Privacy Policy

1. Introduction & Identity of Data Controller

Data Controller: CIEN GOOD
Registered Legal Entity: Hangzhou Yibin Bags Co., Ltd.
Privacy Contact Email: privacy@ciengood.com

If our legal entity is located outside the European Economic Area (EEA) and we serve EEA customers on a sustained basis, we shall appoint an authorized EU-based Data Representative in compliance with GDPR Article 27; relevant representative information will be published on this page separately once appointed.

We operate the website https://ciengood.com (“the Site”), engaged in design, wholesale and retail of outdoor bags, insulated cooler bags, waterproof backpacks, cycling bags, golf accessories and travel luggage.

This Privacy Policy governs collection, storage, processing, sharing and protection of your personal data. This document complies with:

1).Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR);
2).EU ePrivacy Directive 2002/58/EC (Cookie Directive);
3).California Consumer Privacy Act & California Privacy Rights Act (CCPA/CPRA);
4).U.S. Federal Trade Commission (FTC) Act prohibiting unfair or deceptive trade practices;
Other applicable local data protection laws globally.

By accessing and using the Site, you confirm you have read, understood and accept this Privacy Policy. If you disagree with our data handling practices, please discontinue use of our website immediately.
We acknowledge that internet data transmission cannot guarantee absolute invulnerability against risks; we deploy industry-standard security controls to minimize data security hazards.

2. Key Definitions

1).Personal Data: Any information that directly or indirectly identifies a natural person, including full name, email, phone number, billing/shipping address, corporate credentials, order records, payment-related information, public IP address, device identifiers. An unanonymized IP address is classified as Personal Data under GDPR.

2).Data Subject: Website visitors, retail customers, B2B wholesale partners, newsletter subscribers and all individuals whose personal data we process.

3).Data Processor: Third-party vendors executing data processing under a signed Data Processing Agreement (DPA) with binding confidentiality and security obligations.

4).Cookies: Small text files stored on your device; categorized as Necessary, Analytics, Marketing Cookies subject to ePrivacy rules.

5).Sale (CCPA Definition): Exchange of personal information for monetary or valuable consideration. Sharing personal data for cross-context targeted advertising counts as “Sharing” rather than a “Sale” under CCPA.

3. Personal Data Collected

3.1 Information You Voluntarily Submit

-Basic contact information: full name, email address, telephone number;
-Logistics & billing data: shipping address, billing address, postal code, country/region;
-B2B cooperation materials: company name, inquiry details, quotation records, sample application information;
-Transaction records: order details, purchased items, invoices, payment verification records;
-Marketing preference opt-in/opt-out selections;
-Customer service correspondence, product reviews, complaint and after-sales service logs.

3.2 Automatically Collected Passive Technical Data

Collected via server logs, cookies and tracking pixels: device model, operating system, browser type, page access timestamps, click paths, approximate geographic location resolved from your public IP address.
Original plaintext IP addresses are only utilized for website security defense and fraud prevention. We mask and partially truncate IP addresses for long-term logs, and fully anonymize all identifiable IP information after 12 months.

We will not collect sensitive special category personal data (government ID documents, biometrics, complete payment card CVV codes, health information) unless you proactively provide such materials for verified special business cooperation review.
4. Legal Bases & Legitimate Processing Purposes

We maintain internal records of all data processing activities in compliance with GDPR Article 30 for regulatory audit.

1).Performance of a Contract
Process online orders, arrange logistics delivery, return & after-sales service, issue official invoices, conduct payment anti-fraud verification.

2).Legitimate Interest (GDPR)
A formal Legitimate Interest Assessment (LIA) has been completed internally to validate these processing activities:
-Optimize website operation, resolve technical faults, analyze anonymous site traffic;
-Send relevant similar product recommendations to existing customers without standalone consent;
-Maintain website cybersecurity, block unauthorized access and fraudulent transactions.
You hold the absolute right to object to processing based on legitimate interest at any time.

