Privacy policy

Last updated: July 17, 2026

MARS TERRA TRADING LIMITED ("we", "us", "our"), a Hong Kong SAR registered company, operates the online clothing store and its associated website (collectively the "Services"), providing curated shopping experiences to you (the "Customer").

Our Services are powered by Shopify Inc. ("Shopify"). This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you use the Services or communicate with us. It is governed by Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"), and applicable international regulations (GDPR, CCPA/CPRA). In case of conflict with our Terms of Service, this Privacy Policy controls for personal information matters.

By using the Services or providing your personal information, you acknowledge having read, understood, and agreed to this Privacy Policy. If you disagree, do not use the Services or provide your information.

1. Personal Information We Collect or Process

"Personal information" refers to information that identifies or can be linked to you. It does not include anonymous, de-identified, or aggregated data that cannot identify you, as permitted by law.

We may collect and process the following personal information, based on your interactions with the Services, your residence, and applicable laws:

Contact Details: Name, residential/billing/shipping addresses, phone number, email address.
Financial Information: Payment card details (processed securely by third-party payment providers), transaction details, billing history.
Account Information: Username, encrypted password, security questions, account preferences (if you create an account).
Transaction Information: Products viewed, cart/wishlist items, purchase/return/exchange/cancellation details, order history.
Communications Information: Content of inquiries, feedback, or complaints, and details of your communication with us.
Device and Technical Information: Device model, browser type, IP address, unique device identifiers, network details (collected automatically).
Usage Information: Browsing patterns, pages visited, search queries, and interaction data with the Services.
Marketing Information: Your preferences for receiving promotional materials from us or our partners.

2. Sources of Personal Information

We collect personal information from the following sources, in compliance with applicable laws:

Directly from You: When creating an account, placing orders, subscribing to newsletters, submitting inquiries, or providing feedback.
Automatically Through the Services: Using cookies, web beacons, and similar tracking technologies (see Section 10 for details).
From Our Service Providers: Including Shopify, payment processors, shipping companies, and analytics providers, who share your information with us as needed.
From Third-Party Partners: With your consent, from business/marketing partners or social media platforms.
From Publicly Available Sources: In limited circumstances, where permitted by law.

3. How We Use Your Personal Information

We use your personal information for legitimate business purposes, in compliance with applicable laws, only for the purposes it was collected or compatible purposes:

Provide, Tailor, and Improve the Services: Process orders, payments, and returns; manage your account; personalize your shopping experience; and enhance the Services' functionality.
Marketing and Advertising: With your consent (where required), send promotional communications and display targeted ads (including via Shopify's features). You may opt out as described in Section 9.3.
Security and Fraud Prevention: Protect the Services, detect and prevent fraud/illegal activities, verify your identity, and enforce our terms and policies.
Communicate with You: Respond to inquiries, provide customer support, and send important updates (e.g., order confirmations).
Legal Compliance: Fulfill legal obligations, respond to valid legal requests, and participate in legal proceedings.
Business Operations: Internal uses like accounting, auditing, and business planning; disclose information in the event of business transactions (e.g., mergers), as permitted by law.

4. How We Disclose Your Personal Information

We do not sell, rent, or lease your personal information for commercial purposes. We may disclose it to the following third parties for the purposes in Section 3, in compliance with applicable laws:

Shopify and Other Service Providers: Shopify processes and stores your information to provide the e-commerce platform. Other providers (payment, shipping, analytics) use your information only to perform services on our behalf.
Marketing and Business Partners: With your consent (where required), to send promotions or display targeted ads (partners follow their own privacy policies).
With Your Consent: To third parties you direct us to share with (e.g., for order fulfillment) or via social media integrations.
Corporate Group and Business Transactions: With our affiliates for internal purposes; to acquiring parties in business transactions (e.g., mergers), as permitted by law.
Legal and Regulatory Authorities: When required by law, or to protect our rights, property, safety, or that of our customers/third parties.

5. Our Relationship with Shopify

Shopify acts as our data processor, collecting, processing, and storing your personal information to provide the Services, in accordance with its Privacy Policy (https://privacy.shopify.com/en) and Data Processing Agreement (https://www.shopify.com/hk/legal/dpa).

Your information may be transmitted to and stored on Shopify's servers outside Hong Kong (e.g., Canada, the U.S.). Shopify may share it with its own service providers per its privacy policy.

For Shopify's enhanced features, Shopify is responsible for processing your personal information and responding to your data rights requests related to such processing. You may exercise these rights directly via Shopify's Privacy Portal (https://privacy.shopify.com/en).

6. Third-Party Websites and Links

The Services may link to third-party websites or platforms ("Third-Party Services"), provided for your convenience only. We do not control or endorse their content, privacy policies, or practices.

