, and if permitted by law, we may reject the User's request.

• The right to knowledge / the right to access personal informationThe user may have the right to request access to personal information we hold about them, including information regarding how the user's information is used and shared by us.
• The right to have your personal information deletedThe user may have the right to submit a request for the deletion of the personal information we hold about the user.
• The right to rectify personal informationThe user may have the right to request the correction of inaccurate personal information about the User that we hold.
• The right to transfer personal informationThe user may have the right to receive a copy of the personal information we hold about them and to request that it be sent to a third party, under certain circumstances and with specific exceptions.
• Right to withdraw from the sale, sharing, or targeted advertisingThe user may have the right to prohibit us from "selling" or "sharing" the user's personal information or to opt out of the processing of the user's personal information for purposes deemed to be "targeted advertising," as defined in the applicable privacy protection laws. It should be noted that if the user visits the Site with the GPC opt-out signal enabled, then depending on the user's location, we will automatically treat such a signal as a request to opt out of the "sale" or "sharing" of information for the device and browser that the user is using to visit the Site.
• Restriction of processingThe user may request the cessation or limitation of the processing of their personal information by us.
• Withdrawal of consentWhenever we require consent to process the User's personal information, the User may have the right to withdraw that consent.
• AppealIf we refuse to consider the User's application, the User may have the right to appeal our decision. To do this, the User should respond directly to our refusal.
• Managing communication preferencesWe may send the User promotional emails, and the User can unsubscribe from receiving them at any time by using the unsubscribe option displayed in our emails. If the User unsubscribes from receiving them, we may still send them non-promotional emails, such as messages regarding the User's account or orders.

The user may exercise any of these rights when specified on the Site or by contacting us using the contact details provided below.

We will not discriminate against the User based on the exercise of any of these rights. Before providing a substantive response to the request, we may be required to collect information from the User (e.g., email address or account information) to verify their identity. In accordance with applicable law, the User may designate an authorized representative to submit a request on behalf of the User to exercise the rights available to the User. Before accepting such a request from the representative, we will require the representative to present appropriate authorization to act on behalf of the User, and we may also require the User to verify their identity directly with us. We will respond to the request submitted by the User in a timely manner, in accordance with the requirements of applicable law.

Complaints

In the event of complaints regarding the way we process the User's personal information, please contact us using the contact details provided below. If the User is not satisfied with our response to their complaint, they may have the right to appeal our decision (by contacting us using the contact details provided below) or to file a complaint with the appropriate local data protection authority, depending on their place of residence. A list of the relevant supervisory authorities for data protection in the EEA can be foundhere.

Foreign users

Please note that we may transfer, store, and process the User's personal information outside of their country of residence. The User's personal information is also processed by employees and external service providers and partners in those countries.

If we transfer the User's personal information outside of Europe, we will rely on recognized data transfer mechanisms, such as the Standard Contractual Clauses adopted by the European Commission or any equivalent documents adopted by the relevant authority in the United Kingdom, unless the data is transferred to a country that has been recognized as providing an adequate level of protection.

Contact

If you have any questions regarding our privacy practices or this Privacy Policy, or to exercise any of your rights, please contact us by phone or email at wzhao6800@gmail.com or write to us at UNIT 811, BEVERLEY COMM CENTRE, 87-105 CHATHAM RD SOUTH, TSIM SHA TSUI HONG KONG.

In accordance with the applicable data protection laws, and unless explicitly stated otherwise, we are the administrator of the User's personal information.