Privacy Policy
PRIVACY POLICY
Kulpvaro | Effective date: November 13, 2026
Legal operator: Guangzhou Tingyan Trading Co., Ltd. | Contact: service@kulpvaro.com
This Privacy Policy explains the information used to operate our online store, complete customer orders, administer refunds, respond to requests and maintain the website. It also explains privacy choices and how to contact the legal operator identified above.
1. Who We Are and What This Policy Covers
Kulpvaro is an online store operated by Guangzhou Tingyan Trading Co., Ltd.. This Privacy Policy describes the personal information handled in connection with visits, purchases, customer service, order fulfillment, and store communication at https://kulpvaro.com.
The store operator is responsible for privacy requests concerning customer records it controls. Requests can be sent to service@kulpvaro.com. Shopify provides the commerce infrastructure; Shopify also publishes its own privacy notices concerning activities it controls.
Our role as the store operator is separate from the role of the platform and external providers that make checkout, payment, delivery and communications possible. This notice explains what the merchant handles through its online store; a service provider may also act as an independent controller for its own products and services. The legal seller identified in this notice is the business responsible for the customer's online purchase and related service requests.
The notice covers customers, people who contact support, visitors using the storefront, and individuals who submit a privacy rights request. It does not claim to describe independent websites or payment accounts that the customer visits outside this store. Our website is https://kulpvaro.com, and requests addressed to the merchant can be sent to service@kulpvaro.com.
This notice covers personal information processed by the legal merchant in relation to visitors, shoppers, account holders, delivery recipients and people who contact customer service. It does not convert the merchant into the controller of every independent payment processor, courier or advertising platform. Those organizations may make their own decisions about certain information and publish their own notices. We distinguish our responsibilities from theirs so that customers know where to direct a request. The website domain and legal operator named in this document are the relevant store references for merchant-controlled records.
A purchase can generate several separate records: the initial cart and checkout details, payment confirmation from the processor, an order in the commerce administration system, a shipment reference, a return case and a final refund record. We use these records to perform the transaction and respond to a query. They should not be treated as one unrestricted marketing profile. The categories, purpose, recipients and lawful basis of each processing activity are explained in the numbered sections below.
2. Categories of Personal Information
During shopping and order fulfillment, we handle name, email address, telephone number, billing and shipping address, purchased items, quantities, price, order number, payment status, shipment status, and customer communications.
The commerce platform also processes technical information such as IP address, browser and device characteristics, referral source, pages visited, session activity, and cart or checkout events. The store does not request complete payment-card details through email or customer-support messages.
Order information includes line items, variants, quantities, purchase price, applied discounts, shipping selection, delivery address, payment status, refund status and the order timeline. Customer communication records include emails, service-ticket information and materials voluntarily supplied for an order or warranty inquiry. A customer should not submit government identification documents or complete payment-card details unless a secure, specifically necessary verification process is provided.
Technical information can include IP address, user-agent string, device type, approximate geographic region derived from network data, referring page, pages viewed, date and time of use, and browser storage or cookie identifiers. Sensitive personal data is not requested to complete an ordinary retail order. If a customer voluntarily includes sensitive information in a free-text message, support uses it only as necessary to respond and should avoid retaining unrelated details.
Identification and contact data can include customer name, email, telephone, shipping and billing details and an optional account identifier. Transaction data can include order numbers, selected variants, quantities, prices, discounts, tax, shipping rates, payment status, refund identifiers and the correspondence associated with a dispute. Carrier data can include tracking references, delivery scans and proof of delivery. Product support information can include photographs or descriptions voluntarily submitted about a defect or wrong item; we ask customers not to include unrelated identifying documents in those images.
Technical data can include device type, operating system, browser information, IP address, approximate location derived from IP, timestamps, session or cookie identifiers, viewed pages, referrals, searches and shopping-cart events. We do not need an emailed complete payment-card number or a customer's banking password to process an order. Payment providers may handle card credentials under their separate security obligations. We do not classify every piece of device information as a customer name, but identifiers can be personal information under applicable law when they identify or are reasonably linked to a person.