Your use of Third-Party Services is governed by their terms and privacy policies. We are not responsible for the privacy or security of information you provide to them, nor for the accuracy of their content.

Information shared on public/semi-public platforms (including social media) may be viewable by others. Inclusion of links does not constitute an endorsement of Third-Party Services.

7. Children's Personal Information

The Services are not intended for children under 16 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children under 16 and take reasonable measures to prevent this.

If we learn we have collected a child's personal information without parental/guardian consent (where required), we will promptly delete it. Parents/guardians may contact us (Section 14) to request deletion.

As of the effective date, we have no actual knowledge of sharing or selling (as defined by applicable laws) personal information of individuals under 16.

8. Security and Retention of Your Personal Information

8.1 Security Measures

We take reasonable technical, administrative, and physical security measures (e.g., encryption, access controls, regular audits) to protect your personal information from unauthorized access, use, or disclosure.

No security measures are perfect. Information transmitted over the internet is not fully secure, so we recommend avoiding unsecure channels (e.g., public Wi-Fi) for sensitive information and protecting your account credentials.

8.2 Data Retention

We retain your personal information only as long as needed to fulfill its collection purposes (e.g., order processing, account management) and comply with legal obligations.

Retention periods vary by information type:

Transaction and Account Information: 7 years after account closure or last transaction (to comply with Hong Kong tax/accounting laws).
Contact and Communications Information: 2 years after last interaction (to respond to inquiries).
Technical and Usage Information: 1 year (to improve the Services and prevent fraud).

After the retention period, we will delete, de-identify, or anonymize your personal information in accordance with applicable law.

9. Your Rights and Choices

Depending on your residence, you may have certain data rights under applicable laws (PDPO, GDPR, CCPA/CPRA). These rights are not absolute, and we may decline requests as permitted by law.

9.1 Your Data Rights

Right to Access/Know: Request access to personal information we hold about you.
Right to Correction: Request correction of inaccurate/incomplete personal information.
Right to Deletion: Request deletion of your personal information under specific circumstances (e.g., no longer needed, withdrawn consent).
Right to Restriction of Processing: Request restriction of processing under specific circumstances (e.g., contested accuracy).
Right to Data Portability: Request a copy of your personal information in a machine-readable format, or transfer to another controller (where feasible).
Right to Object: Object to processing for direct marketing or profiling (where no overriding legitimate interests exist).
Right to Withdraw Consent: Withdraw consent for processing based on your consent (does not affect prior processing).

9.2 Exercising Your Rights

To exercise these rights, contact us (Section 14). We may verify your identity to protect your information. Authorized agents must provide written authorization, and we may require your direct verification.

We will respond to valid requests in a timely manner (per applicable law, e.g., 30 days under GDPR/CCPA). We will explain refusals in writing, as permitted by law.

9.3 Managing Marketing Communications

You may opt out of promotional communications (emails, texts, mail) by: clicking "unsubscribe" in emails, replying "STOP" to texts, contacting us (Section 14), or updating account preferences (if applicable).

We may still send non-promotional communications (e.g., order confirmations, account updates) necessary to fulfill our contractual obligations.

9.4 Do Not Sell or Share My Personal Information

We do not sell your personal information. California residents may request we not share your information for cross-context behavioral advertising by contacting us (Section 14).

10. Cookies and Similar Technologies

We use cookies, web beacons, and similar technologies ("Cookies") to enhance your experience, analyze usage, and display targeted ads. Cookies are small text files stored on your device.

10.1 Types of Cookies We Use

Essential Cookies: Necessary for the Services to function (e.g., cart management, secure access). Disabling them may limit Service access.
Performance and Analytics Cookies: Collect non-identifiable usage data to improve the Services and measure marketing effectiveness.
Marketing and Targeting Cookies: Collect identifiable data to display targeted ads (shared with partners/Shopify).

10.2 Your Cookie Choices

You can manage Cookies via your browser settings (block, delete, disable). Disabling essential Cookies may impair Service functionality.

For browser-specific guidance, visit your browser's help section. For EEA/UK residents, we display a cookie consent banner, and use non-essential Cookies only with your explicit consent.

11. International Transfers of Personal Information

Your personal information may be transferred, stored, and processed outside Hong Kong (e.g., Canada, U.S.), where data protection laws may differ. We take reasonable measures to ensure compliance with this Privacy Policy and applicable laws.

These measures include transferring to adequate protection countries, or using Standard Contractual Clauses (SCCs) or other recognized transfer mechanisms.

EEA/UK residents may request a copy of our data transfer agreements by contacting us (Section 14).

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal obligations. We will post revised versions on the Services, update the "Last updated" date, and notify you of material changes as required by law.

Continued use of the Services after revisions are posted constitutes your acceptance of the changes. If you disagree, stop using the Services and request deletion of your information.