1. Scope & Data Controller
This policy applies to personal information collected through our website (www.fabulk.com), mobile application, and related services (collectively, the "Service").
Data Controller: If you are located in the EU, EEA, UK or Switzerland, Hong Kong Nihao Technology Co., Ltd. is the service provider and data controller responsible for your personal information.
2. What Information Do We Collect?
2.1 Information You Provide
- Account & Profile: Mobile phone number, email address, login credentials, profile photo, username, account settings and preferences.
- Purchases: Transaction history, payment information, shipping address (city, state, country, postal code), recipient contact info. For certain Spanish addresses (Ceuta, Melilla, Canary Islands), we collect ID numbers (NIF/CIF/NIE) solely for customs clearance.
- Customer Support: Communication history via support functions, social media, or other channels.
- User-generated Content: Profile pictures, photos, videos, audio, comments, messages, and associated metadata.
- Promotions: Contact info and preferences when participating in contests, sweepstakes, surveys, or marketing communications.
2.2 Information from Third-Party Sources
- Data Providers: Demographic and fraud detection information.
- Affiliate & Marketing Partners: Affiliate networks, publishers, influencers, and business partners.
- Public Authorities: Information necessary to comply with obligations or investigate claims/crimes.
- Social Media Services: Username, profile picture, and email if you register/login via third-party services.
- Logistics Providers: Delivery progress and address information for order fulfillment.
2.3 Information Collected Automatically
- Device Data: Device model, OS, language settings, unique identifiers (including advertising IDs).
- Usage Information: Pages viewed, duration, referral source, interactions, email opens and clicks.
- Location Data: Approximate location based on IP address.
- Cookies & Similar Technologies: Used for analytics, personalization, advertising, and performance measurement. See our Cookie Policy for details.
3. How and Why We Use Your Information
Create/maintain profiles, enable security features (e.g., SMS/email codes).
Process orders, payments, delivery, and communicate about transactions.
Optimize features, analyze metrics, fix errors, create deidentified/aggregated data.
Recommend features/products and tailor your experience.
Send updates, security alerts, administrative messages, and respond to inquiries.
Direct marketing, abandoned cart reminders, interest-based advertising (per DAA principles).
Detect/investigate fraud, unauthorized access, Terms violations, and cyberattacks.
Comply with laws, respond to subpoenas, enforce terms, protect rights/privacy/safety.
5. Your Rights and Choices
If you are a Data Subject under GDPR/UK law, you may exercise the following rights:
Right to Know / Access
Obtain confirmation of processing and access to your Personal Data.
Right to Erasure
Request deletion when data is no longer necessary, consent is withdrawn, or processing is unlawful.
Right to Rectification
Request correction of inaccurate Personal Data.
Right to Restriction of Processing
Request restriction while accuracy is contested or processing is unlawful but erasure is opposed.
Right to Data Portability
Receive your data in a structured, machine-readable format and transmit it to another controller.
Right to Object
Object to processing based on legitimate interests or direct marketing at any time.
Right to Withdraw Consent
Withdraw consent at any time without affecting prior lawful processing.
Automated Decision-Making
Fabulk does NOT make decisions based solely on automated processing that produce legal effects.
Lodge a Complaint
File a complaint with the China Data Protection Commission or your local supervisory authority.
Opt-Out Options
- Email: Click "unsubscribe" at the bottom of promotional emails.
- Mobile Alerts: Reply "STOP" to any SMS alert or follow in-message instructions.
- Push Notifications: Adjust in your mobile device notification settings.
- Cookies: Manage via browser settings or visit allaboutcookies.org.
- Do Not Track: We currently do not respond to DNT signals. Learn more at allaboutdnt.com.
6. Our Global Operations and Data Transfers
Data of users in the EU, EEA, UK, and Switzerland is stored by default in EEA-based cloud infrastructure. Non-fulfillment personal data (account/profile) is NOT transferred outside these regions.
When transfers outside the EU/EEA/UK/Switzerland are necessary (e.g., for order fulfillment), we ensure adequate protection through:
- Adequacy Decisions: European Commission Article 45 GDPR recognitions.
- Standard Contractual Clauses (SCCs): Approved clauses under Article 46 GDPR for countries without adequacy decisions.
- Derogations: Applicable law exceptions in specific situations.
7. Legal Basis (GDPR / UK Data Protection Laws)
| Legal Basis | When Applied |
|---|---|
| Performance of Contract | Providing Services, communicating about them, fulfilling Terms of Use. |
| Legitimate Interests | Service optimization, fraud prevention, security, interest-based advertising. |
| Consent | Specific purposes communicated to you; withdrawable at any time. |
| Legal Obligation | Compliance with laws, subpoenas, government requests, internal audits, enforcement. |
8. Data Security, Retention & Children
Security Measures
We implement technical and administrative safeguards against loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. Credit card handling follows PCI-DSS standards. However, security risk is inherent in all internet technologies.
Data Retention
We retain personal information to fulfill collection purposes, satisfy legal/accounting/reporting requirements, establish/defend legal claims, and prevent fraud. When no longer needed, data is deleted or anonymized.
Children
9. Changes to This Policy & Contact Us
We reserve the right to modify this Privacy Policy. Material changes will be notified by updating the date, posting on the Service, and/or providing required notices. Modifications are effective upon posting.
Contact Our Data Protection Office
Attn: Data Protection Office