Privacy Policy

This Privacy Policy (“Policy”) describes how Shaolin Toys (“we”, “us”, “our”, the “Brand”) collects, uses, shares, and protects personal information when you visit our website https://shaolin.toys, place an order, use our Standalone Mobile App, or interact with our Telegram bot @ShaolinToysBot (collectively, the “Services”).

This Policy is designed to comply with:

• The EU General Data Protection Regulation (GDPR) and the ePrivacy Directive;
• The UK General Data Protection Regulation (UK GDPR) and PECR;
• The California Consumer Privacy Act as amended by the CPRA and Delete Act (SB 362);
• Applicable data protection laws of other jurisdictions where we offer our Services.

By using the Services, you acknowledge that you have read and understood this Policy.

2.1. For customers in the European Economic Area (EEA) and Switzerland: The data controller is [Legal Entity Name], a company incorporated in [Jurisdiction], registered at [Registered Address]. Pursuant to Article 27 of the GDPR, we have appointed the following EU Representative:

• EU Representative: [EU Representative Company Name]
• Address: [EU address — must be in an EU Member State where our customers are located]
• Email: [EU representative contact email]
• Purpose: The EU Representative may be addressed in addition to or instead of the controller by supervisory authorities and data subjects on all issues related to GDPR processing.

2.2. For customers in the United Kingdom: Pursuant to Article 27 of the UK GDPR, our UK Representative is:

• UK Representative: [UK Representative Company Name]
• Address: [UK address]
• Email: [UK representative contact email]

2.3. For customers in California (USA): The business responsible for personal information under the CCPA/CPRA is [Legal Entity Name]. See Section 9 for California-specific rights.

2.4. For customers in the Russian Federation: Data processing is governed by the separate Russian-language Privacy Policy at /ru/privacy, operated by individual entrepreneur Samokhin Igor Vladimirovich (INN 632138378940).

2.5. General contact channels:

• Privacy & data protection inquiries: legal@shaolin.toys
• Customer support: support@shaolin.toys
• Data Protection Officer (if applicable): dpo@shaolin.toys
• Website: https://shaolin.toys

3.1. Information you provide directly:

• Name (first and last) and shipping address.
• Email address and telephone number.
• Billing information necessary to process payment (processed by our licensed payment processors; we do not store full card numbers).
• Communication content when you contact our support team.
• Account credentials if you choose to create an account for the Digital Companion.

3.2. Information collected automatically:

• IP address (anonymized for analytics where required by local law).
• Device type, operating system, browser type and version.
• Cookie and session identifiers (see Section 11).
• Pages viewed, time spent, referral source, and general navigation patterns.

3.3. Product-related information:

• Unique order identifier.
• Activation status of the cryptographic QR/HMAC code embedded in the sole of your figure (activated / not activated).
• Digital Companion progression state (level, unlocked features), stored locally on your device and optionally synchronized to your account with your consent.

3.4. Information we do NOT collect:

• Cryptocurrency wallet addresses, private keys, seed phrases, or blockchain transaction hashes. Shaolin Toys does not accept cryptocurrency payments and does not operate any blockchain-based services on this storefront.
• Biometric data, health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or trade union membership.
• Financial account numbers beyond what is transiently handled by our PCI DSS-compliant payment processors.

We process personal information only for specified, explicit, and legitimate purposes. The legal basis for each processing activity is as follows:

4.1. Order fulfillment and delivery (performance of a contract): To process your order, manufacture the product on-demand, arrange shipping, and handle returns. Legal basis: Art. 6(1)(b) GDPR; equivalent under UK GDPR; California business purpose under CCPA.

4.2. Payment processing (performance of a contract and legal obligation): To charge your payment method and issue fiscal receipts where required by local law. Legal basis: Art. 6(1)(b) and Art. 6(1)(c) GDPR.

4.3. Customer support (legitimate interest and contract): To respond to your inquiries and resolve disputes. Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR. Our legitimate interest is maintaining the quality of our Services and resolving customer issues.

4.4. Digital Companion activation (performance of a contract): To authenticate your figure via the sole-embedded QR code and activate your Digital Companion. Legal basis: Art. 6(1)(b) GDPR.

4.5. Optional account creation (consent): To synchronize your Digital Companion across devices. Processing is based solely on your explicit opt-in consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time.

4.6. Marketing communications (consent): Only if you explicitly opt in. You may withdraw consent at any time via the unsubscribe link in each email. Legal basis: Art. 6(1)(a) GDPR; ePrivacy Directive for electronic direct marketing.

4.7. Security, fraud prevention, and legal compliance (legitimate interest and legal obligation): To protect our Services from abuse, fraud, and unauthorized access. Legal basis: Art. 6(1)(c) and Art. 6(1)(f) GDPR.

4.8. Anonymized analytics (legitimate interest): To improve our Services based on aggregated, non-identifiable usage data. Legal basis: Art. 6(1)(f) GDPR. IP anonymization is applied where required.

