The short version. We collect what we need to take your order, get it to you and deal with any problem afterwards. We do not sell your data, we do not run advertising trackers by default, and we keep order records for six years because tax law says so. Email hello@pixvenn.com and you can see, correct or delete what we hold.
1. Who we are
pixvenn ("we", "us", "our") is an independent online retailer of designer toys, blind boxes, plush and collectible figures, trading at pixvenn.com. For the purposes of the UK GDPR, the EU GDPR, the UAE Personal Data Protection Law and comparable laws, we are the data controller for the personal data described in this policy.
Business details. pixvenn is operated as an independent sole-trader business from Hangzhou, Zhejiang, China. A full correspondence address is available on request. Company registration number: not applicable. Contact: hello@pixvenn.com.
We have not appointed a Data Protection Officer, because our processing does not meet the threshold that requires one. Privacy questions still reach a human at the address above — put "Privacy" in the subject line.
2. What we collect
Only what a shop actually needs. In practice that means:
| Category | What it includes |
|---|---|
| Order details | Name, email address, delivery address, phone number (carriers ask for it), the items you ordered, gift notes and any delivery instructions. |
| Payment information | Payments are processed by PayPal. We receive a transaction reference, the status of the payment, your payer email and the billing country. We never see or store your full card number. |
| Account & rewards data | Your email, collector points balance, tier, daily check-in streak, and the reviews or photos you choose to submit. |
| Device & usage data | IP address, browser and device type, pages you viewed on our site, and the contents of your cart. Some of this is kept in your own browser rather than on our servers. |
| Messages | Emails, chat messages and anything you send us about an order, a return or a damaged item — including the photos you attach. |
| Dispute & delivery evidence | Tracking numbers, carrier scans, dispatch photos or video of your parcel being packed, and correspondence about a claim. We keep these because payment providers ask for proof when a payment is disputed. |
We do not ask for, and do not want, special-category data (health, religion, ethnicity, political views). Please do not send it to us.
3. Why we use it, and on what legal basis
| What we do | Legal basis | Why |
|---|---|---|
| Take payment, pack and ship your order, handle returns | Performance of a contract | We cannot send you anything without an address. |
| Answer support messages and resolve claims | Contract / legitimate interests | Fixing problems is part of selling you the thing. |
| Keep invoices, tax and accounting records | Legal obligation | Tax authorities require it. |
| Prevent fraud, chargeback abuse and bulk reselling | Legitimate interests | Card fraud and false claims are paid for by every honest customer. |
| Improve the site, measure which pages work | Legitimate interests (aggregated where possible) | So the next visitor finds things faster. |
| Send marketing email | Consent, or soft opt-in for existing customers | Only if you asked, and every email has an unsubscribe link. |
| Run advertising measurement (if enabled) | Consent where required | Currently off by default — see section 4. |
Where we rely on legitimate interests, we have weighed our interest against your rights and kept the data to the minimum needed. You can object at any time (section 8).
4. Cookies and local storage
Our site is deliberately light. By default it sets no advertising or cross-site tracking cookies.
- Essential storage. Your cart, your chosen currency and region, your points balance and your check-in streak are stored in your own browser (local storage). They keep the shop working between pages. Blocking them will break the cart and checkout.
- Analytics. If we use analytics, we use aggregated, non-identifying measurement where the law allows it without consent; anything else is switched on only after you agree.
- Advertising. If we run advertising measurement (for example a Meta or TikTok pixel), the tag loads only where consent is required and has been given, and you can withdraw that consent at any time by clearing your browser storage or emailing us.
You can clear or block storage in your browser settings. Doing so resets your cart and your points display; it does not delete your order history with us.
