Last Updated: August 6, 2026

Torytale operates this store and website, together with all related information, content, features, tools, products, and services, in order to provide you with a personalized and high-quality shopping experience (collectively, the “Services”).

Torytale uses Shopify as its e-commerce platform, which enables us to provide the Services.

This Privacy Policy explains how we collect, use, process, store, and disclose your personal information when you visit or use our Services, make a purchase or other transaction, or otherwise communicate with us.

If there is a conflict between our Terms of Service and this Privacy Policy concerning the collection, processing, or disclosure of personal information, this Privacy Policy will control.

Please read this Privacy Policy carefully. By accessing or using the Services, you acknowledge that you have read and understood the personal information practices described in this policy.

Personal Information We Collect or Process

When we use the term “personal information,” we mean information that identifies you or that can reasonably be linked to you or another individual.

Personal information does not include information that has been collected anonymously or de-identified so that it can no longer reasonably identify or be linked to you.

Depending on how you interact with the Services, where you reside, and what is permitted or required by applicable law, we may collect or process the following categories of personal information:

• Contact details, including your name, address, billing address, shipping address, telephone number, and email address.

• Financial and payment information, including information related to credit or debit cards, financial accounts, payment methods, transactions, payment confirmations, and other information necessary to process payments.

• Account information, including username, password, security questions, preferences, and settings.

• Transaction information, including products you view, add to your cart or wishlist, purchase, return, exchange, or cancel, as well as your transaction history.

• Communications with us, including information you provide when contacting our customer support team.

• Device information, including information about your device, browser, network connection, IP address, and other identifiers.

• Usage information, including information about how and when you interact with the Services or browse our website.

Sources of Personal Information

We may obtain personal information from the following sources:

• Directly from you, for example when you create an account, visit or use the Services, make a purchase, contact us, or otherwise provide information.

• Automatically through the Services, including from your device and through cookies and similar technologies.

• From our service providers, when we use providers to support certain technologies, features, or services and they collect or process information on our behalf.

• From our business partners or other third parties, where permitted by applicable law.

How We Use Your Personal Information

Depending on how you interact with us and which Services you use, we may use your personal information for the following purposes.

Providing, Personalizing, and Improving the Services

We use your personal information to provide the Services and, where applicable, perform our contract with you, including to:

• Process payments.

• Process and manage orders.

• Arrange shipping and delivery.

• Manage purchases, returns, exchanges, refunds, and withdrawals.

• Create, maintain, and administer your account.

• Remember your preferences and products of interest.

• Send communications relating to your account or orders.

• Allow you to post reviews.

• Provide customer support.

• Personalize and improve your shopping experience.

• Recommend products related to your purchases or interests.

We may also use this information to better understand how the Services are used and to improve our operations, products, and customer experience.

Marketing and Advertising

We may use personal information for advertising and promotional purposes, including to:

• Send marketing communications by email, text message, or postal mail where permitted.

• Show you advertisements for our products or services.

• Personalize certain advertisements based on your interactions with our store where permitted by applicable law.

Where required, we will obtain your consent before using non-essential cookies or similar technologies for certain marketing or personalized advertising activities.

Security and Fraud Prevention

We may use personal information to:

• Authenticate accounts.

• Maintain a secure shopping and payment experience.

• Detect, investigate, and prevent fraud.

• Identify potentially illegal, malicious, or unauthorized activity.

• Protect our Services, customers, and business.

• Prevent unauthorized transactions.

If you create an account, you are responsible for keeping your login credentials secure.

We recommend that you do not share your username, password, or other account access information with third parties.

Communicating With You

We may use your personal information to:

• Respond to your inquiries.

• Provide customer support.

• Provide information about orders and deliveries.

• Maintain our business relationship with you.

• Manage requests relating to returns, refunds, or products.

Complying With Legal Obligations

We may process personal information when necessary to:

• Comply with applicable law.

• Respond to valid legal process or requests.

• Respond to lawful requests from public authorities.

• Investigate or manage claims and legal proceedings.

• Enforce our policies and terms.

• Protect our rights and the rights of our customers or others.

How We Disclose Personal Information

In certain circumstances and for legitimate purposes, we may disclose personal information to third parties, including:

• Shopify, as well as vendors and third parties that provide services on our behalf, such as IT management, payment processing, analytics, customer support, cloud storage, order fulfillment, and shipping.

• Business and marketing partners, where necessary to provide advertising or marketing services and where permitted by applicable law.