The Digital Companion feature in our Standalone Mobile App may incorporate algorithmic or generative AI components to personalize interactions, generate in-character responses, and adapt progression. Effective August 2, 2026, and in line with Article 50 of the EU AI Act, we disclose the following:

• You are interacting with an AI-assisted digital character, not a human.
• Certain dialogue, reactions, and progression suggestions are generated algorithmically.
• The AI system is used for entertainment and interactive engagement only; it does not provide medical, financial, legal, or professional advice.
• No AI-generated output from the Digital Companion has financial, legal, or real-world consequential effect.
• You may disable AI-assisted features in the app settings at any time without losing access to your figure's core verification or your account.

The Digital Companion is not classified as a high-risk AI system under the AI Act. We maintain transparency logs and version records as required.

6.1. Categories of recipients: We share personal information only with the following categories of service providers, each under a written data processing agreement:

• Licensed payment processors: order identifier and transaction amount only. Card data is handled directly by the processor under PCI DSS.
• Shipping carriers (DHL, FedEx, UPS, local postal services): name, phone, shipping address.
• Cloud hosting and infrastructure (servers located in the EU, UK, or other approved jurisdictions as applicable).
• Transactional email and messaging providers (SMTP, SMS): email/phone and notification content.
• Customer support platforms: ticket content.
• Analytics providers (with IP anonymization enabled where required).

We do not sell, rent, trade, or otherwise transfer your personal information to data brokers, advertising networks, or marketing aggregators.

6.2. International transfers: Where personal information of EEA, UK, or Swiss residents is transferred to a country outside the EEA/UK that has not received an adequacy decision, we rely on one of the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission and the UK ICO, as applicable;
• Adequacy decisions (e.g., EU-US Data Privacy Framework where applicable);
• Explicit consent, where no other safeguard is available and the transfer is occasional.

A copy of the applicable SCCs may be requested at legal@shaolin.toys.

We retain personal information only as long as necessary for the purposes stated in Section 4:

• Order and shipping records: retained for the period required by applicable tax and commercial law in the jurisdiction of the selling entity (typically 6–10 years).
• Customer support correspondence: retained for 3 years after the last interaction, unless a longer period is required by law.
• Account data: retained as long as the account is active; deleted within 30 days of account closure or withdrawal of consent, subject to legal retention obligations.
• Marketing consent records: retained for 3 years after the last interaction, per ePrivacy best practice.
• Cookie identifiers: retained no longer than 12 months for analytics cookies and the session duration for strictly necessary cookies.
• Phygital activation records: the QR code activation state is retained for the lifetime of your account to prevent duplicate activations and fraud; deleted upon account closure.

Upon expiry of the retention period, data is securely deleted or irreversibly anonymized.

Depending on your jurisdiction, you may have the following rights. To exercise any right, contact legal@shaolin.toys. We respond within 30 days (GDPR: 1 month, extendable by 2 months for complex requests; CCPA: 45 days, extendable by another 45 days).

8.1. GDPR and UK GDPR rights (EEA, UK, Switzerland):

• Right of access (Art. 15).
• Right to rectification (Art. 16).
• Right to erasure / “right to be forgotten” (Art. 17).
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20).
• Right to object to processing, including profiling (Art. 21).
• Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal (Art. 7(3)).
• Right not to be subject to a decision based solely on automated processing with legal or similarly significant effect (Art. 22). The Digital Companion does not make such decisions.
• Right to lodge a complaint with your local supervisory authority (a list of EU authorities is at https://edpb.europa.eu; the UK authority is the ICO at https://ico.org.uk).

8.2. Rights for residents of other US states (Colorado, Virginia, Connecticut, Utah, Texas, Oregon, and others with active privacy laws): Where applicable, you have the right to access, correct, delete, and obtain a portable copy of your personal information, as well as the right to opt out of the sale of personal information and targeted advertising. Shaolin Toys does not sell personal information.

If you are a California resident, the following additional disclosures apply.

9.1. Categories of personal information collected in the preceding 12 months:

• Identifiers (name, email, phone, shipping address, IP).
• Commercial information (order history).
• Internet activity (browsing patterns on our site).
• Inferences (limited to product preferences derived from browsing).

9.2. Categories of sources: you directly, automatically via the site, and our payment and shipping partners.

9.3. Business and commercial purposes: order fulfillment, customer support, legal compliance, security, and (with consent) marketing.

9.4. Categories of third parties with whom we share information: payment processors, shipping carriers, hosting providers, email/SMS services, and analytics providers — each for the purposes listed in Section 6.1.

9.5. Sale or sharing of personal information: We do not sell personal information, and we do not share personal information for cross-context behavioral advertising as those terms are defined by the CCPA/CPRA.

9.6. Your California rights:

• Right to know what personal information we collect, use, and disclose.
• Right to delete personal information we collected from you, subject to statutory exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information (not applicable, as we do not sell or share).
• Right to limit use of sensitive personal information (we do not collect sensitive categories).
• Right to non-discrimination for exercising your rights.