3. How Personal Information Is Collected
Information is collected when a customer fills out checkout fields, submits a contact request, places an order, subscribes to an email list, or contacts customer service. Transaction and shipping status is also received from payment processors and carriers supporting that order.
Technical events are generated when visitors use the website. Cookies and platform tools support cart state, user sessions, site performance, fraud prevention, and checkout security.
We receive information directly when a person checks out, enters an address, subscribes to a mailing list, uses a contact form, or emails customer service. Additional transaction status comes from payment processors, carriers, fraud-prevention tools and other providers completing the requested order. Where an integrated analytics system records browsing activity, that information comes from the person's interaction with the website rather than from the checkout form.
We do not represent that the merchant collects every category described by all third-party providers. Information handled by a service provider depends on the features that are active in the store. A provider's services outside this store do not automatically become part of the customer's order or this merchant's processing activities.
Information comes directly from customers when they complete checkout, register an optional account, contact support, subscribe to permitted communications, request a return or use a privacy-rights channel. It can also be collected automatically through server records and site technologies, subject to the controls and consent required for nonessential tools in the visitor's jurisdiction. Shopify and enabled apps can provide order status, payment references or activity signals necessary for the chosen service.
We may receive information from a courier when it reports a delivery exception, a checkout provider when a payment settles or is disputed, or a fraud-prevention provider when suspicious transaction patterns require review. A person placing an order for somebody else should provide only information reasonably needed for lawful delivery. We do not obtain full banking login credentials from any of these sources, and we should not seek personal information from an unrelated broker for purposes not explained in this notice.
4. Why We Use Personal Information
We use personal information to maintain the storefront, calculate an order total, authorize payment, detect fraud, fulfill and deliver orders, provide tracking, handle cancellations and returns, issue refunds, answer questions, and keep transaction records.
We use customer-service messages to resolve the particular request. Marketing emails are sent under the store’s consent and unsubscribe process. Customer payment-card numbers are not requested as part of a support inquiry.
The store uses customer contact and order information to authenticate legitimate requests, confirm payment, prepare purchases, coordinate parcel delivery, respond to complaints, manage authorized returns and issue refunds. An order number is used as a reference when replying to a customer so that personal details are not repeated unnecessarily in correspondence. Transaction information is also used for bookkeeping, accounting, chargeback responses and proof of compliance with consumer obligations.
Site technical data is used to maintain security, diagnose faults, understand checkout errors and measure whether the website works properly. Promotional emails require the applicable sign-up or lawful marketing basis and include an unsubscribe method. We do not need a marketing subscription to fulfill a paid order, and refusing promotional emails does not prevent receipt of essential transaction notices.
Order administration requires contact details, selected goods, payment results and the destination address so that we can fulfill the purchase and communicate dispatch. Support uses the transaction history and messages to identify the issue and arrange a correction, return or refund. Security processes help detect unauthorized access, card abuse and suspicious checkout patterns. Legal compliance may require storing accounting evidence and handling lawfully binding requests from competent authorities.
Website measurement, where enabled, is used to understand how visitors navigate product pages, whether technical errors occur and which shopping flows work correctly. Promotional communication is separated from essential transactional messages: a person who unsubscribes from marketing still receives the notices necessary to complete an existing order. We do not treat a privacy request as permission to add the requester to a sales mailing list. Processing that is not necessary for checkout must be evaluated against the relevant consent and choice requirements.
5. Legal Grounds for Processing
Processing necessary to complete and deliver an order is performed to execute the customer purchase contract. Payment recordkeeping, consumer-protection obligations, and legally required accounting are performed to comply with applicable legal duties.
Account protection, service security, fraud investigation, and support-quality controls are carried out for legitimate operational interests where permitted by the law governing the individual. When consent is legally required for optional tracking or marketing, that activity is governed by the consent choice.
