Privacy policy

Last updated: August 22, 2026

1. Introduction

Nankun ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what information we collect when you visit nankunart.com or place an order through our online store (the "Website"), how we use it, who we share it with, and the rights you have over it.

Nankun is a trading name of NANKUN INTERNATIONAL LIMITED, a company registered in the Hong Kong Special Administrative Region of the People's Republic of China. We act as the data controller for the personal data described in this policy.

This policy applies wherever local law does not require us to do otherwise. Where you are located in the European Economic Area, the United Kingdom, Switzerland, California, or another jurisdiction with specific data protection laws, the additional rights described in Section 10 apply to you.

2. Information We Collect

We collect only the information necessary to operate our store and fulfil your orders:

  • Order and shipping information: your name, email address, shipping and billing address, phone number, and order details. We need this to produce, dispatch, and deliver your order and to contact you about it.
  • Payment information: when you make a purchase, your payment is processed by our payment processor, Stripe (which powers Shopify Payments). We do not store your full credit or debit card number, card verification code, or other complete payment credentials on our servers. See Section 4 for details.
  • Account information: if you create a customer account, your name, email address, password (stored in encrypted form), saved addresses, and order history.
  • Communications: if you contact us by email, we keep the correspondence and your contact details so we can respond and keep records of our communications.
  • Technical information: standard technical data automatically collected when you browse the Website, such as your IP address, browser type and version, device type, operating system, referring page, and pages visited. This is collected through cookies and similar technologies (see Section 5).

We do not collect special categories of personal data (such as data revealing racial or ethnic origin, religious beliefs, or health information), and we ask you not to include such information in messages to us.

3. How We Use Your Information

We use your personal information for the following purposes:

  • To fulfil your orders — producing your hand-painted piece, quality control, dispatch, delivery, and insurance (including sending you photographs of your finished piece for approval before dispatch).
  • To provide customer service — responding to enquiries, handling returns, replacements, and refunds.
  • To process payments and prevent fraud — verifying payment details and detecting and preventing fraudulent or unlawful transactions.
  • To comply with legal obligations — tax, accounting, customs, and other record-keeping requirements under Hong Kong law and the laws of your jurisdiction.
  • To operate and improve the Website — understanding how the Website is used, maintaining site security, and diagnosing technical problems.
  • To send you marketing communications — only if you have expressly opted in. You may unsubscribe at any time using the link in any email or by contacting us.

Legal bases (EEA/UK): where the EU or UK General Data Protection Regulation applies, we rely on: (a) performance of a contract for order processing, fulfilment, and customer service; (b) our legitimate interests in site security, fraud prevention, and improving our store; (c) your consent for marketing emails and non-essential cookies; and (d) compliance with legal obligations for record-keeping.

4. Payment Processing (Stripe)

All payments on the Website are processed by Stripe, our third-party payment processor, through Shopify Payments. When you make a purchase:

  • Your payment data is transmitted directly to Stripe and is processed in accordance with the Stripe Privacy Policy and Stripe's terms of service.
  • We do not collect or store your full card number, expiry date, or card verification code on our servers.
  • Stripe is certified as a PCI DSS Level 1 service provider, the highest level of certification in the payments industry.
  • We receive from Stripe only the minimum transaction information needed to confirm your payment and handle refunds (such as the payment status, the last four digits of your card, and the card brand).
  • If you request a refund, we process it through Stripe to your original payment method.

By submitting a payment on the Website, you also agree to Stripe's processing of your data as described in the Stripe Privacy Policy linked above.

5. Cookies and Similar Technologies

The Website uses cookies and similar tracking technologies to keep the store functioning, remember your preferences, and understand how the site is used:

  • Strictly necessary cookies — required for the shopping cart, checkout, and site security. These cannot be disabled.
  • Functional cookies — remember choices such as your language and currency preferences.
  • Analytics cookies — help us understand how visitors use the Website (pages visited, time on site, referral source) so we can improve it.

The Website is hosted on the Shopify platform; Shopify sets and processes cookies as described in the Shopify Cookie Policy. You can manage or delete cookies through your browser settings at any time; blocking strictly necessary cookies may prevent the checkout from working.

