Privacy Policy

1. Introduction and scope

This Privacy Policy explains how CHOICE Overseas International Co., Limited (“CHOICE Overseas”, “we”, “us” or “our”) collects, uses, discloses and protects personal information when you:

• visit or use our website published at cishihaiwai.com (the “Website”);
• download, install or use our mobile management application published on the Apple App Store and Google Play (together, the “App”);
• contact our business support team, our key accounts team, or register an account with us; or
• communicate with us as a prospective or existing business partner, supplier, customer or adviser.

This Policy covers both the Website and the App, including the advertising technologies integrated into our App. It applies to personal information processed on behalf of our business clients where we act as a processor, subject to a separate written agreement, and to personal information we process as a controller in respect of our own business contacts, visitors and users.

Your business scope — cross-border business consultation, international marketing planning, brand advisory, general trading and cross-border e-commerce support — determines which data we need in order to serve you. We do not collect more than a reasonable commercial purpose requires.

2. Data we collect

We collect the following categories of information.

2.1 Account and identity data

• Full name, business email address, company name, job title and role.
• Business telephone number, instant messaging identifiers and correspondence preferences.
• Account credentials, including an encrypted password, and security question responses where you set them.
• Verification records, including identity or company documents where a regulated trading or compliance process requires them.
• Contract, invoicing and payment-related details. Payment card data is handled by our payment processors and is not stored on our systems in full.

2.2 Device and technical data

• Device type, model, operating system and version, application version, build number and language settings.
• Screen resolution, timezone, locale and country/region settings.
• Network identifiers such as IP address, MAC address and mobile carrier information.
• Crash logs, diagnostic data, error traces and performance statistics generated when the App runs.
• Identifier(s) assigned by the device operating system or advertising SDK, including the Apple Identifier for Advertisers (IDFA) and the Android Advertising ID (AAID).

2.3 Usage data

• Pages visited, screens viewed, search terms, features used and actions taken within the Website or the App.
• Session duration, navigation paths, in-app actions, feature engagement and conversion events.
• Advertising interaction data such as impressions, clicks, installs, view-through attribution and campaign identifiers.
• Referrer URLs, campaign parameters and promotional attribution values.
• Support content: messages, attachments, call notes and any other information you choose to provide.

2.4 Optional location data

Our App may request approximate or precise location, generally to support a local language and currency, regional content or a nearby service partner. Location access is optional. If you decline the permission, the App continues to function and you may grant it later through your device settings. We do not build location histories from the Website.

2.5 Advertising identifiers and tracking data

Where permitted, and subject to your consent where required, we and our advertising partners may collect advertising identifiers, app-installation identifiers, device fingerprinting components and attribution data to deliver, measure and personalise advertising. The platforms we use are listed in Section 9, and the formats we serve are described in Section 10.

3. How we use personal data

We use personal data only for the purposes set out below, or as otherwise permitted by applicable law:

• Providing our services. To deliver cross-border business consultation, international marketing planning, brand advisory, general trading and cross-border e-commerce support, to operate your account and to fulfil orders, shipments, documents and advisory deliverables.
• Operating the App. To authenticate users, synchronise orders, inventory and supply chain milestones, deliver push notifications you have permitted, and maintain the consulting dashboard.
• Customer relationship management. To respond to enquiries, manage key accounts, schedule consultations, issue proposals and invoices, and maintain a record of our commercial history with you.
• Compliance and risk control. To perform sanctions and export control screening, customs documentation, record keeping and other legal obligations.
• Security and fraud prevention. To detect abuse, prevent fraudulent transactions, protect our systems and investigate incidents.
• Advertising and monetisation. To fund the App through advertising, to measure campaign performance, to personalise advertising where you have consented, and to limit advertising frequency.
• Analytics and product improvement. To understand how the Website and the App are used, to fix defects and to prioritise new features.
• Communications. To send service messages, transaction notices, newsletters and marketing communications where you have consented or where otherwise permitted by law.
• Legal claims. To establish, exercise or defend legal claims and to comply with lawful requests from authorities.