Where the law requires a lawful basis, fulfilling a purchase is a contractual necessity; meeting tax, accounting and legally required disclosures is a legal obligation; investigating fraud or maintaining system security may rely on a legitimate interest where that basis is permitted; and optional marketing or nonessential tracking relies on consent when required. The precise basis can differ by processing activity and the customer's jurisdiction. We do not treat a customer's acceptance of the Terms of Service as automatic consent to every possible advertising cookie.
A person may withdraw consent for optional processing through the available privacy or cookie choices or by contacting the store. Withdrawal does not retroactively invalidate processing performed lawfully before the change, and it does not stop necessary order processing or legally mandated recordkeeping. When a request concerns a vendor-controlled account or service, the customer may also need to exercise choices with that provider.
Different tasks may rely on different legal grounds where applicable law recognizes such grounds. Processing a delivery address to ship purchased goods can be necessary to perform the sales contract. Maintaining required tax records can reflect a legal obligation. Preventing fraud, protecting the service and handling an existing complaint can involve legitimate interests subject to applicable balancing rules. Optional promotional email and nonessential tracking may require consent or another legal basis authorized by the person's jurisdiction.
Consent is not a substitute for a contractual task that is genuinely necessary, and a claimed legitimate interest does not override specific local rules requiring prior consent to certain cookies or advertising technologies. A person can withdraw consent for consent-based activity without retroactively affecting earlier lawful processing. If withholding a data field prevents a specific service, we should explain that relationship rather than describe all optional data as mandatory for purchase.
6. Checkout, Payment and Order Fulfillment
The store transmits order information to Shopify and the payment providers shown at checkout. Payment processing is performed by those authorized payment services. Shipping details are provided to the carrier or fulfillment partner responsible for delivering the order.
Customer-service personnel access order data for order verification, delivery questions, returns, refunds, and complaints. Customers should not send card numbers, online banking passwords, or identity documents to customer support unless a secure and legally justified verification procedure has been expressly established.
Checkout requires the customer name, selected items, delivery information and an accepted means of payment. The chosen payment service handles the payment credential according to its own security and processing arrangements. The merchant uses transaction identifiers and authorization or refund status rather than asking support staff to store full card data in an email. Shipping providers receive the recipient information necessary to deliver a specific parcel and handle delivery issues.
For cancellation, fraud review and refund administration, the merchant maintains a link between the order number, customer record, payment status and customer-service case. An approved refund is initiated through the original payment transaction. A payment processor's independent retention and regulatory obligations are described in that provider's own notice and are not controlled by the store's customer service team.
A customer's checkout may involve Shopify as the commerce platform, payment processors, fraud screening, and the courier or fulfillment operation handling delivery. The store uses order and payment status to reconcile what was paid and whether a refund can be initiated. Sensitive card authentication details should be entered through secure processor interfaces, not emailed to general customer service. Where the processor manages a financial dispute, it may process evidence and account data according to its own obligations.
The shipping provider receives the contact information and destination necessary to move the parcel and may generate a tracking event or delivery confirmation. A return case may require the affected product, the reason for return and a receipt scan from the authorized receiving facility. Access should be restricted to employees or providers responsible for that stage. An external provider does not receive carte blanche to use the buyer's order record for unrelated marketing merely because it delivered one package.
7. Cookies and Similar Technologies
Essential technologies retain a shopping cart, support session integrity, secure checkout, and protect against automated abuse. Browser settings allow customers to block or delete cookies; disabling essential cookies can prevent cart and checkout features from operating correctly.
Cookies and similar storage can be required to maintain a shopping basket, keep checkout secure, remember preferences or manage session continuity. Analytics and advertising technologies, when configured, serve separate purposes such as measuring website traffic or an advertising campaign. A visitor can use the store's available cookie or privacy preference controls for optional categories. Browser-level settings may also block cookies, although essential functionality, including the basket or checkout, may be affected.