• Carriers and logistics partners, where necessary to prepare and deliver your orders.

• Affiliates or companies within our corporate group, where applicable.

• Third parties to whom you request, authorize, or consent that we disclose information.

• Authorities, advisers, or other relevant parties, where disclosure is necessary to comply with a legal obligation, protect rights, prevent fraud, or manage a business transaction.

We may also disclose information in connection with a business transaction such as a merger, acquisition, restructuring, insolvency, or sale of assets, in accordance with applicable law.

Depending on where you reside, you may have the right to opt out of certain forms of disclosure or processing used for targeted advertising.

Our Relationship With Shopify

The Services are hosted by Shopify.

Shopify collects and processes certain personal information relating to your access to and use of the Services in order to provide, maintain, and improve its platform and features.

Information you provide through our store may be transmitted to Shopify and certain third parties that are necessary to provide and improve the Services. These recipients may be located in countries other than your country of residence.

We may also use certain Shopify features designed to protect, develop, and improve our business. Some of these features may use information derived from your interactions with our store, with other merchants using Shopify, and with Shopify.

In certain circumstances, Shopify may act independently as a controller of personal information for specific processing activities.

For more information about how Shopify uses personal information and the rights that may be available in relation to Shopify's processing activities, you may review the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

Third-Party Websites and Links

The Services may contain links to websites, platforms, or services operated by third parties.

If you access a website that is not affiliated with Torytale or that we do not control, we recommend that you review its privacy, security, and terms of use policies.

We do not control and are not responsible for the privacy or security practices of third-party websites, including the accuracy, completeness, or reliability of information available on those sites.

Information you post in public or semi-public areas, including on third-party social media platforms, may be visible to others and subject to the policies of those platforms.

The inclusion of external links does not necessarily mean that Torytale endorses the operator, content, or practices of the relevant website.

Children's Data

The Services are not intended for use by individuals under the applicable legal age in their jurisdiction, and we do not knowingly collect personal information from such individuals.

If you are a parent or legal guardian and believe that a minor has provided us with personal information, you may contact us using the details provided at the end of this Privacy Policy to request deletion.

As of the effective date of this Privacy Policy, we do not have actual knowledge that we sell or share, as those terms may be defined under certain privacy laws, personal information of individuals under 16 years of age.

Security and Retention of Information

We use reasonable measures designed to protect personal information.

However, no security system or measure can guarantee absolute protection, and we cannot guarantee perfect security.

Information transmitted over the Internet may also be exposed to risks during transmission. We recommend that you do not use unsecured channels to send us particularly sensitive or confidential information.

How long we retain personal information depends on various factors, including:

• The need to maintain your account.

• The provision of our Services.

• Compliance with tax, accounting, or legal obligations.

• Fraud prevention.

• Dispute resolution.

• Claims management.

• Enforcement of contracts and policies.

We retain information for as long as reasonably necessary for the relevant purposes and for any additional period required or permitted by applicable law.

Your Rights and Choices

Depending on your country or region of residence, you may have some or all of the rights described below.

These rights are not absolute and may be subject to conditions, exceptions, or limitations under applicable law.

Right to Access or Know

You may have the right to request information about the personal information we maintain about you and, where applicable, obtain access to it.

Right to Delete

You may have the right to request deletion of certain personal information we maintain about you.

Right to Correct

You may have the right to request correction of inaccurate personal information.

Right to Portability

In certain circumstances, you may have the right to receive a copy of certain personal information and request that it be transferred to a third party where applicable.

Right to Opt Out of Sale, Sharing, or Targeted Advertising

Depending on where you reside, you may have the right to request that we not sell or share your personal information, as those terms may be defined under applicable law, or to opt out of the processing of personal information for certain forms of targeted advertising.

You may exercise these rights through privacy options made available through the Services where applicable.

Global Privacy Control

If you visit our website with a Global Privacy Control (GPC) preference signal enabled, we may treat that signal as a valid opt-out request where required by applicable law.

Where it is possible to associate the device sending the signal with a Shopify account, the preference may also apply to that account.

Apart from Global Privacy Control, we do not necessarily recognize other general “Do Not Track” signals transmitted by browsers or devices.

Marketing Communication Preferences

We may send promotional emails to you.

You may opt out of receiving promotional emails at any time by using the unsubscribe option included in those communications.

Even if you opt out of marketing communications, we may continue to send non-promotional communications that are necessary, including messages relating to:

• Your account.

• Your orders.

• Your payments.

• Your returns.

• The provision of the Services.

