Privacy Policy

1. Our Commitment
We appreciate your trust in us. We are committed to protecting your privacy by taking all reasonable precautions and complying with all applicable laws and regulations regarding the protection of personal data to ensure the security and proper use of your personal information. The purpose of this Privacy Policy is to help you understand the types of personal data we collect, how we use and protect your personal data, and your rights and choices.

2. Categories of Personal Data We Collect
The categories of personal data we collect include, but are not limited to:

a. Your title, name, gender, phone number, email address, residential address, mailing address, billing address, delivery address, or other contact details; your birth month and date; your payment or credit card details; username and password; and any other personal data voluntarily provided by you; and

b. Your computer, mobile phone, or other electronic/communication device’s IP address, real-time location data, browser settings, browsing history, referral website that directed you to our platform, and other internet-related data.

3. Collection of Your Personal Data
We may obtain your personal data through various means, such as:

a. When you make purchases at our online or physical stores;
b. When you participate in our events or promotions;
c. When you apply for or use our membership card or participate in any of our membership or promotional programs;
d. When you register an account with us;
e. When you participate in any surveys or marketing activities;
f. When you log in to visit our website, use our mobile application, or browse any of our social media pages;
g. When you use WiFi services in our stores or at our events;
h. When you contact us in person, by phone, email, or any social media platform to make inquiries or provide information;
i. When verifying your identity;
j. When you subscribe to our marketing or promotional materials.

You may choose not to provide the requested personal data, but if you do so, we may not be able to provide you with our products, services, or offers, or you may not be able to log in to our platform or use certain features.

You have the right to request access to, correction, updating, or deletion of your personal data. If you reside in the European Union, you have additional rights regarding your personal data. Please refer to Section 11, "Data Subject Rights."

4. Purposes of Collecting Personal Data
Your personal data may be used for one or more of the following purposes ("Purposes"):

a. To communicate with you;
b. To verify your identity and any accounts you have with us;
c. To manage any membership, marketing, promotional offers, or corporate activities we participate in, including providing you with the benefits you are entitled to;
d. To process your orders for products or services (e.g., saving your shopping cart contents, making billing, payment, refund, and delivery arrangements);
e. To handle and respond to your inquiries, suggestions, or complaints;
f. To conduct customer surveys or organize events for customers;
g. To provide you with customer service;
h. To perform analysis to better understand customer needs and improve our service and product quality;
i. To personalize the content of our shopping website/mobile application and social media platforms to enhance your customer experience;
j. To design specific promotional offers;
k. To conduct advertising campaigns, including targeted advertising;
l. To carry out direct marketing activities;
m. To fulfill our obligation to maintain records of processing activities;
n. To comply with legal, regulatory, or compliance requirements, handle inquiries from law enforcement or regulatory authorities, or seek legal advice; and
o. Any other purposes directly related to any of the above.

We will only collect personal data that is necessary or directly related to the specified Purposes. If we intend to use your personal data for purposes not listed above, we will obtain your consent before doing so.

5. Direct Marketing
We will use your personal data for direct marketing, including promotions and advertisements for the CENY BIOTECHNOLOGY LIMITED that engage in the sale of cosmetic and beauty products). We will not provide your personal data to third parties for direct marketing purposes.

If you wish to opt out of receiving direct marketing communications, you may contact our customer service officers using the methods listed under "Contact Us" to indicate your preference or request changes to your preferences (free of charge). If you receive direct marketing communications via email, please use the provided unsubscribe link to stop receiving such messages.

For customers in Hong Kong and Singapore, we will not use your personal data for direct marketing without your consent. We will use your personal data (e.g., name, mobile number, email address, and/or residential address) to inform you about our latest products and/or marketing campaigns.

For customers in Singapore and Malaysia, we will use your personal data as necessary to provide you with goods and services, and you consent to our processing of your personal data in accordance with this Privacy Policy. If you consent to our use of your personal data for advertising or direct marketing, we will continue sending you relevant information until you opt out.

For customers in the European Union, unless you object to direct marketing, we rely on legitimate interests as the legal basis for using your personal data for direct marketing. You have the right to opt out of direct marketing at any time. You may (a) contact our customer service officers using the methods under "Contact Us" or (b) click the unsubscribe link in marketing emails. We will keep a record of your decision, and your opt-out will not affect the legality of our prior processing of your personal data.

6. Use of Your Personal Data
We will process (including but not limited to collecting, storing, retaining, using, transferring, and disclosing) your personal data in compliance with relevant laws and regulations. We will ensure that your data is secure, accurate, and up to date, and will not retain it longer than necessary.

7. Legal Basis for Processing Personal Data of EU Customers
We lawfully process your personal data based on the following grounds:

Legitimate Interests
We may use your personal data to pursue our legitimate interests, provided these interests do not override your fundamental rights and freedoms.