Customers can use any available store privacy preference controls to manage optional tracking, as well as browser controls for cookies and local storage. Essential storage may remain necessary for the shopping basket, secure checkout and transaction continuity. Privacy choices are applied to the relevant technologies in accordance with applicable law.
Essential technologies can remember a cart, maintain login or session security, route checkout, or prevent unauthorized transactions. Analytics technologies may measure visits, browsing steps and technical performance. Advertising technologies, if installed and activated, can record product views, add-to-cart events and purchase attribution. Whether a particular cookie is essential depends on its real function, not simply on how the store labels it. Local laws can require a prior choice for nonessential technologies.
A compliant consent interface should offer accurate information about categories and allow refusal or withdrawal where the relevant law requires it. Changing browser settings may remove a cookie without revoking processing already lawfully completed; conversely, a store may be obligated to respect a legally recognized opt-out signal such as Global Privacy Control where applicable. The merchant must configure actual installed tags in accordance with the public explanation and not claim that all tracking is disabled merely because the notice mentions preferences.
8. Email Marketing and Advertising Information
Marketing emails contain an unsubscribe mechanism. When a customer uses that link, the email address is removed from the applicable marketing mailing list. Transactional messages about accepted orders, refunds, or delivery are sent independently of marketing subscriptions.
Advertising and analytics providers publish their own notices explaining their data practices. The following AppLovin link is supplied as an official reference; its presence does not assert that a particular AppLovin pixel is installed or that an AppLovin service collects data through this store.
Transactional communications include purchase confirmations, dispatch notices, return instructions, refund notices, fraud alerts and necessary service messages. They are sent because they relate to an active customer relationship and do not require enrollment in a promotional mailing list. Marketing messages, where used, should provide an unsubscribe link or another straightforward opt-out method. An unsubscribe affects promotional communications but not essential status messages about an outstanding order.
Advertising attribution, where enabled, can involve online identifiers and events such as a page view, add-to-cart activity or completed purchase. When AppLovin advertising tools are used in connection with the store, customers can consult AppLovin's official notice linked in Section 17. The information handled by an advertising provider depends on the functions installed and used for the shopping or advertising interaction.
A subscriber's email address and marketing preference can be used to send permitted offers or store updates. An unsubscribe link or written request removes the address from promotional dispatch to the extent required by law; essential notices about paid orders, returns or security remain separate. Marketing preferences should not be silently reset to enrolled status merely because a customer makes another purchase. Customers should not receive a promotional message represented as a mandatory delivery notice when its purpose is advertising.
Where advertising measurement is enabled, certain events may be sent to platform partners to attribute a sale or evaluate a campaign. These can involve device or browser identifiers, IP addresses, conversion events and limited transaction signals depending on the installed integration. AppLovin provides its own explanation of advertising data practices at the official notice linked in this policy. A description of an optional tool is not a statement that the tool is already enabled on every store; merchant disclosures must match the deployed configuration.
9. Who Receives Personal Information
Order information is shared with the commerce platform, payment-processing companies, shipping and fulfillment providers, and the services used to secure the checkout and provide customer support. Each recipient receives information relevant to its function.
Records are disclosed to regulators, courts, and public authorities when the store operator is legally required to provide them. We do not request or distribute full card numbers through general customer-support email.
The categories of recipients can include Shopify as the commerce platform, a checkout payment provider, a fulfillment operation, the parcel carrier, customer service infrastructure, accounting advisers, security providers and legally authorized public authorities. Each recipient should receive only information needed to perform the related task, such as a shipping address for a carrier or a transaction reference for a processor. We do not send customer payment credentials to unaffiliated parties for informal processing.
If the business transfers ownership or business assets, personal information connected to the store may be included where law permits and appropriate notices are provided. Disclosure for legal demands is assessed against applicable requirements, and we do not treat a casual request from an unrelated third party as a valid legal order. Service providers may separately determine how to retain information under their own published notices.
