Privacy policy

Last updated: September 23, 2026

Issued by: GALAXEA HK LIMITED

We understand how important your personal information is to you, and we appreciate your trust. This Privacy Policy (the "Policy") explains how we collect, store, protect, use and disclose your personal information when you visit the Shopify store pages of GALAXEA HK LIMITED ("Galaxea"，"we", "us" or "our") (the "Site") or otherwise interact with us (collectively, the "Services"). It also explains how you may exercise your rights as a data subject.

We have endeavored to express this Policy in plain and concise language, and have highlighted in bold the clauses that materially affect your rights and interests and any sensitive personal information, so as to draw your attention to them. This Policy is closely related to your use of the Services. We recommend that you read and fully understand it before using the Services. If you choose to continue using the Services, you are deemed to have read and agreed to this Policy. If you do not agree with any part of this Policy, please immediately stop using our website, products and services.

Data Controller: The data controller under this Policy is GALAXEA HK LIMITED, the operator of this store. All orders placed through this store are entered into with GALAXEA HK LIMITED as the seller, and this Policy applies to the processing of personal information in connection with such transactions.

This Policy applies only to the processing of personal information in the e-commerce operations of this store (including browsing, inquiries, ordering, payment, delivery and after-sales communications).

1. How We Collect and Use Personal Information

1.1 In the course of your use of the Services, we may collect and use the following personal information that you provide, authorize us to provide, or that arises from your use of the Services:

l Information you provide: name, company name, job title, business email, telephone number, shipping address, billing information, and the content of quotation and contract communications.

l Account and transaction information: account identifiers, order records, payment status, invoice information, and after-sales and maintenance records.

l Website usage information: IP address, browser and device identifiers, operating system, access time, page views and click paths, referring URL, cookies and similar identifiers.

l Communication and support information: records of your correspondence with us by email, online chat, telephone and support tickets.

1.2 We collect and use the above information for the following purposes: (a) providing, delivering, installing, commissioning, maintaining and upgrading our products or services; (b) processing orders, payments, invoicing and logistics; (c) providing technical support, troubleshooting and after-sales service; (d) conducting product safety monitoring, vulnerability remediation and quality improvement; (e) communicating with you regarding quotations, contracts, delivery and service matters; (f) complying with laws, regulations and regulatory requirements and responding to disputes and litigation; and (g) sending you product information and marketing communications, subject to your separate consent.

1.3 In accordance with the applicable laws of your jurisdiction, we are entitled to process (including collect, use, entrust the processing of, share, transfer and publicly disclose) your personal information without your authorization or consent in the following circumstances:

l (1) where necessary for the conclusion or performance of a contract to which you are a party;

l (2) where necessary for us to perform our statutory duties or obligations;

l (3) where necessary to respond to a public health emergency, or in an emergency to protect the life, health or property safety of a natural person;

l (4) where we process your personal information within a reasonable scope for news reporting, public opinion supervision or similar activities carried out in the public interest;

l (5) where we process, within a reasonable scope as prescribed, personal information that you have made public yourself or that has otherwise been lawfully made public;

l (6) other circumstances provided by laws and administrative regulations.

1.4 Unless you refuse our processing by deletion, withdrawal of consent or other means, we will use your personal information during your use of the Services within a scope that complies with laws and regulations and that is directly or reasonably related to the purposes stated in this Policy. If the information we collect or use for the Services exceeds the scope described above, we will separately explain the scope and purposes of collection through page prompts or contractual arrangements, and obtain your consent as required by laws and regulations.

1.5 Third parties may provide services to you through our channels. Where you enter a service page operated by a third party or use a third-party service, and where this involves the third party collecting your personal information, we recommend that you carefully review that third party's privacy policy. Where that third party collects and processes your personal information as an independent controller, that third party shall bear responsibility for such processing.

1.6 You confirm that, where the personal information you provide to us includes the personal information of other individuals, you have notified those individuals of this Policy and obtained their consent (where applicable).

2. How We Store and Protect Personal Information

2.1 In general, we store the personal information we collect in accordance with applicable laws and regulations. Order and transaction information of this store is stored by Shopify on its infrastructure located in the United States (see Section 4.1).

2.2 Generally, unless otherwise provided by laws and regulations, we retain your personal information only for as long as necessary to fulfil the purposes, for example for the term of our cooperation with you. Where our products or services cease operation, we will notify you by notice or announcement and delete or anonymize your personal information within a reasonable period.

