Purposes and Methods of Data Processing

• Transaction Processing & Service Support: Collecting your name, purchase details, and payment information to complete order delivery, process returns/exchanges, and provide necessary after-sales technical support.
• Communication & Feedback: Used to respond to your inquiries and send order status updates. We may use your contact information to send important notices (such as changes to terms and policies); because this information is vital to transaction fulfillment, you generally cannot opt out.
• Security & Anti-Fraud: Aimed at protecting the safety of users, employees, and this platform, preventing financial loss, and preempting fraudulent behavior, including risk screening for abnormal orders.
• Personalized Experience: Provided you have opted into personalized settings, we will use collected information to recommend products that better match your preferences or provide customized communication content.
• Legal Compliance: Used to fulfill tax filing obligations or comply with regulatory requirements in the relevant jurisdiction.

Legal Basis for Data Processing

• Contractual Fulfillment: Necessary to complete your orders and service agreements.
• Your Consent: Applied in specific scenarios where you have provided explicit authorization (e.g., subscribing to marketing content).
• Legal Obligations: To comply with mandatory legal requirements such as accounting and taxation.
• Legitimate Interests: Used to improve our service quality and security, provided it does not infringe upon your interests, rights, or expectations.

Note on Automated Decision-Making

We commit that we will not use algorithms or automated profiling methods to make any decisions that would have a legal or significant impact on you without human intervention and review.

Data Retention Period and Disposal

• Retention Assessment: We carefully evaluate the necessity of retaining data. If the data is no longer required by law or for business operations, we strive to retain it for the shortest period permitted by law.
• Storage Limitations: Once the retention period expires, your personal data will be permanently deleted or deeply anonymized so that it can no longer be re-associated with your personal identity.
• Special Retention: We may retain necessary copies of data beyond the aforementioned periods only when involved in specific legal obligations such as litigation, tax audits, or crime prevention.

Global Processing and Storage

• Your personal data is typically stored on our global core servers. Regardless of where your data is located, NirvanaLotus applies the same rigorous security measures.
• We comply with all applicable laws in various jurisdictions regarding the cross-border transfer of personal data to ensure your information receives consistent legal protection worldwide.

Legal Basis for Cross-Border Transfer

• Standard Contractual Clauses (SCCs): For personal data transfers involving the European Economic Area (EEA), the UK, and Switzerland, we implement internationally recognized “Standard Contractual Clauses” to ensure the security of data in transit.
• Regional Compliance: For example, we strictly adhere to the Personal Information Protection Law (PIPL) for users in Mainland China and follow CCPA requirements for users in California.

Third-Party Service Providers

• For the processing purposes described in this policy (such as international logistics and global payment settlement), we may transfer necessary data to third-party partners located outside your country of residence. These partners are required to sign strict data processing agreements to ensure that data remains secure and controlled after being transferred abroad.

Global Compliance Certification

• Our privacy practices are designed to align with major global cross-border privacy frameworks (such as the spirit of the Global CBPR framework). We are committed to ensuring that our global business operations meet high security standards for data flow through continuous internal compliance reviews.

Service Restrictions

Our website and product offerings are primarily intended for adults. We do not knowingly solicit or collect personal data from individuals we know to be children.

Parental Authority and Consent

• If a child needs to use our services or interact with our platform under parental guidance, prior review and explicit consent from a parent or guardian must be obtained.
• We encourage parents and guardians to monitor their children’s online activities to ensure their privacy remains protected.

Management and Deletion Mechanisms

• Proactive Erasure: If we become aware that we have collected personal data from a child without proper parental authorization, we will employ technical measures to permanently delete such data from our servers as quickly as possible.
• Parental Requests: If you, as a parent or guardian, discover that your child has provided information to us without your consent, please contact us immediately at legal@nirvanalotus.com. Upon verification, we will prioritize the de-registration and destruction of the relevant data.

Commitment to Response Speed

We take your privacy concerns seriously. Our compliance team reviews every inquiry to determine the best way to address your specific issue.

• Response Timeframe: In most cases, substantive privacy inquiries or requests will receive a response within 7 business days.
• Complex Situations: For more complex requests, we may notify you if additional information or a longer processing time is required, maintaining full transparency regarding our progress.

Continuous Improvement Mechanism

Your feedback is a vital reference for enhancing our services.

• Process Optimization: If a complaint indicates room for improvement in our privacy handling, we will take steps to implement systemic updates at the next reasonable opportunity.
• Problem Resolution: If a privacy issue has had a tangible impact on you or other users, we will take proactive measures to work with you toward a resolution.

Right to Lodge a Complaint

If you are unsatisfied with our response, you may lodge a complaint with the relevant regulatory authority in your country or region at any time. If you consult us regarding this, we will provide information on applicable complaint channels based on your specific circumstances.

Policy Change Notifications

This Privacy Policy is updated periodically to reflect changes in the legal environment or our business operations.

• Direct Contact: If we have valid contact information for you, we will also notify you of significant changes directly via email or other methods.
• Proactive Notification: When material changes are made to this policy, we will post a notice in a prominent location on this website at least 7 days in advance.