Service provider categories can include Shopify, processors and fraud services, shipping and fulfillment organizations, customer-support platforms, relevant accounting or legal advisers, hosting and security vendors, and analytics or advertising partners that are actually in use. A courier ordinarily needs a recipient and destination but does not need the customer's unrelated browsing history. A payment processor may need an order total and authentication information but does not need the content of every support discussion. We apply access limitations appropriate to each business function.
A transfer in connection with a legitimate sale, merger or reorganization of the store may involve records necessary for the business's continuity and lawful obligations, subject to applicable law. We may respond to a valid legal process or protect the security of customers and the website. These exceptions do not authorize the merchant to sell a customer contact list to any unrelated party merely because an external provider exists. Any legally defined sale, sharing or targeted-advertising disclosure must be evaluated and disclosed accurately.
10. Cross-Border Processing
Shopify, payment services, and shipping partners operate technology and support systems in more than one country. As a result, order and technical information can be processed outside the customer’s home jurisdiction.
For a transfer covered by a data-protection law requiring additional protections, the operator and relevant processor must apply the legally required transfer mechanism. A request for information about a customer record can be sent to the store privacy contact.
A customer may shop from one country while website hosting, payment processing, customer service or delivery infrastructure operates from another. Personal information can therefore be processed in jurisdictions with different privacy protections. Where European or United Kingdom transfer rules apply, the responsible parties must use a recognized safeguard, such as appropriate contractual terms or another lawful transfer mechanism, when required.
The legal operator's registered address is listed in this policy. Customer information can be processed in the locations where our contracted commerce, payment and delivery services operate. We do not claim that order or browsing information remains exclusively inside the customer's country. Customers can contact service@kulpvaro.com for information about our merchant-controlled processing.
The legal merchant may be established in a jurisdiction different from the shopper's location. The commerce platform, payment provider, cloud hosting, customer-service tools and delivery partners may each process information in one or more countries. Customers therefore should not be told that all personal information remains inside the country of purchase unless that is factually supported. The merchant's registered office identifies its legal entity; it is not a complete inventory of processing locations.
Where a law imposes transfer restrictions, appropriate legal safeguards must be applied, such as recognized contractual mechanisms or another lawful route. The specific duties depend on the merchant's processing and on the destination country. A third-party service provider can have its own transfer notice and security program. Requests about merchant-controlled records should be addressed to the official store contact, while an independent provider may handle its separate processing and rights requests through its own notice.
11. Retention and Deletion
Order records are retained for 7 years from the purchase date for accounting, transaction verification, and dispute records. Closed customer-support cases are retained for 24 months after closure. Technical access and security logs maintained by the store operator are retained for 12 months.
At the end of the stated period, records are deleted or de-identified unless an active dispute, legal hold, or mandatory retention obligation requires a longer period. Records held independently by a payment provider, shipping carrier, or Shopify are governed by that organization’s own retention obligations.
For records controlled by our business, our retention schedule is: completed order, tax and payment reconciliation records for seven years after the transaction; customer support cases for 24 months after case closure; fraud and security investigation material for 24 months after case closure; and marketing subscription records until withdrawal plus up to 24 months to document the request. These periods apply to records under our control unless a legal obligation, active claim or legally required longer period applies.
Deletion requests are evaluated against legal obligations, open returns, unresolved payment disputes and legitimate record preservation. Data not required for those purposes should be removed from merchant-managed systems under the adopted retention schedule. Copies in backups and independent service-provider systems may follow separate recovery and retention schedules; the merchant must not claim to erase vendor-held records it does not control.
The merchant retains transaction records necessary to complete delivery, record a return, provide a refund and meet accounting obligations. Support records are kept for operational follow-up and dispute evidence; security records are retained for investigations and protection of the service; subscription information is kept as needed to honor an opt-out. A retention decision should consider the actual applicable tax, commerce, privacy and limitation-period rules and any open claim rather than assigning all data an indefinite life. We do not promise the removal of legally required tax information just because a marketing subscription was cancelled.