2.3 We will process your sensitive personal information only for specific purposes and where strictly necessary, and only with your separate consent (or under other circumstances provided by laws or administrative regulations). In the context of store transactions, your payment card information is processed directly by the payment service provider and is neither collected nor stored by us; where you voluntarily provide sensitive personal information such as identity documents for customs clearance or invoicing purposes, we will apply strict safeguards such as encrypted transmission and access control as required by law.

2.4 We take reasonable measures to protect your personal information against loss, leakage, damage, unauthorized access and unauthorized disclosure. For example, we use storage and transmission encryption technologies and user access management to protect your personal information. We maintain strict information security rules and procedures, and dedicated network engineers implement these measures within the company. In the event of a personal information breach or similar security incident, we will initiate emergency measures to prevent the incident from escalating, and will notify you and report to the relevant authorities as required by applicable laws and regulations.

2.5 Please understand that the Internet environment is not absolutely secure. Despite our security measures, please note that there is no such thing as a "perfect security measure" on the Internet, and we will do our best to ensure the security of your personal information. If you discover that personal information held by us may have been or has been leaked, please contact us immediately so that we can promptly take appropriate measures to avoid or mitigate any harm to you.

3. Cross-Border Transfer of Personal Information

3.1 As our business operates globally, we may in certain circumstances transfer your personal information overseas. We take measures to ensure that our processors provide an adequate level of data protection by guaranteeing that appropriate safeguards are in place and by appropriately implementing data transfer arrangements. We will ensure that your personal information is provided overseas only after we have fulfilled our obligations under applicable data protection laws. Where required by applicable law, we safeguard cross-border transfers of personal information by way of standard contractual clauses or other mechanisms recognized under such law.

3.2 As we maintain operating entities both inside and outside mainland China and may use global cloud services and technical support teams, your personal information may be transferred to, stored and processed in countries and regions outside your jurisdiction.

4. Entrusted Processing, Sharing, Transfer and Public Disclosure of Personal Information

4.1 Entrusted processing: to improve the efficiency of information processing, we may entrust third parties to process your personal information on our behalf. We enter into agreements with such third parties requiring them to process personal information in accordance with the terms of the agreement, this Policy and applicable laws and regulations.

Among such third parties, this store is operated on the Shopify platform: Shopify Inc. (a company incorporated in Canada) acts as our processor and processes personal information relating to store operation, order management and payment on our behalf; under Shopify's service architecture, such personal information is generally stored on Shopify's infrastructure located in the United States. You may review Shopify's privacy policy (https://www.shopify.com/legal/privacy) for details of its data processing practices.

(1) Galaxea affiliated and subsidiaries

Access to your personal data may be provided to staff of Galaxea affiliates and subsidiaries. Such staff abide by statutory, and when required, additional confidentiality agreements.

(2) Business Partners

We may also share necessary personal data with our business partners or service providers in accordance with the principle of minimization to provide the related services. We will require our business partners and service providers to strictly comply with our measures and requirements for data privacy protection to ensure your privacy security. If an authorized partner needs to use your personal data for an unauthorized purpose, it will seek your prior consent.

4.2 Sharing: we may share your personal data inside the company if it is necessary to provide services in a timely manner. We will not share your personal information with other companies, organizations or individuals, except in the following circumstances: (1) sharing with your separate consent; (2) sharing as required by law or by a government authority with statutory authority; (3) where the service you request can only be provided if part of your information is submitted. We may share your personal data with the following categories of recipients:

4.3 Transfer: as our business continues to develop, we may engage in transactions such as mergers, acquisitions and asset transfers. We will inform you of the relevant circumstances and will continue to protect, or require the recipient to process and continue to protect, your personal information in accordance with laws and regulations and standards no less protective than those required by this Policy. If the recipient changes the original purposes or methods of processing, it must obtain your authorization and consent anew in accordance with law (unless otherwise provided by laws and regulations).

4.4 Public disclosure: in principle, we do not publicly disclose the personal information we collect. Where public disclosure is truly necessary, we will inform you of the purpose of the disclosure, the types of information disclosed and the personal information that may be involved, and will obtain your separate consent.

5. Your Rights as a Data Subject

5.1 During your use of the Services, if you wish to access, copy, correct, supplement or delete (or close your account, where applicable) or restrict the processing of your personal information, or if you wish to withdraw your consent to our use of your personal information, or to exercise other statutory rights, please contact us using the details in the "Contact Us" section of this Policy, and we will respond within the statutory period.