We believe we have a legitimate basis for processing your personal data, including but not limited to:

Providing services to you, including verifying your identity and any accounts you hold with us, managing membership or marketing activities, processing your orders (e.g., billing, payments, refunds, and delivery arrangements), responding to your inquiries, conducting analytics, and performing direct marketing activities within your expectations;

Complying with legal obligations (e.g., anti-money laundering and counter-terrorism laws);

Improving our understanding of customer needs and enhancing service quality;

Ensuring the smooth operation of our services;

Protecting our systems from unauthorized access or cyberattacks; and

Safeguarding the commercial interests of our shareholders.

Consent
We may process your personal data based on your consent, which must be:

Freely given (without coercion);

Informed (you must be fully aware of what you are consenting to);

Specific (we will seek separate consent for different purposes, avoiding bundled consent); and

Explicit (we will obtain your consent through clear affirmative actions, such as ticking a checkbox).

You have the right to withdraw consent at any time. Please refer to the "Contact Us" section below for details.

Contractual Necessity
We may process your personal data to fulfill contractual obligations (e.g., collecting credit card or bank details to process payments).

Legal Compliance
We may also process your personal data to comply with legal obligations.

8. Data Collected Through Automated Means
Cookies are small data files stored on your device when you browse websites. We use cookies for various purposes:

a. Essential Cookies – Necessary for website functionality (e.g., login access). Disabling these may impair site performance.
b. Functional Cookies – Enhance user experience (e.g., remembering preferences). These do not track browsing activity on other sites.
c. Targeting Cookies – Often provided by third parties (e.g., Google Analytics) to track browsing behavior for advertising. You may disable these.

By continuing to browse without adjusting settings, you consent to our cookie usage. Note that blocking certain cookies may restrict access to parts of our website.

We also collect data via web server logs (e.g., IP addresses, search queries) for analytical purposes.

9. Closed-Circuit Television (CCTV)
Our stores use CCTV for security. Footage is handled per data protection laws and retained only as long as necessary.

10. Data Sharing and Transfers
We may disclose your personal data to:

Affiliates (e.g., CENY BIOTECHNOLOGY LIMITED) and third-party service providers (locally or internationally), with safeguards ensuring compliance with data protection laws.

Legal/regulatory authorities where required (e.g., insurance claims, mergers).

11. Data Subject Rights
General Rights (All Customers)
Request access to, correction, or deletion of your personal data.

Withdraw consent (where applicable).

Singapore Customers
Withdraw consent in writing via "Contact Us" (may affect service availability).

Malaysia Customers
Opt out of direct marketing or withdraw consent via "Contact Us".

EU Residents (Under GDPR)
Right to Object – Oppose processing based on legitimate interests, public tasks, or direct marketing.

Right to Withdraw Consent – Revoke previously given consent.

Right to Access – Request a copy of your data (may incur fees for unfounded/repetitive requests).

Right to Erasure ("Right to Be Forgotten") – Request deletion if:

Data is no longer necessary;

Processing was unlawful; or

You withdraw consent.

Right to Restrict Processing – Limit processing if:

Data accuracy is contested;

Processing is unlawful but you oppose erasure; or

Data is needed for legal claims.

Right to Rectification – Correct inaccurate/incomplete data.

Right to Data Portability – Receive your data in a transferable format.

Right to Lodge Complaints – Report violations to your local supervisory authority.

To exercise these rights, contact us via "Contact Us".

12. Data Retention
We retain personal data only as long as necessary for the stated purposes, after which it is securely deleted or anonymized.

13. Data Security
We implement measures to protect against unauthorized access, loss, or misuse of your personal data.

14. Third-Party Websites
This policy does not apply to third-party sites linked from our platforms. Review their privacy policies separately.

15. Children’s Policy
Our services are not intended for users under 16. Minors must obtain parental consent before providing personal data.

16. Policy Updates
We may amend this policy and will post updates on our website/platforms. Check periodically for changes.

17. Contact Us
For questions or to exercise your rights:

Online Shoppers: Contact our customer service team.

[1] You may request us to restrict the processing of your personal data under the following circumstances:
(a) When you contest the accuracy of the data we process about you. In this case, the processing of your personal data will be restricted until the accuracy is verified;
(b) When you object to our processing of your personal data based on legitimate interests. In this situation, you may restrict our processing until we verify our overriding legitimate grounds;
(c) When we process your personal data unlawfully, but you choose to restrict processing rather than request erasure;
(d) When we no longer need your personal data for processing, but you require it to establish, exercise or defend legal claims.

Note: If processing is restricted under these circumstances, we will only store your data and will not process it further until:
(i) The relevant issue is resolved;
(ii) We obtain your consent; or
(iii) The processing becomes necessary for the establishment, exercise or defense of legal claims, for the protection of another person's rights, or for reasons of important public interest recognized in the EU or a member state.

We will notify any third parties to whom we have disclosed your personal data about such restrictions, unless this proves impossible or involves disproportionate effort.