3).Explicit Unambiguous Consent
Deliver promotional newsletters; activate analytics and marketing tracking cookies. Consent may be withdrawn at any time with effect for future processing only.

4).Legal Obligation
Retain data to satisfy statutory accounting, taxation, commercial dispute statute of limitations and official regulatory investigative requirements.

5).Pre-contractual Measures
Evaluate wholesale cooperation applications, provide quotations and arrange sample delivery for prospective business partners.

5. Cookies & Tracking Technologies (Fully ePrivacy Compliant)

Our cookie consent popup strictly complies with EU regulatory requirements: no implicit consent via page scrolling, pre-ticked checkboxes or forced acceptance. You may select each cookie category individually.

1).Necessary Cookies
Indispensable for core website functions: shopping cart storage, session persistence, cookie consent preference recording. These do not require user consent under the ePrivacy Directive. You may manually disable them via browser settings, yet core website functions may malfunction consequently. Our consent panel clearly lists all necessary cookies, their functions and lifecycles.

2).Analytics Cookies
Collect anonymized browsing statistics for website iteration; activated only upon your active affirmative opt-in.

3).Marketing Cookies
Deployed by Google Ads, Meta Pixel for targeted cross-site advertising; enabled exclusively after your explicit consent.

You may clear, restrict or block all cookies via native browser configuration at any time.

6. Sharing & Disclosure of Personal Data

We never sell your personal information for valuable consideration as defined under CCPA. We only share data with contracted Processors bound by formal DPA agreements:

1).Authorized service providers: payment gateways, logistics carriers, cloud hosting platforms, cybersecurity vendors, email marketing service providers;

2).Verified global distributors only when you actively submit wholesale cooperation applications;

3).Compelled disclosure pursuant to valid court orders, legally binding government regulatory demands;

4).Merger, acquisition or asset transfer: the acquiring entity shall be contractually obligated to assume all privacy obligations under this Policy. If the transferee intends to alter data processing purposes, fresh explicit consent shall be obtained from affected users prior to transfer execution. We will issue a prominent website notice and targeted email alerts for material data transfers.

Public reviews, comments and content you voluntarily publish on our site are visible to all visitors; you bear full responsibility for personal information disclosed voluntarily in public user-generated content.

7. Cross-Border Data Transfers

Your personal data may be transferred to jurisdictions outside the EEA.
For data exported from the EEA to third countries lacking an EU adequacy decision:
We adopt the latest 2021 European Commission Standard Contractual Clauses (SCCs) as the primary legal safeguard, paired with end-to-end encryption and logical data isolation for sensitive transaction data. You may request a full copy of executed SCC documents by emailing privacy@ciengood.com.

8. Data Retention Schedule

Data is retained for the minimum period necessary to fulfill original collection purposes:

1).Retail order transaction data: 7 years post order completion (compliant with tax, accounting and commercial law mandatory retention rules);

2).Newsletter subscriber data: retained until you submit an unsubscribe request;

3).B2B partner information: stored for 5 years following cooperation termination, grounded in commercial dispute limitation periods and fiscal regulatory requirements;

4).Customer support correspondence: retained for 3 years after case closure for dispute resolution reference;

5).Raw technical access logs including IP addresses: partially masked during routine use, fully anonymized after 12 months;

6).Aggregated de-identified statistical data: may be stored indefinitely with all personal identifiers permanently removed.

We will erase or anonymize your personal data upon a valid deletion request unless statutory mandatory retention obligations apply. All low-risk data security incidents shall be archived in internal logs for a minimum of 5 years for regulatory inspection.