5.2 After you withdraw your consent (where applicable) or delete your personal information (where applicable), we will delete or anonymize your personal information in accordance with applicable laws and regulations.

5.3 To the extent permitted by laws and regulations, we may be unable to respond to your rights request in the following circumstances:

l where your request conflicts with our performance of obligations prescribed by laws and regulations;

l where the requested information is directly related to national security or national defense security;

l where the requested information is directly related to public security, public health or major public interests;

l where the requested information is directly related to criminal investigation, prosecution, trial or enforcement of judgment;

l where we have sufficient evidence that you are acting in bad faith or abusing your rights;

l where it is necessary to protect the life, property or other major lawful rights and interests of you or others, but it is difficult to obtain your authorization or consent;

l where responding to your rights request would cause serious harm to the lawful interests of you or other individuals or organizations;

l where the requested information involves trade secrets.

6.1 To ensure the normal and efficient operation of our products and services, to provide you with smoother access experience, and to recommend content that may be of interest to you, we place small data files called "Cookies" on your device. Cookies help recall your information on subsequent visits to our website, simplify the process of entering personal details, provide you with personalized settings such as secure shopping preferences, and protect your data security, among other functions.

6.2 We will not use Cookies for any purposes other than those described in this Policy. You can manage or delete Cookies according to your preferences. You have the right to accept or refuse Cookies. You may clear all Cookies stored on your computer or mobile device. Please note that if you choose to clear all Cookies stored within the software, you may not be able to fully experience some of the convenient and secure service features we offer.

6.3 In addition to Cookies, we may use other similar technologies on our websites, such as web beacons and pixel tags (also known as clear GIFs). These technologies help count users who visit our web pages or open emails and links, allowing us to understand your preferences and usage patterns in order to improve our services and user experience

7. How We Protect the Personal Information of Minors

7.1 Our products and services are primarily intended for enterprise and professional users and are not sold or provided to children (as defined by the laws of your jurisdiction). We do not knowingly collect the personal information of children. If we discover that we have collected the personal information of a child without the prior consent of a parent or other guardian, we will delete the relevant information as soon as possible in accordance with law. If you are a minor, please use our products and services under the guidance of your guardian.

8. Application and Updates of This Policy

8.1 This Policy applies to your use of the functions of the Services and to new functions introduced from time to time. We will update this Policy as appropriate in the event of the following material changes: (1) changes to our basic circumstances, such as a change of ownership arising from merger, acquisition or restructuring; (2) changes to the scope, purposes or rules of collecting, storing or using personal information; (3) changes to the way you access and manage personal information, or to the channels and mechanisms for inquiries and complaints; (4) changes in data security capabilities or information security risks; and (5) other changes that may materially affect your personal information rights and interests.

8.2 If this Policy is updated, we will notify you by website announcement or other means. If you continue to use the Services after an updated Policy takes effect, you are deemed to have fully read and understood the updated Policy and to be willing to be bound by it. You may view the latest version of this Policy on our official website.

9. Governing Law and Dispute Resolution

9.1 The formation, validity, interpretation, performance and dispute resolution of this Policy shall be governed by the laws of the Hong Kong Special Administrative Region of the People's Republic of China. Any dispute arising out of or relating to this Policy shall first be resolved through friendly negotiation; if negotiation fails, either party may bring a lawsuit before a court of competent jurisdiction.

9.2 Where the mandatory provisions of the law of your jurisdiction provide you with a higher level of protection, nothing in this Policy excludes any rights you enjoy under such mandatory provisions; if any provision of this Policy conflicts with such mandatory provisions, the mandatory provisions shall prevail.

9.3 If any provision of this Policy is held invalid or unenforceable, the validity of the remaining provisions shall not be affected. Such invalid or unenforceable provision shall be adjusted to the maximum extent permitted by law so as to give effect to its original intent as far as possible.

10. Contact Us

10.1 We have designated dedicated personnel for this purpose. If you have any complaint, suggestion or question relating to this Policy or the processing of personal information, please contact us via the following means: privacy contact email: legal@galaxea-ai.com; postal address: Building 14, Courtyard 3, Jinghai Fifth Road, Beijing, China.

10.2 We will review your inquiry as soon as possible and reply promptly. We undertake to respond with our handling opinion or outcome within the period prescribed by applicable law.