Privacy Policy

ZONE6IX is committed to protecting your personal data in accordance with the Personal Data Protection Act of the Republic of China (個人資料保護法, PDPA). This policy explains what personal data we collect, why we collect it, how it is used and stored, and your rights as a data subject.

1. Data Controller

The data controller responsible for your personal data is ZONE6IX. For any privacy-related enquiries, contact us at hello@zone6ix.com.

2. Personal Data We Collect

We collect personal data in the following circumstances:

• When you place an order: full name, email address, phone number, shipping address (including 7-11 store address for Taiwan customers), and order details.
• When you create an account: email address and password (stored as a secure hash; we never see your plain-text password).
• When you subscribe to our newsletter: email address.
• When you contact us: name, email address, and the content of your message.
• Automatically: IP address, browser type, pages visited, and server request logs. This data is used for security and operational purposes only.

We do not collect or store payment card numbers or full banking credentials. Payment data is processed directly by PayPal under their own security and privacy standards.

3. Purpose and Legal Basis for Processing

Under the PDPA, we collect and process your personal data for the following specific purposes:

• Order fulfilment (Purpose 090): Processing and shipping your order, communicating order status, and managing returns or disputes.
• Financial services (Purpose 069): Payment processing, delivery fee invoicing, and record-keeping for accounting and tax compliance.
• Customer service (Purpose 090): Responding to enquiries and managing your account.
• Marketing (Purpose 040): Sending promotional emails and newsletters — only where you have actively opted in. You may unsubscribe at any time.
• Legal compliance (Purpose 157): Meeting obligations under Taiwanese tax law, consumer protection law, and other applicable regulations.

4. Data Retention

We retain your personal data only as long as necessary for the purposes stated above. Order and transaction records are retained for seven (7) years as required by Taiwanese tax and accounting law (商業會計法). Account data is retained until you request deletion. Newsletter subscription data is retained until you unsubscribe. Server logs are retained for up to 90 days for security purposes.

5. Data Storage and Security

Your data is stored on servers operated by Supabase, located in the Asia-Pacific region. All data in transit is encrypted using TLS (Transport Layer Security). Data at rest is encrypted at the storage level. Access to production data is restricted to authorised personnel only. While we apply industry-standard security measures, no system is completely immune to risk, and we cannot guarantee absolute security.

6. Third-Party Service Providers

We share your data with the following third-party processors only to the extent necessary to operate our services:

• Supabase — database and authentication infrastructure. Your account credentials and order data are stored on their platform.
• PayPal — payment processing for orders and international delivery fee invoices. PayPal receives your name and email as part of the transaction flow.
• Resend — transactional and marketing email delivery. Your email address (and name, where provided) is shared with Resend to send order confirmations, shipping updates, and newsletters.

We do not sell your personal data to third parties. We do not use your data for advertising on third-party platforms.

7. Cookies

We use the following cookies:

• Session cookies: Set by our authentication system (Supabase) to keep you logged in to your account. These are essential for the site to function.
• Cart cookie: A cookie that stores your shopping cart ID so your cart persists between sessions and devices. This is essential for the shopping experience.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. You can disable cookies in your browser settings, though this may prevent you from staying logged in or maintaining your cart.

8. Your Rights Under the PDPA

Under the Personal Data Protection Act (個人資料保護法), you have the following rights in relation to your personal data:

• Right to access (查閱): Request a copy of the personal data we hold about you.
• Right to correction (更正): Request correction of inaccurate or incomplete data.
• Right to deletion (刪除): Request deletion of your personal data, subject to our legal retention obligations.
• Right to restrict processing (停止處理): Request that we stop processing your data in certain circumstances.
• Right to object to marketing: Opt out of marketing communications at any time by using the unsubscribe link in any email we send, or by contacting us directly.

To exercise any of these rights, contact us at hello@zone6ix.com. We will respond within fifteen (15) business days as required by the PDPA. We may need to verify your identity before processing your request.

9. International Data Transfers

Your data may be processed on servers located outside Taiwan (for example, Supabase infrastructure in the Asia-Pacific region, and PayPal and Resend servers in other regions). Where data is transferred internationally, we ensure that appropriate safeguards are in place and that transfers comply with the PDPA's requirements for cross-border data flows.

10. Children's Privacy

Our website is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page indicates the most recent revision. We will notify registered customers by email of any material changes before they take effect.

12. Contact

For any privacy-related questions or to exercise your rights, please contact us at hello@zone6ix.com.