Legal
Privacy policy
What we collect, why we collect it, who we share it with, and how to make us stop.
This page is a working draft. Items marked [TO CONFIRM] — the registered company name, its address, retention periods and transfer safeguards — still have to be completed and reviewed. Until then, read it as our stated intent rather than a final policy.
Who we are
Qi House is an online store selling Eastern living objects — incense, tea, jade, textiles and studio craft — sourced from named makers in China and shipped worldwide. The store is operated by [TO CONFIRM: registered company name], registered at [TO CONFIRM: registered address] (“Qi House”, “we”, “us”).
Where the EU or UK General Data Protection Regulation applies, we are the data controller for the personal data described below.
What we collect
We collect only what we need to sell to you and ship to you.
- Account data — your email address and the display name you choose. If you sign in with a one-time email code, we store the address the code was sent to.
- Order data — recipient name, email, phone number, shipping address, country or region, the items ordered and the order total. A sale is not possible without this, and customs and tax records require it.
- Messages — anything you send us through the contact form, the wishes-and-messages area of your account, or the live chat on the site.
- Basic technical data — the pages you visit and the errors your browser reports back, used to keep the store working. We do not build advertising profiles.
We do not collect or store card numbers. At present no card is charged on this site at all: you place an order and we confirm the payment method with you directly (see the Terms of service). If we later take card payments, they will be handled by a payment provider and the card details will never reach our servers.
Why we use it
We use your data for four reasons, and each has a lawful basis:
- To perform our contract with you — taking the order, shipping it, handling returns and answering questions about an order.
- To meet legal obligations — customs, tax and accounting records.
- For our legitimate interests — keeping the store secure, preventing fraudulent orders, and understanding which pages work so we can improve them. We weigh these against your rights, and you may object at any time.
- With your consent — the newsletter, and any non-essential cookies where consent is required. You may withdraw consent at any time; it does not affect orders already placed.
Cookies and similar technologies
We use a small number of cookies and browser storage keys that the store needs in order to work: keeping you signed in, remembering the language you picked (English or 中文), and holding the contents of your bag on your own device. We also load a live-chat widget from Tawk.to, which sets its own cookies when it starts. [TO CONFIRM: whether analytics or marketing tools are added, and whether a consent banner is required in your markets] You can block or delete cookies in your browser; if you block the essential ones, the bag and sign-in will stop working.
Who we share it with
We do not sell personal data and we do not share it for advertising. We pass it only to the companies that do the work, and only the part they need:
- Hosting and database — the store and its data run on cloud infrastructure operated by our hosting provider.
- Delivery — the courier carrying your parcel needs the recipient name, address and phone number.
- Live chat — Tawk.to processes the conversations you start in the on-site chat window.
- Payment — once a payment provider is in place it will receive the amount and the order reference. [TO CONFIRM: payment provider]
- Advisers and authorities — where we are legally required to disclose, for example to customs or tax authorities.
Sending data outside your country
Our store and database are hosted outside the European Economic Area, and our team is based in China. When you order from the EU or UK, your data is transferred to and processed in those locations so that we can fulfil the order. Where the law requires it, we put safeguards in place for those transfers. [TO CONFIRM: which transfer mechanism applies, e.g. standard contractual clauses, once the selling entity is fixed]
How long we keep it
- Account data — while your account is open, and for 24 months after your last activity, so that a returning customer is not treated as a stranger.
- Order data — for as long as tax and customs rules require. [TO CONFIRM: exact retention period, typically 6–10 years]
- Contact form and chat messages — 24 months after the conversation closes, unless they relate to an order, in which case the order period applies.
- Newsletter — until you unsubscribe.
Your rights
Depending on where you live, you may have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent you have given. You also have the right to complain to your local data protection authority.
We answer requests within 30 days. We may ask you to verify that you control the account before we act, because we will not hand your orders to someone else on request.
Security
Access to order data is enforced by row-level security on the server: a signed-in account can read only its own orders, wishes and messages. Administrative access is limited to named staff accounts and changes to that list can only be made from our operations side, not from the store itself.
No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority as the law requires.
Children
The store is not intended for children. We do not knowingly collect personal data from anyone under 16, and we do not sell to them. If you believe a child has given us data, write to us and we will delete it.
Changes to this policy
We will update this page when our practice changes, and change the “last updated” date at the top. Where a change materially affects existing customers, we will announce it on the site rather than relying on you to re-read a silent edit.
How to contact us
For any question about this policy, or to exercise any right described above, write to us. We aim to reply within 30 days.
This document is provided in English and Chinese. If the two versions differ, the English version prevails.