We do not sell personal information for money. We do not sell or share personal information as those terms are defined by the CCPA/CPRA unless you have expressly opted in.

4. Legal bases for processing

Depending on your location and the processing activity, we rely on the following bases.

5. Sharing and processors

We share personal data with the following categories of recipients, and only to the extent necessary:

• Processors and service providers who host our infrastructure, deliver email and messaging, provide customer support, perform analytics, manage advertising campaigns, process payments, and supply logistics and customs systems. They act on our instructions under written contracts that limit their use of the data.
• Advertising and attribution partners listed in Section 9, subject to your consent where required and to the opt-out mechanisms they provide.
• App distribution platforms — Apple Inc. and Google LLC — which act as app stores and, where you request it, as payment processors for in-app purchases and subscriptions.
• Trading and logistics partners (suppliers, forwarders, warehouse operators, inspection agencies and customs brokers) to the extent required to perform a transaction you have requested.
• Professional advisers and auditors (legal, accounting, compliance and certification bodies) subject to professional confidentiality duties.
• Authorities and litigants where disclosure is required by law, necessary to protect rights and safety, or needed to establish or defend legal claims.
• Corporate transactions in connection with a merger, financing, acquisition, reorganisation or sale of assets, subject to appropriate confidentiality safeguards.

We do not share your personal data for the purposes of unrelated third-party advertising without consent where consent is required.

6. International transfers

Our App is distributed globally and some processing takes place outside your country of residence. Where personal data is transferred across borders we rely on a lawful transfer mechanism, which may include:

• an adequacy decision issued by the relevant regulator (for example, the European Commission’s adequacy decisions);
• the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum;
• the UK IDTA, or any other transfer mechanism recognised by the exporting jurisdiction;
• the relevant local mechanism, such as the PRC standard contract for cross-border transfers or a binding corporate rules instrument.

Where a transfer cannot be covered by a mechanism, we apply supplementary measures such as encryption in transit and at rest, access limitation and contractual restrictions on onward transfers. You may request information about the safeguards used for a particular transfer by writing to support@cishihaiwai.com.

7. Retention periods

We keep personal data only for as long as it is necessary for the purposes described in this Policy, or as required by law.

8. Security measures

We apply technical and organisational measures proportionate to the data we process, including:

• encryption of data in transit using TLS and encryption of sensitive data at rest;
• role-based access control, least-privilege permissions and multi-factor authentication for staff with production access;
• separation of development and production environments, code review and dependency scanning;
• logging, monitoring, vulnerability management and periodic penetration testing;
• supplier due diligence and contractual security obligations;
• staff training, confidentiality obligations and incident response procedures.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within the period required by applicable law and, where required, notify affected individuals.

9. Advertising and monetisation

Our mobile management app is supported by advertising. We integrate third-party advertising SDKs supplied by the platforms listed below. These partners may collect device identifiers, advertising identifiers, usage data and coarse location information in order to deliver, measure and optimise advertising.

We serve personalised advertising only where you have given the required consent, and we serve non-personalised (contextual) advertising where consent is not required. Where the GDPR, UK GDPR or the ePrivacy rules apply, we rely on the IAB TCF or an equivalent consent signal from our consent management platform. Where the CCPA/CPRA applies, we honour the “Do Not Sell or Share My Personal Information” opt-out and the Global Privacy Control signal. On Apple devices we integrate the App Tracking Transparency (ATT) framework and request permission before tracking; on Android we respect the Advertising ID reset and deletion controls.

Each listed platform operates its own opt-out and preference controls. Where you have not consented to personalised advertising, we instruct our partners to serve contextual ads only and we do not pass advertising identifiers for cross-app targeting. You may also withdraw consent at any time from the app’s privacy settings, and by using the “About Ads” or “Apps Privacy” options on your device.