A valid deletion request is assessed against records no longer needed and those still required for a paid order, statutory accounting, unresolved dispute or fraud investigation. Data that no longer serves a lawful purpose should be removed or anonymized under the adopted retention schedule. Backups and independent providers can have their own limited recovery periods. The store should not assert that it can delete a payment processor's legally retained record on demand when that provider independently controls the record.
12. Security of Customer Information
Access to customer records is limited to staff and processors with a business need to fulfill orders or provide support. Store administration accounts use access controls. The checkout and payment services manage their own payment and platform security controls.
No internet transmission is risk-free. Customers should protect account credentials and report suspicious messages claiming to represent the store. In the event of a reportable personal-information incident, required notices are provided under the law governing that incident.
Protective controls include access restrictions for staff, account authentication, limited disclosure of customer order records, secure checkout connections, software updates and monitoring for suspicious order activity. Team members should not download customer lists onto unmanaged devices or send payment information through ordinary email. Return photographs and customer communications are reviewed only by people who need them to address the relevant case.
No network or storage system is completely immune from unauthorized access. If a personal-data incident occurs, the merchant evaluates what records and individuals are affected, documents the response and provides notifications required by applicable law. Customers who suspect an unauthorized store-account login or fraudulent communication should contact service@kulpvaro.com and avoid sending passwords or card security codes in the report.
Access to merchant-managed data is restricted according to business need. Account credentials, secure checkout connections, staff permissions, software maintenance and fraud monitoring are examples of relevant protective controls. Customer support should view the order information necessary to resolve the case rather than browse unrelated buyer records. Staff must not ask the customer to send a full card number, card security code or password through ordinary email. Sensitive documents accidentally received in a complaint should be handled with appropriate access controls and removed when no longer required.
Security risk cannot be reduced to zero. If a personal-data incident affects merchant-controlled records, the business must investigate what happened, preserve relevant evidence, contain the issue and notify customers or authorities when applicable law requires notice. A customer who suspects account compromise can contact the official support address, change exposed credentials and avoid replying to suspicious recovery messages. A privacy statement should not claim an absolute guarantee of safety that no online service can responsibly make.
13. Access, Correction and Deletion Requests
Email service@kulpvaro.com using the subject "Privacy Request" to ask for access to, correction of, or deletion of information linked to an order. Include the order number and the email address used at checkout. Never include a full payment-card number.
We verify the requester’s authority before disclosing customer information. We answer privacy requests within the legal deadline that applies to the request and explain any legally required exception. Shopify provides separate tools for certain information it controls.
To exercise a privacy right, send an email to service@kulpvaro.com with “Privacy request” and identify the type of request. The store may need to verify the requester's control of the email or order record before disclosing or changing personal information. We do not require a full card number or password for verification. Where the law specifies a response deadline, the business must follow that deadline and explain any extension permitted by law.
Subject to applicable exceptions, privacy rights can include access, correction, deletion, a copy of provided information, objection to certain processing, limits on the use of sensitive data and withdrawal of consent. The store must explain when it cannot complete a request because records are needed for tax, fraud prevention, an open dispute or another legal requirement. A decision can be reviewed or appealed where the applicable law gives that right.
A request for access identifies the data subject and the scope of requested records. A correction request should describe the incorrect address or account detail, while a deletion request should identify the record or account involved. The store may verify control of the known email or another proportionate identifier to avoid disclosing information to an impersonator. Identity verification should not demand a payment-card security code or an unnecessary copy of a government document. An authorized representative may be accepted where applicable law requires that route.
We distinguish a confirmation that the request was received from the final legal response. Where an applicable law specifies a deadline, an extension process or an explanation of denial, the merchant follows that law. If some data must remain for tax, active order or dispute purposes, the response should identify the relevant exception rather than state that every request has been completed. Customers can also unsubscribe from marketing through the message itself instead of exercising a full account deletion request.