9. Technical & Organizational Data Security Measures

-End-to-end SSL/TLS encryption for all data transmission across ciengood.com;

-Role-based granular access control for internal staff; only designated authorized personnel may access personal data;

-Periodic vulnerability scanning, penetration testing and regular security compliance audits;

Personal Data Breach Protocol (GDPR Compliant)

1).Low-risk incidents with negligible threat to user privacy: internal rectification and mandatory log archiving for 5 years;

2).High-risk breaches likely to pose substantial risks to your rights and freedoms: notify the competent EEA supervisory authority within 72 hours; we will directly inform affected data subjects where necessary.

10. Your Statutory Privacy Rights

Submit all verified privacy rights requests via privacy@ciengood.com with basic identity verification.

Identity Verification Rules

We adopt lightweight verification first (registered email validation, order reference number matching). We will never request excessive sensitive identity documents such as unredacted ID/passport photos unless absolutely unavoidable. Any verification materials submitted will be permanently deleted immediately after request authentication is completed. If we decline your legitimate request, we will supply written legal justification within the statutory response window.

10.1 Rights for EEA Data Subjects (GDPR)

1).Right of Access: obtain a copy of your stored personal data in structured format;

2).Right to Rectification: amend inaccurate or outdated personal information;
Right to Erasure (“Right to be Forgotten”);

3).Right to Restriction of Processing;
Right to Data Portability (machine-readable electronic format);

4).Right to Object to processing based on legitimate interest;
Revoke previously granted consent at any time.

Response timeframe: 30 calendar days for standard requests; a maximum extension of 14 days is permitted for complex requests with prior written notification. Standard identity verification, access, correction and deletion requests are free of charge. A reasonable administrative fee may only be charged for manifestly repetitive, abusive or excessive duplicate requests.

10.2 Rights for California Residents (CCPA/CPRA)

1).Right to Know: obtain disclosure of categories of personal data collected, used and shared, together with corresponding business purposes;

2).Right to Delete verified personal information;

3).Statutory Right to Opt Out of Sale and Sharing of your personal data for cross-context targeted advertising; our website maintains a dedicated “Do Not Sell Or Share My Personal Information” access entry for California users;

4).Non-discrimination guarantee: we will not raise pricing, degrade service quality, restrict website access or impose unfair terms solely because you exercise your CCPA privacy rights;

5).Within any rolling 12-month period, you may submit up to two verified free privacy requests; reasonable administrative fees apply for third and subsequent repetitive requests.

10.3 Supplementary Rule for Minors in the EEA

For users under 16 years old within the EEA, marketing cookies, personalized recommendation services require verifiable consent from a parent or legal guardian. We do not knowingly collect personal data from minors globally aged under 18. If you are a legal guardian and confirm we hold data belonging to a minor, contact us for immediate permanent deletion.

11. Third-Party Links & Embedded Content

This Privacy Policy applies exclusively to ciengood.com. External websites linked from our platform operate under their independent privacy frameworks. We bear no legal liability for third-party data collection and processing activities. We advise you to review the privacy policy of each external site before submitting personal information.

12. Brand Charitable Donation Program

Your participation records in corporate social donation activities are stored solely for internal statistical evaluation. Your personally identifiable information will never be transferred to external charitable organizations without your separate written consent. Only fully anonymized aggregated statistical data may be published publicly.

13. Policy Amendments & Updates

We reserve the right to revise this Privacy Policy to align with updated legislation, business adjustments and data processing changes. Material revisions affecting your core privacy entitlements will be highlighted prominently on our homepage with an updated revision date; registered customers and subscribers will receive a notification email for major policy changes. Your continued use of the Site after the effective date of revisions constitutes acceptance of updated terms.

14. Contact Information & Dispute Resolution

Privacy inquiries, data rights applications, privacy complaints:
Email: privacy@ciengood.com
Online contact form: https://ciengood.com/contact-us

1).EEA residents: You retain the right to lodge a formal complaint with your local national data protection supervisory authority, or seek Alternative Dispute
Resolution (ADR) services;

2).United States users: You may file a complaint with the Federal Trade Commission (FTC) if you believe we violate U.S. privacy protection regulations.

Last Updated: August 06, 2026