Privacy policy

Who we are

ABULU (“we”, “us”) is the data controller for the personal data described in this policy. Our registered details are:

• Legal entity: [LEGAL ENTITY NAME]
• Registered address: [REGISTERED ADDRESS]
• Business registration number: [VAT / REGISTRATION NUMBER]
• Privacy contact: [SUPPORT EMAIL]

Questions about this policy, or a request to exercise your rights, can be sent to that email address or to us on WhatsApp.

What we collect

Category	Examples
Order details	Name, delivery address, email address, phone number (if you give one), order contents and value
Artwork you send	Logos, sketches and photos you upload or send us for custom orders
Conversations	Messages you send us on WhatsApp or by email, including your phone number in that channel
Technical data	IP address, browser type, device type, pages viewed, and the site you arrived from
Payment confirmation	Confirmation that a payment succeeded, the amount, and a PayPal transaction reference

We never receive or store your card number, CVV or bank credentials. Those are entered directly into PayPal and never reach our servers.

Why we use it, and our legal basis

Purpose	Legal basis (GDPR)
Making, packing and shipping your order	Performance of a contract
Customer support, returns and refunds	Performance of a contract
Fraud prevention and dispute handling	Legitimate interests
Meeting tax, accounting and consumer-law duties	Legal obligation
Marketing emails you subscribed to	Consent — withdrawable at any time
Analytics and site improvement	Consent, where required by local law

Where we rely on consent, you can withdraw it at any time and we stop the processing. Withdrawing consent does not affect orders already placed.

Payments

Payments are processed by PayPal. When you check out, your card details go straight to PayPal, and we receive only a confirmation that the payment succeeded together with a transaction reference.

PayPal processes your data as an independent controller for its own payment, fraud-prevention and regulatory purposes. Its handling of your data is governed by PayPal’s own privacy statement.

Cookies and analytics

We use cookies and similar technologies for three purposes:

• Essential — keeping your cart and checkout session working. These cannot be switched off.
• Analytics — understanding which pages are used, so we can improve them. These are only set with your consent.
• Marketing — measuring whether our own advertising brought you here. Only set with your consent.

You can change your choice at any time through the cookie banner, or by clearing cookies in your browser. Blocking essential cookies will prevent checkout from working.

Who we share it with

We share personal data only with service providers who need it to do a job for us:

• PayPal — payment processing and fraud checks
• Shipping carriers and postal operators — delivering your parcel
• Our hosting provider — running this website and storing order records
• Email and analytics providers — order emails, and site analytics where you consented
• Accountants and auditors — where the law requires it

We do not sell your personal data, and we do not share it for anyone else’s marketing.

We may also disclose data where we are legally required to, or to establish or defend a legal claim.

International transfers

We are based in China, and our service providers may process data in other countries, including the United States and the European Union.

Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses, together with the providers’ own safeguards such as the EU–US Data Privacy Framework where applicable.

How long we keep it

Data	Kept for
Order, invoice and payment records	As long as tax and accounting law requires (typically 6–10 years)
WhatsApp and email conversations	Up to 24 months after the last message
Artwork files for custom orders	24 months, so reorders match exactly. Tell us if you want them deleted sooner.
Analytics data	Up to 14 months
Marketing consent records	Until you unsubscribe, plus a short period afterwards as proof of the withdrawal

Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct data that is inaccurate or incomplete
• Delete data we no longer have a lawful reason to keep
• Restrict or object to certain processing, including profiling
• Receive your data in a portable, machine-readable format
• Withdraw consent at any time, where consent is our basis
• Not be discriminated against for exercising these rights (California residents)

To exercise any of these, email [SUPPORT EMAIL]. We respond within 30 days. We may ask you to confirm your identity before acting, and we will not charge you for a reasonable request.

If you are in the EU or UK and are unhappy with our response, you have the right to complain to your national data protection authority.

Security

This site is served over HTTPS. Access to order data is limited to the people who need it to fulfil orders, and payment credentials never touch our systems because PayPal handles them directly.

No method of transmission or storage is perfectly secure, so we cannot promise absolute security. If a breach ever affects your rights, we will notify you and the relevant authority as required by law.

Children

This site is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy to reflect changes in our practices or the law. The date at the top of this page always shows the current version. If a change materially affects you, we will make that clear on the site.