You may also exercise opt-out preferences through your browser's "Do Not Track" setting or a recognized Global Privacy Control signal where applicable.

6. How We Share Your Information

We do not sell, rent, or trade your personal information. We share it only with the following categories of recipients, strictly as needed to operate our business:

  • Our e-commerce platform, Shopify — hosts the Website and processes orders, checkout, and customer accounts. See the Shopify Privacy Policy.
  • Our payment processor, Stripe — processes payments and refunds as described in Section 4.
  • Shipping and logistics providers — DHL and FedEx, to deliver your order and provide tracking. We share only the name, address, phone number, and order information needed for delivery and customs clearance.
  • Email service providers — to send transactional emails (order confirmations, dispatch notifications, approval photos) and, with your consent, marketing emails.
  • Professional advisers and authorities — accountants, auditors, and legal advisers; and public authorities such as customs or tax authorities, where we are legally required to do so.

Where we work with service providers, we select ones that provide adequate data protection and allow them to process data only on our instructions.

7. International Data Transfers

We are based in Hong Kong, and our service providers operate globally. Your personal information may be processed in the United States, Canada, Europe, or other countries where Shopify, Stripe, DHL, FedEx, or our email providers operate — which may be outside your own country.

Where required by law (for example, under the GDPR), such transfers are protected by appropriate safeguards, including the European Commission's Standard Contractual Clauses adopted by our service providers and, where applicable, certification under the EU–US Data Privacy Framework. A copy of the relevant safeguards can be requested from us using the contact details in Section 13.

8. Data Retention

We keep your personal information only as long as necessary for the purposes described in this policy:

  • Order, payment, and accounting records: retained for up to 7 years after the relevant transaction, as required by the record-keeping obligations of the Hong Kong Companies Ordinance and applicable tax law.
  • Customer account data: retained while your account is active; deleted or anonymized within a reasonable period after you close your account, except for data we must keep for legal reasons.
  • Marketing consent records: retained until you withdraw consent, plus the minimum period needed to evidence that your consent was given and withdrawn.
  • Customer communications: retained for up to 3 years after the last contact, after which they are deleted.

When retention periods expire, personal data is deleted or irreversibly anonymized.

9. Data Security

We use appropriate technical and organizational measures to protect your personal information, including encrypted transmission (TLS/HTTPS) across the Website and checkout, restricted access to customer data on a need-to-know basis, and secure handling of account credentials by the Shopify platform.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and the relevant supervisory authorities where required by law.

10. Your Privacy Rights

Depending on where you live, you may have the following rights over your personal data:

EEA, UK, and Switzerland (GDPR): the right to access, rectify, or erase your personal data; to restrict or object to our processing; to data portability; and to withdraw consent at any time for processing based on consent. You may also lodge a complaint with your local data protection supervisory authority.

California (CCPA/CPRA): the right to know what personal information is collected about you and whether it is sold or shared; the right to request deletion and correction of your personal information; and the right to opt out of any sale or sharing. We do not sell or share your personal information as defined by California law, so no opt-out is necessary. You will not be discriminated against for exercising these rights.

Hong Kong (PDPO): the right to request access to and correction of your personal data held by us, and to complain to the Office of the Privacy Commissioner for Personal Data if you believe our handling of your data breaches the Personal Data (Privacy) Ordinance.

To exercise any of these rights, contact us at nankuntairuo@gmail.com using the subject line "Privacy Request." We will verify your request and respond within 30 days. Requests are free of charge; we may ask for additional information solely to confirm your identity.

11. Children's Privacy

The Website is not directed at children. You must be at least 18 years of age to create an account or place an order, as stated in our Terms of Service. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The current version will always be posted on this page with its "Last updated" date. Material changes will be highlighted on the Website or communicated to you by email where required by law. Your continued use of the Website after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us:

  • Company: NANKUN INTERNATIONAL LIMITED
  • Address: Flat 1506, 15/F, Cheung Fung Comm Bldg, 21-25 Cheung Sha Wan Road, Sham Shui Po, Kowloon, Hong Kong
  • Email: nankuntairuo@gmail.com
  • Website: nankunart.com

We aim to respond to all enquiries within 1–2 business days.