1.1 This policy applies to your personal data collected and processed by us in the process of providing outdoor bag products and related services (including but not limited to online sales, after-sales support, membership services, market research, etc.) within the EU. This policy applies regardless of whether the data processing occurs within or outside the EU, as long as the processing is related to the provision of goods and services to EU individuals or involves the monitoring of the behavior of EU individuals.

1.2 This policy does not apply to the processing of personal data by our partners and third-party service providers. Please refer to the privacy policies of these entities separately.

2.1 Types of Personal Data Collected
To achieve our service objectives, we may collect the following personal data:

• Identification Data: Including but not limited to your name, gender, date of birth, contact information (telephone, email, address), and EU member state residency information
• Transaction Data: Including but not limited to your order information, payment records, product preferences, and purchase history
• Device and Usage Data: Including but not limited to your IP address, browser type, operating system, access time, page browsing history, and cookie usage information
• Special Categories of Personal Data: Unless we obtain your explicit consent, we will not proactively collect special categories of personal data such as race, religious beliefs, health status, and genetic data

2.2 Data Collection Methods

• Proactively Provided by You: Personal data voluntarily filled out or submitted when registering as a member, submitting an order, consulting customer service, etc.
• Obtained During Service: Device and usage data automatically recorded through our website/APP, and transaction data recorded through the transaction system
• Legally Obtained by Third Parties: Necessary personal data from legal and compliant third parties (such as payment institutions and logistics partners) with your consent

We will only process your personal data within the following legal purposes:

• Fulfilling Contractual Obligations: To complete your order transaction and provide after-sales support
• Obtaining Your Consent: To send you product information/promotions or provide personalized services (with explicit consent)
• Complying with Legal Obligations: To fulfill compliance obligations under EU and member state laws
• Protecting Legitimate Rights: To handle after-sales disputes and prevent fraud
• Pursuing Legitimate Interests: Data analysis to optimize product design and service quality (without harming your core rights)

4.1 Obtaining and Withdrawing Consent

• We will clearly inform you of the scope, purpose, and method of data processing when obtaining consent
• You have the right to withdraw consent at any time (the withdrawal process is as simple as the consent process)

4.2 Data Storage and Retention

• Encrypted storage and access control to ensure data security
• Retain data only for the necessary period (delete/anonymize after expiration)

4.3 Data Transfer

• Comply with EU data flow rules (use SCCs for non-EU transfers)
• Sign data processing agreements with third-party recipients

• Right to Know: Know the scope, purpose, storage period, and recipients of your data
• Right to Access: Request a copy of your personal data
• Right to Correction: Correct incorrect/incomplete personal data
• Right to Erasure (Right to Be Forgotten): Request deletion of your data under statutory circumstances
• Right to Restrict Processing: Restrict data processing in specific circumstances
• Right to Data Portability: Request data in a machine-readable format or direct transfer to another controller
• Right to Object: Object to processing based on legitimate interests

To exercise the above rights, contact us at service@aaroshre.xyz (response within 30 business days)

6. Protection of Children's Data

We protect children's (under 16) personal data — obtain explicit consent from parents/guardians for direct services. Guardians can request deletion of unauthorized data via our contact email.

7. Data Breach Notification

Activate emergency response for breaches affecting your rights — notify you within 72 hours and report to relevant authorities as required.

8. Policy Updates

Revise policy based on GDPR updates/business adjustments — publish on aaroshre.xyz. Significant changes will be notified via email/pop-ups.

9. Dispute Resolution

Contact us first at service@aaroshre.xyz — file a complaint with your EU member state's DPA if negotiation fails.