9.7. California Delete Act (SB 362): As of January 1, 2026, California operates a centralized Data Broker Deletion Mechanism (DROP). Shaolin Toys does not meet the statutory definition of a “data broker” because we collect information directly from consumers in the context of a product sale. If you believe we should be registered as a data broker, contact legal@shaolin.toys.

9.8. Authorized agents: You may designate an authorized agent to make requests on your behalf by providing a signed power of attorney or written authorization and verifying your identity.

9.9. To exercise your California rights: email legal@shaolin.toys with the subject line “California Privacy Request”. We will verify your identity before processing.

9.10. Financial incentives: We do not offer financial incentives in exchange for personal information.

9.11. Shine the Light (California Civil Code § 1798.83): California residents who have an existing business relationship with us may request information about how we have shared personal information with third parties for their direct marketing purposes in the prior calendar year. We have not made such disclosures.

Shaolin Toys products are collector-grade art objects rated 14+, not children's toys. They are not intended for children under 16 (or under 13 in jurisdictions such as the United States under COPPA). We do not knowingly collect personal information from children under the applicable age threshold. If you believe we have inadvertently collected such information, contact legal@shaolin.toys and we will delete it without undue delay.

Orders may only be placed by individuals aged 18 or older, or by minors with the verifiable consent of a parent or legal guardian.

11.1. Strictly necessary cookies: used to maintain your session, secure checkout, and prevent fraud. These cannot be disabled without breaking the site.

11.2. Functional cookies: used to remember your language and region preferences.

11.3. Analytics cookies: used to measure site performance on an aggregated, anonymized basis. IP anonymization is enabled for EEA and UK visitors.

11.4. Marketing and advertising cookies: used only with your explicit prior consent. We do not use third-party behavioral advertising networks on shaolin.toys.

11.5. Consent: When you first visit the site from the EEA, UK, or other jurisdictions that require opt-in consent, you will be presented with a cookie banner allowing you to accept, reject, or customize categories. Pre-ticked boxes and dark patterns are not used, in line with EDPB Guidelines 05/2020 and 2026 cookie enforcement practice.

11.6. Managing cookies: You can change your preferences at any time via the “Cookie Settings” link in the footer or through your browser settings.

We implement appropriate technical and organizational measures to protect personal information, including:

• TLS 1.2/1.3 encryption for data in transit (HTTPS).
• Encryption at rest for sensitive fields.
• Role-based access controls and least-privilege access.
• Regular security updates and vulnerability patching.
• Logging and monitoring of access and security events.
• PCI DSS-compliant payment processing via certified third-party processors — we do not store card data on our servers.
• Periodic security reviews of service providers.

No system is completely secure. While we take reasonable precautions, we cannot guarantee absolute security.

13.1. Sole-embedded cryptographic QR/HMAC code: Each Shaolin Toys figure carries a unique cryptographic QR/HMAC code embedded directly into the sole. Scanning this code in our Standalone Mobile App or Telegram bot verifies authenticity and activates your Digital Companion. This code is a Certificate of Authenticity and an access key — it is not a cryptocurrency, NFT, or financial instrument.

13.2. Activation and account binding: Once scanned, the code is permanently bound to your device and (optionally) your account. This binding is essential for fraud prevention and cannot be reset. As a result, an activated figure cannot be returned under our standard return policy — see our separate Returns page for full terms.

13.3. Data minimization for the Digital Companion: The Digital Companion can be used entirely locally on your device. Creating an account and synchronizing progress to our servers is optional and requires your explicit consent.

We may update this Policy from time to time. The “Last updated” date at the top reflects the effective date of the current version. Where changes materially affect the way we process your personal information (new purposes, new categories of recipients, new international transfer mechanisms), we will:

• Post the revised Policy on this page;
• Notify registered users by email at least 14 days before the changes take effect;
• Where required by law, request renewed consent before applying the new processing.

Your continued use of the Services after the effective date of the revised Policy constitutes acceptance of the changes.

15.1. For all privacy-related inquiries, requests, and complaints:

• Email: legal@shaolin.toys
• Postal address: [Legal Entity Name], [Registered Address]

15.2. EU Representative (Art. 27 GDPR):

• Name: [EU Representative Company Name]
• Address: [EU address in a Member State where our customers are located]
• Email: [EU representative contact email]

15.3. UK Representative (Art. 27 UK GDPR):

• Name: [UK Representative Company Name]
• Address: [UK address]
• Email: [UK representative contact email]

15.4. Supervisory authorities where you may lodge a complaint:

• European Economic Area: the supervisory authority of your country of residence (list at https://edpb.europa.eu/about-edpb/about-edpb/members_en).
• United Kingdom: Information Commissioner's Office (ICO), https://ico.org.uk/make-a-complaint.
• California: California Privacy Protection Agency (CPPA), https://cppa.ca.gov.
• Other US states: the attorney general of your state of residence.