Privacy Policy

Welcome to XYOLIAN LIMITED (hereinafter referred to as “we“, “us“, or “our“). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (the “Site”) and interact with our services, including wholesale and retail purchases.

Please read this Privacy Policy carefully. By using our Site and services, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this policy, please do not use our Site or services.

XYOLIAN LIMITED operates from FLAT E15 10/F WONG KING INDUSTRIAL BUILDING 2-4 TAI YAU STREET SAN PO KONG KL and complies with the applicable data protection laws of Hong Kong, the General Data Protection Regulation (GDPR) for our users in the European Economic Area (EEA), and the California Consumer Privacy Act (CCPA) for our users in California, USA.

1. Information We Collect

We collect several types of information from and about users of our Site, including:

a. Personal Identification Information

When you register an account, place an order, subscribe to our newsletter, or contact us, we may ask you to provide:

Identity Data: Full name, date of birth (for age verification where required), and gender.
Contact Data: Billing address, shipping address, email address, and telephone numbers.
Financial Data: Payment method details (such as credit/debit card information, PayPal account details). Please note that we do not store full payment card numbers; all payment processing is handled by our trusted third-party payment gateways who are PCI-DSS compliant.
Transaction Data: Details about products you have purchased from us, order history, and customer service correspondence.
Account Credentials: Username and password (hashed and encrypted).

b. Automatically Collected Information (Device and Usage Data)

As you navigate through and interact with our Site, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

Device Data: IP address, browser type and version, operating system, platform, device type, screen resolution, and language preferences.
Usage Data: Pages visited, time and date of visit, time spent on pages, clickstream data, referring/exit pages, and other diagnostic data to analyze trends and improve our services.
Location Data: General geographic location (country and city-level) derived from your IP address to ensure compliance with regional shipping restrictions.

c. Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to enhance your browsing experience, analyze site traffic, and deliver personalized content. For detailed information on the types of cookies we use and how to manage your preferences, please refer to our Cookie Policy section below.

2. How We Use Your Information

We process your personal data only for legitimate business purposes and in compliance with applicable laws. These purposes include:

Order Processing and Logistics: To process, verify, and ship your orders, manage returns/exchanges, and provide order confirmations and tracking updates. We coordinate with logistics carriers and shipping partners to ensure delivery.
Customer Support: To respond to your inquiries, resolve disputes, and provide technical assistance.
Account Management: To maintain and manage your registered account, including password resets and preference settings.
Marketing and Promotions: To send you marketing emails, newsletters, and promotional offers (only where you have provided explicit consent or where permitted by law). You can opt-out of these communications at any time by using the “unsubscribe” link in our emails.
Legal Compliance and Fraud Prevention: To verify your identity, prevent fraudulent transactions, comply with regulatory obligations (including age verification for age-restricted products), and enforce our Terms and Conditions.
Site Improvement: To analyze usage trends, monitor the effectiveness of our marketing campaigns, and improve the functionality and user experience of our Site.
Trade Compliance: To screen orders against international trade sanctions and embargo lists to ensure we do not process transactions from restricted jurisdictions.

3. Legal Basis for Processing (EEA and UK Users)

If you are located in the EEA or the UK, our legal basis for collecting and using your personal data depends on the specific purpose and is as follows:

Contractual Necessity: Processing is necessary for the performance of a contract with you (e.g., processing your order, arranging shipping, and handling returns).
Legitimate Interests: Processing is necessary for our legitimate interests, such as improving our Site, direct marketing (subject to your rights), fraud prevention, and network security, provided your interests and fundamental rights do not override those interests.
Legal Obligation: Processing is necessary to comply with legal obligations (e.g., tax, customs, and anti-money laundering regulations).
Consent: Where we rely on your explicit consent for processing (e.g., for marketing emails), you have the right to withdraw your consent at any time.

4. How We Share Your Information

We do not sell, trade, or rent your personal data to third parties for their independent marketing purposes. However, we may share your data with the following categories of third-party service providers to enable us to provide our services:

Shipping and Logistics Partners: Carriers (e.g., DHL, FedEx, UPS, national postal services) that require your name, address, and contact number to deliver your orders.
Payment Processors: Secure third-party gateways (e.g., Stripe, PayPal, or local banking partners) that handle payment transactions. They are bound by strict confidentiality and data security obligations.
IT and Hosting Providers: Cloud infrastructure providers, data storage services, and website analytics platforms (e.g., Google Analytics) that help us operate the Site securely.
Customer Service Platforms: Tools that manage support tickets and live chat interactions.
Legal and Regulatory Authorities: When required by law, court order, or governmental regulation, or to protect our rights, property, or safety, and that of our users or others.

All third-party processors are contractually obligated to maintain the confidentiality of your data and process it only in accordance with our instructions and applicable data protection laws.

5. International Data Transfers

XYOLIAN LIMITED is based in Hong Kong. Your information may be transferred to, stored at, and processed in countries outside of your jurisdiction of residence, including Hong Kong, the United States, and the European Union.

