Privacy Policy

The data controller responsible for this website is KOIBONI APEX LIMITED, Business Registration No. 80997483, registered office Unit 1603, 16/F, The L. Plaza, 367–375 Queen's Road Central, Sheung Wan, Hong Kong. Privacy enquiries: support@koiboni.online or +1 650 468 5832 (Monday to Friday, 9:00 AM – 6:00 PM Eastern Time (excluding public holidays)).

• Identity and contact details: name, email address, telephone number.
• Order details: shipping and billing address, items ordered, order value, order history, delivery and return records.
• Payment information: transaction amount, authorization result, card brand and last four digits, and billing address verification results supplied by our payment provider. We never receive or store full card numbers, CVV/CVC codes, PINs or other raw payment credentials.
• Account information: where you create an account, your login email and a securely hashed password.
• Support correspondence: messages, photographs and attachments you send us.
• Technical data: IP address, device and browser type, operating system, referring page, pages viewed and interaction timestamps.
• Marketing data: your subscription status and email engagement, where you opt in.

We do not knowingly collect sensitive personal information such as government ID numbers, precise geolocation, health data or biometric data, and we ask that you do not send it to us.

Directly from you when you place an order, create an account, track an order, contact support or subscribe to marketing; automatically through cookies and similar technologies when you browse the site; and from service providers such as our payment processor, fulfilment partners and delivery carriers.

• Processing, fulfilling, shipping and tracking your orders.
• Taking payment and issuing refunds through our payment provider.
• Fraud prevention, chargeback defence and transaction security checks.
• Customer support, returns handling and warranty claims.
• Sending transactional emails such as order, dispatch and refund confirmations.
• Analytics to understand and improve how the store performs.
• Marketing communications, only where you have opted in.
• Meeting accounting, tax, consumer-protection and other legal obligations.

Where local law requires a legal basis, we rely on performance of a contract (orders and support), legitimate interests (site security, fraud prevention, service improvement), consent (marketing and non-essential cookies) and legal obligation (tax and record keeping).

• Strictly necessary: cart contents, session state, checkout security and fraud prevention. These cannot be switched off.
• Functional: remembering preferences such as recent searches and filters.
• Analytics: aggregated, privacy-respecting page and traffic measurement used to improve the store.
• Marketing: used only if and when we enable advertising measurement, and only with your consent where consent is required.

You can block or delete cookies in your browser settings. Blocking strictly necessary cookies will prevent the cart and checkout from working. We honour Global Privacy Control (GPC) signals as an opt-out of any sale or sharing of personal information.

Marketing emails are sent only where you have opted in, and every message includes a one-click unsubscribe link. Opting out of marketing does not stop transactional emails relating to orders you have placed. We do not send marketing SMS unless you separately consent.

We share personal information only with providers that support the categories below:

• Payment processing and fraud screening (PCI DSS compliant payment provider).
• Order fulfilment, warehousing and returns handling.
• Delivery carriers, including USPS, UPS and FedEx (carrier selected by destination and parcel size).
• Transactional and marketing email delivery.
• Website hosting, content delivery and error monitoring.
• Website analytics.
• Professional advisers such as accountants and legal counsel, where necessary.

Each provider is bound by contract to process personal information only on our instructions and to keep it secure. We also disclose information where required by law, to respond to lawful requests, to enforce our terms, or in connection with a merger, acquisition or sale of assets. We do not sell your personal information and we do not share it for cross-context behavioural advertising.

Because KOIBONI APEX LIMITED is established in Hong Kong, personal information relating to US customers is processed both in the United States and outside it, including in Hong Kong. Where information is transferred internationally, we use contractual protections with our providers and apply the safeguards described in this policy regardless of where the data is processed.

We keep 7 years for order, tax and accounting records; 24 months for marketing contacts. Support correspondence is kept for 24 months. Account data is kept until you delete your account, after which we retain only the order records we are legally required to keep. When information is no longer needed it is deleted or irreversibly anonymised.

The site is served exclusively over HTTPS/TLS, passwords are stored using industry-standard hashing, administrative functions are access-controlled, and card data is captured and processed directly by our PCI DSS compliant payment provider rather than by this website — it never touches our servers. Access to customer data is limited to staff who need it to do their job. No online service can be guaranteed completely secure, and we make no claim to any specific security certification unless it has been independently verified. If a breach affecting your personal information occurs, we will notify you and the relevant authorities as required by applicable law.

Subject to applicable law, including the California Consumer Privacy Act as amended by the CPRA and similar state laws in Virginia, Colorado, Connecticut, Utah and Texas, you have the right to:

• Know what personal information we collect, use and disclose about you.
• Access a copy of that information.
• Correct inaccurate personal information.
• Request deletion of your personal information.
• Opt out of marketing at any time.
• Opt out of any sale or sharing of personal information (we do neither).
• Not be discriminated against for exercising these rights.

To exercise a right, email support@koiboni.online with "Privacy Request" in the subject line. We verify requests using details tied to your orders or account and respond within 45 days, extendable once by a further 45 days where permitted. Authorised agents may submit requests with written proof of authority.

The store is intended for adults. We do not knowingly collect personal information from children under 13, and we do not sell or share the personal information of anyone under 16. If you believe a child has provided information, contact support@koiboni.online and we will delete it promptly.

Our site may link to third-party websites, such as carrier tracking pages. We are not responsible for their content or privacy practices; their own policies apply.

We may update this policy to reflect changes to our practices or legal requirements. The revised version takes effect when published on this page, and the "Last updated" date above will change. Material changes will be notified by email to subscribers where required.

KOIBONI APEX LIMITED, Unit 1603, 16/F, The L. Plaza, 367–375 Queen's Road Central, Sheung Wan, Hong Kong. Email support@koiboni.online. US Customer Support +1 650 468 5832. See also our Terms & Conditions, Shipping Policy and Return & Refund Policy.