Who is responsible
Dingsheng E-commerce Co.,Limited, of Hong Kong (Business Registration No. 80140579), is the data controller for personal data collected through this website (www.getpapar.com). Contact us for privacy matters at daotrandinhh@gmail.com.
What we collect
- Order information — name, delivery address, billing address, email, phone number, the items you buy, and the order total.
- Account information — if you register: name, email, a hashed password, saved addresses and your order history.
- Communications — the content of emails and messages you send us, plus the fact of the exchange.
- Payment confirmation — the transaction reference and status returned by our payment provider. We do not receive or store full card numbers, expiry dates or CVV codes.
- Technical data — IP address, browser and device type, pages viewed, referring site, and session timing, collected through cookies and similar technology.
- Marketing preferences — whether you have joined the email list and how you have engaged with our messages.
Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Take your order, take payment, deliver goods, handle returns | Performance of a contract |
| Support replies and order updates | Performance of a contract / legitimate interests |
| Fraud screening and chargeback defence | Legitimate interests |
| Tax records and accounting | Legal obligation |
| Marketing emails and SMS | Consent (or an existing-customer soft opt-in where the law allows it) |
| Analytics and improving the storefront | Consent, where required for non-essential cookies |
Payment processing
Card and PayPal payments are handled by PayPal (Europe) S.à r.l. et Cie, S.C.A. PayPal acts as a separate controller for the payment data it needs and processes it under its own privacy notice. Card details are transmitted directly to PayPal over TLS and are never written to our databases.
Who we share data with
- Delivery carriers — USPS receive the name, address, phone number and email needed to deliver and to notify you.
- Our store platform — WooCommerce, on our own managed hosting.
- Email and marketing tools — none. We do not yet use an email marketing platform.
- Analytics — none. We run no analytics or advertising pixels on this site.
- Finance and legal advisers, and law enforcement or regulators where we are legally required.
We do not sell personal data, and we do not share it with third parties for their own marketing.
International transfers
We operate from Hong Kong and the United States and ship worldwide, so your data may be processed outside your home country. Where data leaves the UK or the EEA we rely on an adequacy decision, or on Standard Contractual Clauses with the additional safeguards described in our transfer assessment.
How long we keep it
- Order and accounting records: 7 years, as required by tax law.
- Support correspondence: 1 year from the last message.
- Account data: until you delete the account, then 3 months.
- Marketing consent records: until you withdraw consent, plus the period needed to prove it.
- Server logs used to keep the site running: 1 year. We collect no analytics or advertising data.
Cookies and local storage
Cookies are small files stored by your browser. We use strictly necessary cookies to keep your session and basket working, and — only with your consent — optional cookies for analytics and advertising.
This storefront also writes a small value into your browser's local storage so your basket count survives a page reload. It holds a number only, is never sent to our servers, and is removed when you clear site data.
You can accept or refuse optional cookies in the banner, and delete cookies at any time in your browser settings. Refusing them will not stop you ordering. We set no non-essential cookies today, which is why there is no consent banner; if analytics or advertising pixels are added later, a banner goes in first.
Your rights
Where they apply to you, you may ask to: access the data we hold; have it corrected; have it erased; restrict or object to processing; receive it in a portable format; object to profiling or automated decisions; and withdraw a consent without affecting processing that already happened. You can also object to direct marketing at any time, simply by using the unsubscribe link in any email or by writing to us.
If you are in California, the CCPA/CPRA gives you the right to know, delete, correct and opt out of selling or sharing, plus limits on sensitive personal information. We do not sell or share personal information in those terms.
Requests are answered free of charge within one month. We may ask for proof of identity before disclosing data. Write to daotrandinhh@gmail.com.
If you are unhappy with how we handle your data you may complain to your local supervisory authority — in the UK, the Information Commissioner's Office; in the EU, the relevant national authority; in Australia, the Office of the Australian Information Commissioner.
Marketing
Email and SMS marketing is sent only where you have asked for it, or where an existing-customer soft opt-in lawfully applies. Every message carries an unsubscribe link that works immediately. We send no more than twice a month.
Children
This store is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
Security
The site is served over HTTPS. Access to order data is limited to staff who need it, under least-privilege accounts with two-factor authentication, and our platform providers are contractually required to protect the data they process. No system is perfectly secure, so we will notify you and any regulator if a breach creates a risk to you.
Changes to this policy
We update this page when our processing changes. The current version and its date appear below; material changes are announced on the site or by email where you have given us an address.