14. Privacy Notices for Residents of the United States
Residents of states with consumer privacy statutes can submit requests concerning access, deletion, correction, and qualifying advertising uses of their personal information. The store reviews these requests against the statute governing the requester and confirms the result by email.
Privacy-related requests, including a request to opt out of targeted advertising, can be submitted to service@kulpvaro.com with the subject "Privacy Request". A right that is protected by law is not conditioned on placing a purchase.
Depending on the state and whether its privacy law applies to the merchant, residents may be entitled to learn the categories of information collected, access specific information, request correction or deletion, obtain data portability and opt out of specified sales, sharing or targeted advertising. Definitions of “sale,” “sharing” and “targeted advertising” can include certain technology-based disclosures even where no money is received in exchange. The store must accurately disclose any such activity based on its live advertising configuration.
Requests can be directed to service@kulpvaro.com, and the business must apply the verification and appeals procedures required in the relevant state. We evaluate these requests according to the processing activities applicable to the store. If state law requires a dedicated privacy choice link, recognition of Global Privacy Control, or an appeal process, we provide the required method and honor valid requests in accordance with that law.
Privacy rights differ among U.S. states and depend on whether a particular law applies to the merchant and processing activity. A qualifying resident may have rights to access, correct, delete or obtain certain information and to opt out of specified sales, sharing or targeted advertising. The legal definitions of “sale” or “sharing” can include disclosures involving advertising technologies even without direct payment for the data. The merchant must examine the configured advertising services before stating whether such processing occurs.
When required, the store provides an appropriate opt-out route, recognizes legally operative preference signals, and offers any mandated review or appeal process. A request should be linked to the correct jurisdiction and verified in a manner consistent with local law. We do not charge a customer for exercising a right where a law prohibits the fee, and we do not deny service unlawfully because a shopper exercised a protected privacy option. State-specific disclosures must be kept aligned with live site practices and current legal thresholds.
15. Privacy Rights Outside the United States
For an individual covered by the EU GDPR, UK GDPR, or another relevant privacy law, the operator evaluates requests for access, rectification, erasure, restriction, objection, portability, and withdrawal of consent under that law.
Customers can contact the store with privacy questions and can also raise complaints with the data-protection authority responsible for their jurisdiction. Where a local representative or additional market-specific disclosure is legally required, the store operator must publish verified details before selling into that market.
For people covered by the GDPR, United Kingdom GDPR or equivalent laws, rights can include access, rectification, erasure, restriction, objection, portability and withdrawal of consent. A person may complain to a competent supervisory authority where permitted. The business identified in Section 1 is the contact for questions about merchant-controlled records. Any additional representative or regional contact required by applicable law is provided through our published legal information.
Direct marketing objections are handled separately from essential operational communications. Where optional tracking requires prior consent, those technologies must not be activated before valid consent is obtained. A legitimate-interest justification does not automatically replace a specific consent requirement imposed by local electronic-communications rules. Customers can send privacy questions to service@kulpvaro.com and should receive a response within the legally applicable time frame.
Where the EU GDPR, UK GDPR or similar rules apply, relevant rights may include access, rectification, erasure, restriction of processing, objection, data portability and withdrawal of consent. A person may have the right to lodge a complaint with a competent supervisory authority. The availability of a right and the business's duties depend on the facts, legal grounds and exemptions, including the continued need to keep certain transaction records. A request to oppose direct marketing should be handled separately from essential account-security messages.
Any required regional representative or additional rights channel must be identified when the law requires one. If an advertising or analytics technology needs prior consent under local electronic communications rules, the website must honor that requirement through its actual consent controls; mentioning legitimate interests in this notice does not substitute for a lawful consent process. Cross-border transfers of covered information require appropriate safeguards when the law applies. These duties are not resolved merely by publishing a lengthy generic privacy page.