For users in the EEA or UK, we ensure that adequate safeguards are in place for such transfers by relying on Standard Contractual Clauses (SCCs) adopted by the European Commission or the UK International Data Transfer Agreement, as applicable. By providing your data, you consent to such transfers in accordance with this Privacy Policy.

    Important Trade Restriction Notice: We strictly comply with international trade embargoes and sanctions. We do not accept orders from, ship to, or engage in any transactions with individuals or entities located in or sanctioned by the following jurisdictions: Burundi, Cuba, North Korea, Sudan, Afghanistan, Belarus, Libya, Myanmar, South Sudan, Iraq, Somalia, Syria, Ukraine, Venezuela, Yemen, Iran, and Russia. We screen all orders against these restricted lists during processing.

6. Data Security

We have implemented robust administrative, technical, and physical security measures to protect your personal data against accidental loss, unauthorized access, alteration, disclosure, or destruction. These measures include:

Secure Sockets Layer (SSL) encryption for all data transmitted through our Site.
Restricted access to personal data to only those employees, agents, and service providers who require such access to perform their duties.
Regular security assessments and vulnerability scanning of our systems.
Data minimization principles, ensuring we only collect what is strictly necessary.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.

7. Data Retention

We will retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy and to comply with our legal obligations (e.g., tax, accounting, and customs regulations, which generally require us to retain transactional records for 7 years).

Criteria used to determine our retention periods include:

The duration of your relationship with us (e.g., active account status).
Whether we have a legal or regulatory obligation to retain the data.
Whether retention is advisable in light of our legal position (e.g., pending litigation or regulatory investigations).

After the retention period expires, your data will be securely deleted or anonymized for analytical purposes.

8. Your Data Protection Rights

Depending on your location, you may have certain rights regarding your personal data. We are committed to facilitating the exercise of these rights.

For EEA, UK, and Swiss Users (GDPR Rights):

Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure (“Right to be Forgotten”): Request deletion of your data where there is no compelling reason for its continued processing.
Right to Restrict Processing: Request that we suspend processing your data.
Right to Data Portability: Request transfer of your data to you or a third party in a structured, machine-readable format.
Right to Object: Object to processing based on legitimate interests, including direct marketing.
Right to Withdraw Consent: Withdraw consent at any time where we rely on consent for processing.

For California Residents (CCPA Rights):

Right to Know: Request disclosure of the categories and specific pieces of personal data collected, used, disclosed, or sold.
Right to Delete: Request deletion of your personal data.
Right to Opt-Out of Sale: We do not sell your personal data; however, you may contact us to opt-out of any data sharing for cross-context behavioral advertising.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, please contact us at info@hnmjmi.com. We will respond to verified requests within 30 days (or as required by applicable law). We may need to verify your identity by requesting specific information to confirm your identity before fulfilling your request.

9. Cookies and Similar Tracking Technologies

We use cookies to enhance your experience, remember your preferences, and analyze site usage. Cookies are small text files placed on your device by a web server.

Essential Cookies: Necessary for the operation of our Site (e.g., shopping cart, login sessions, and security). These cannot be disabled.
Preference Cookies: Remember your choices and settings (e.g., language, currency).
Analytics/Performance Cookies: Help us understand how visitors interact with our Site (e.g., Google Analytics). We use anonymized IP addresses to protect your identity.
Advertising/Marketing Cookies: Used to deliver relevant advertisements and track campaign performance.

You can manage or disable cookies via your browser settings. However, disabling certain cookies may affect the functionality of our Site. For more detailed information, please see our separate Cookie Policy or contact us at info@hnmjmi.com.

10. Children’s Privacy

Our Site and products are not intended for use by individuals under the age of 18 (or the legal age for purchasing tobacco-related accessories in their jurisdiction). We do not knowingly collect personal data from minors. If we discover that we have inadvertently collected data from a minor, we will take immediate steps to delete such information. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

11. Third-Party Links

Our Site may contain links to third-party websites or services (e.g., payment gateways, social media platforms) that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of these third-party sites. We encourage you to review the privacy policies of every site you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational needs. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the “Last Updated” date at the top. We encourage you to review this policy periodically. Your continued use of our Site after any modifications constitutes your acceptance of the revised terms.

13. Contact Us

If you have any questions, comments, or concerns about this Privacy Policy, our data handling practices, or if you wish to exercise your data protection rights, please do not hesitate to contact us.

Company Name: XYOLIAN LIMITED

Registered Address: FLAT E15 10/F WONG KING INDUSTRIAL BUILDING 2-4 TAI YAU STREET SAN PO KONG KL

Email Address: info@hnmjmi.com

Data Protection Officer (DPO) Contact: For privacy-specific inquiries, please use the email above with the subject line “ATTN: Privacy Officer”.

This Privacy Policy is published in English. In the event of any discrepancy between the English version and any translation, the English version shall prevail.