5. Who we share it with
We share the minimum necessary, and only with organisations that help us run the shop:
| Recipient | What they receive, and why |
|---|---|
| PayPal | Payment and order amount, so your payment can be taken, refunded or disputed. |
| Shipping carriers and fulfilment partners | Name, address, phone and parcel contents, so the parcel can be delivered and tracked. |
| Cloudflare | Hosting and content delivery; standard server logs including IP addresses, for security and uptime. |
| Our email provider | Your email address, for order confirmations, dispatch notices and — only with consent — marketing. |
| Accountants and auditors | Order and invoice records, where required for tax and accounting. |
| Courts, regulators, law enforcement | Only where we are legally required, or to establish or defend a legal claim. |
We do not sell your personal data, and we do not share it for cross-context behavioural advertising as those terms are defined by the California Consumer Privacy Act. If that ever changes, we will say so here and offer an opt-out before anything is shared.
6. Where your data goes
We are based in China and use service providers in the United States, the European Union and the United Kingdom. That means your data may be transferred outside your country of residence.
Where data leaves the UK or the EEA, we rely on an adequacy decision or on the Standard Contractual Clauses (with the UK Addendum where relevant), together with the provider's technical safeguards such as encryption in transit. You can ask us for a copy of the relevant safeguard by emailing us.
7. How long we keep it
| Record | Retention |
|---|---|
| Order, invoice and tax records | 6 years from the end of the tax year — required for accounting and consumer-law claims. |
| Dispatch evidence (packing photos / video, carrier tracking) | 180 days after delivery, then deleted. Kept specifically so a "never arrived" or "arrived damaged" claim can be checked rather than argued about. |
| Support conversations | 24 months from the last message. |
| Rewards account and points history | 24 months after your last activity, then deleted. |
| Marketing consent record | Until you withdraw it, plus 30 days to action the unsubscribe across systems. |
| Reviews you publish | Until you ask us to remove them, or until the product is retired. |
8. Your rights
Wherever you live, we apply the same baseline. You can ask us to:
- See the personal data we hold about you, and get a copy.
- Correct anything wrong — a misspelled name, an old address.
- Delete it, where we are not required to keep it (tax records are the usual exception).
- Restrict or object to processing based on legitimate interests, including profiling for marketing.
- Port it — receive the data you gave us in a machine-readable format.
- Withdraw consent at any time, without affecting what happened before you withdrew.
Email hello@pixvenn.com with the subject "Privacy request". We may ask for your order number or the email you used, purely to make sure we are not handing your data to someone else. We answer within 30 days and it costs you nothing.
If you are in the UK, you can also complain to the Information Commissioner's Office at ico.org.uk. In the EU/EEA, you can complain to your national supervisory authority. In the UAE, to the UAE Data Office. We would rather hear from you first — most things are a two-email fix.
If you are in California or another US state with a comprehensive privacy law, you have the rights to know, delete, correct, and to opt out of sale or sharing (we do neither), and you will not be treated differently for exercising them.
9. Marketing email
We only add you to the newsletter if you asked us to, or if you bought from us and did not opt out — the "soft opt-in" that most consumer laws allow. Every marketing email has a one-click unsubscribe. Order confirmations, dispatch notices and refund messages are not marketing and are always sent, because they are part of the purchase.
10. Children
Our shop is aimed at adult collectors and is not directed at children under 16 (13 in the United States). We do not knowingly collect their data. If you believe a child has placed an order or sent us personal data, email us and we will delete it promptly and cancel any unshipped order.
11. Security
The site runs over HTTPS. Access to order data is limited to the people who need it to pack, ship or support an order. Card details never reach our servers — PayPal handles them under its own security programme. No system is perfect; if a breach affects your rights, we will tell you and the relevant regulator without undue delay, as the law requires.
12. Automated decisions
We do not make automated decisions that produce legal or similarly significant effects about you. Fraud screening may flag an order for review, but a person looks at it before anything is cancelled.
13. Changes to this policy
If we change how we handle data, we update this page and the date at the top. For a material change — a new category of data, a new processor — we also email account holders before it takes effect. Previous versions are available on request.
14. Contact
Privacy questions, data requests, or a complaint: hello@pixvenn.com. One person reads that inbox, and it is not a bot.
For everything else — orders, returns, damaged parcels — see our Terms of Service and the contact page.