16. Children and Customer Accounts
The store is intended for customers legally able to complete online purchases. We do not encourage children to open customer accounts or submit payment details without the involvement of a parent or legal guardian.
A parent or guardian seeking review or deletion of a child’s personal information should contact service@kulpvaro.com and provide sufficient information to locate the record. We verify the request and handle it under applicable child-privacy requirements.
This store is intended for adults making ordinary retail purchases and is not designed to knowingly solicit personal information from children. The store should not collect an age or identity document unless the type of product and applicable law require it. A person who believes that a child has supplied personal information without the required authorization may contact service@kulpvaro.com so the business can investigate and take legally appropriate action.
We do not intentionally direct the store's ordinary retail services to children or request children's information as part of ordinary checkout. Where a product or service is subject to age restrictions, any necessary eligibility procedures are governed by the applicable legal requirements. Any account function is subject to the eligibility rules displayed when registering.
The store is intended for general consumer retail purchasing rather than collection of information from children. It should not knowingly invite a child to provide personal information in a marketing form or account registration where parental authorization or special restrictions are required. If a parent or guardian believes that a child supplied information without the necessary permission, they can contact the official support address with the relevant details. The merchant will review the report and follow applicable deletion or parental-rights duties.
Age limits for a specific product, if any, must be applied through the appropriate product and checkout procedures, not invented as a privacy claim for every item. The website should collect only the information reasonably required for the transaction. A customer's inclusion of a child's name on an ordinary gift shipping label does not automatically mean the store is running a child-directed marketing service. Each case is assessed against the actual circumstances and applicable rules.
17. Updates, Contact Details and Official References
The effective date at the top of this policy identifies the published version. A revised version is displayed on the store website when the policy changes. Changes affecting an existing purchase do not override statutory rights attached to that purchase.
Store: Kulpvaro
Legal operator: Guangzhou Tingyan Trading Co., Ltd.
Registered business address: Room B2709, 2nd Floor, No. 965, Tianyuan Road, Tianhe District, Guangzhou, Guangdong, China
Store website: https://kulpvaro.com
Privacy contact: service@kulpvaro.com
Customer service telephone: +1 9093274172
Effective date: November 13, 2026
We publish material changes to this notice by updating the effective date on the website. Where a new processing activity requires consent or a separate notice, the store must provide it rather than relying solely on a passive policy update. Questions about the merchant's customer records, requests for a copy of this policy and concerns about inaccurate information should be sent to service@kulpvaro.com. The legal company name and registered address stated in this notice identify the responsible store operator.
The following official provider notices are available as external references, not as replacements for the merchant's policy. Shopify Consumer Privacy Policy explains Shopify's own handling of information in its consumer services. Shopify overall Privacy Policy describes its wider practices. AppLovin's Privacy Policy is relevant only if AppLovin tools or ads are actually configured in connection with the store. Customers should consult any applicable external provider notice for that provider's separate privacy practices and choices.
Official external reference links: Shopify Consumer Privacy Policy
A provider notice describes the provider’s own practices. This store remains responsible for explaining the customer information it handles and honoring privacy rights that apply to the merchant.
The effective date identifies the current public version of the notice. When a material change occurs, the merchant should update the content and give any additional notice or consent required by law. A new policy does not retroactively turn earlier unlawful collection into lawful processing. Visitors can retain a copy of the version available at the time of their transaction, and customers can request clarification from the official email address. A policy change should accurately describe a real operational adjustment, such as enabling a new advertising tool or changing a service provider.
The links in this section connect to the merchant's own site and to official notices of Shopify and AppLovin. Shopify is the store platform; AppLovin is an advertising service that may be used if actually enabled. The links do not mean either company endorses the merchant or that the store automatically satisfies every privacy law. Customers should use the merchant's support address for information under merchant control and follow an independent provider's official notice for rights concerning processing it independently controls.