10. Advertising formats and user controls

User controls available in the App include: opening Settings → Privacy to review or withdraw consent, reset the advertising identifier, clear the ad identifier used for attribution, opt out of personalised advertising, and manage or disable in-app promotional placements. On iOS you can reset or delete the IDFA at Settings → Privacy & Security → Advertising. On Android you can delete or reset the Advertising ID at Settings → Google → Ads, and you can use the system “Delete advertising ID” option in our App settings.

11. Cookies and similar technologies

Our Website uses cookies and similar technologies (local storage, pixels, SDKs and similar identifiers) to operate the site and understand its use. Where required by law, non-essential cookies are set only after you consent through our consent banner, and you may withdraw or change your choice at any time.

12. Your rights by region

You may exercise the rights below by writing to support@cishihaiwai.com with the subject line “Privacy request”. We may ask you to verify your identity before we act. We do not discriminate against you for exercising a privacy right.

13. Children’s privacy and age policy

Our services and the App are intended for business users. You must be at least 18 years old, or the age of majority in your jurisdiction, to create an account or enter into a commercial relationship with us.

• We do not knowingly collect personal information directly from children under 13 (or under 16 where a higher threshold applies, including under the UK Age Appropriate Design Code and comparable rules).
• The App is not directed to children and is not rated for children. We do not knowingly collect personal information from children under 13 under the Children’s Online Privacy Protection Act (COPPA) or under the GDPR’s rules on children’s consent.
• Where we discover that information was collected from a child without the required consent, we delete it promptly.
• Both the Apple App Store and Google Play apply their own age ratings, parental consent and Families policy requirements, and we comply with the rating and data-safety declarations we submit for our app.

14. App store compliance

The App is distributed through the Apple App Store and Google Play, and we comply with the rules of both platforms, including:

• Apple App Store Review Guidelines — including the privacy and data collection rules (Guidelines 5.1), the account deletion requirement (5.1.1), and the requirements for apps that monetise through advertising.
• Google Play Data Safety section — our data collection and sharing declarations accurately describe the categories of data collected, whether it is shared, whether it is encrypted in transit, and whether users can request deletion.
• Google Play Families policy — our app is not directed to children, and we do not serve interest-based advertising to audiences designated as children or to unverified ages.
• Apple ATT and Play advertising ID requirements — we request tracking permission before tracking on iOS and honour the Advertising ID controls on Android.

You can request account deletion at any time by emailing support@cishihaiwai.com; we delete or de-identify your App account and associated personal data unless retention is required by law.

15. Do Not Track and Global Privacy Control

Browsers and operating systems may send a “Do Not Track” (DNT) signal or a Global Privacy Control (GPC) signal. Because there is no uniform legal standard for DNT, our Website does not currently respond to it, but we do treat a valid GPC signal as a request to opt out of the sale or sharing of personal information and to limit targeted advertising where the applicable law recognises that signal. You can also opt out at any time using the options described in Section 10.

16. Changes to this policy

We may update this Policy from time to time to reflect changes in our practices, our services, our advertising partners or the law. Material changes will be announced on the Website, in the App, or by email to registered users before they take effect. We will always publish the current version with the effective date shown in Section 18, and we will keep an archive of previous versions on request.

17. How to contact us

If you have any questions about this Policy, wish to exercise a right, or wish to lodge a complaint, please contact us:

• Business support: support@cishihaiwai.com
• Key accounts: baipeng@cishihaiwai.com
• Website: cishihaiwai.com
• Office: ROOM H18 4/F, CENTURY INDUSTRIAL CENTRE, 33-35 AU PUI WAN STREET FOTAN, SHA TIN, HONG KONG
• Company: CHOICE Overseas International Co., Limited

You may also lodge a complaint with your local supervisory authority. We would always prefer to hear from you directly first, so that we can resolve the matter quickly.

18. Effective date

This Privacy Policy takes effect on 2026-11-05 and applies to the Website and the App as published from that date. We will update this section whenever the Policy changes.