Exercising Your Rights

You may exercise rights available in your jurisdiction by using the tools indicated in the Services or by contacting us using the details provided at the end of this Privacy Policy.

We will not discriminate against you for legitimately exercising your privacy rights.

Where permitted or required by applicable law, we may request reasonable information to verify your identity before processing a request.

You may also have the right to appoint an authorized agent to submit certain requests on your behalf.

In such cases, we may request documentation demonstrating the agent's authority and, where appropriate, may verify your identity directly.

We will respond to requests within the time periods required by applicable law.

Additional Information for Individuals in the EEA

If you are located in the European Economic Area (EEA), the following additional information applies to the processing of your personal data under the General Data Protection Regulation (GDPR) and other applicable European data protection laws.

Nothing in this section limits any rights available to you under applicable law.

Data Controller

For purposes of the GDPR, the controller of the personal data described in this Privacy Policy is:

Torytale

Legal Entity: 香港合海貿易有限公司

Address: 28柯士甸道, AA28 大廈 6 樓 19 室, 尖沙咀, Kowloon, Hong Kong SAR

Email: service@torytalestore.com

In certain circumstances, Shopify or other service providers may independently act as controllers for specific processing activities.

Where applicable, their processing activities will be subject to their own privacy policies or notices.

Legal Bases for Processing

Where the GDPR applies, we process personal data only when we have an appropriate legal basis.

Depending on the circumstances, these legal bases may include the following.

Performance of a Contract

We may process personal data when necessary to enter into or perform a contract with you, including to:

• Process and confirm orders.

• Process payments.

• Arrange shipping and delivery.

• Provide order status information.

• Manage returns, refunds, exchanges, and withdrawals.

• Provide customer support.

• Administer your account.

• Respond to requests relating to your purchases.

Compliance With Legal Obligations

We may process personal data when necessary to comply with obligations relating to:

• Tax and accounting.

• Consumer protection.

• Fraud prevention.

• Regulatory requirements.

• Legally valid requests from public authorities.

• Mandatory record retention.

Legitimate Interests

Where permitted by law, we may process personal data where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your fundamental rights and freedoms.

These legitimate interests may include:

• Protecting our website, customers, and business from fraud and misuse.

• Maintaining the security of the Services.

• Preventing unauthorized transactions.

• Improving our products, Services, and customer experience.

• Understanding how customers use the Services.

• Managing and improving our operations.

• Establishing, exercising, or defending legal claims.

Where we rely on legitimate interests, we consider the nature of the information, the purpose of the processing, and the possible impact on your privacy rights.

Consent

Where required by applicable law, we rely on consent as the legal basis for certain activities, which may include:

• Non-essential cookies and similar technologies.

• Certain personalized advertising activities.

• Certain marketing communications.

• Other processing activities for which consent is legally required.

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Data Protection Rights in the EEA

Subject to the conditions and exceptions set out in applicable law, individuals in the EEA may have the following rights.

Right of Access

You may request confirmation as to whether we process your personal data and obtain access to the personal data we maintain about you.

Right to Rectification

You may request correction of inaccurate personal data and completion of incomplete personal data.

Right to Erasure

You may request deletion of your personal data where the circumstances provided by applicable law apply.

This right is not absolute.

We may retain certain information where necessary to comply with legal obligations, prevent fraud, establish or defend legal claims, or fulfill another lawful purpose.

Right to Restriction of Processing

You may request restriction of the processing of your personal data in certain circumstances.

For example, this right may apply while we verify the accuracy of certain data or while we assess an objection you have submitted.

Right to Data Portability

Where applicable, you may request to receive personal data you have provided to us in a structured, commonly used, and machine-readable format.

You may also have the right to request that such data be transmitted directly to another controller where technically feasible and legally required.

Right to Object

You may object, in certain circumstances, to processing based on our legitimate interests.

Where a valid objection applies, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds to continue or the processing is necessary to establish, exercise, or defend legal claims.

Right to Object to Direct Marketing

You have the right to object at any time to the processing of your personal data for direct marketing purposes.

If you object to direct marketing, we will stop using your personal information for that purpose.

You may also unsubscribe from promotional emails using the link included in those communications.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Rights Relating to Automated Decision-Making

Where applicable, you may have certain rights in relation to decisions based solely on automated processing, including profiling, where those decisions produce legal effects or similarly significantly affect you.

Where we use this type of processing in circumstances regulated by applicable law, we will provide the information and safeguards required by law.

How to Exercise Your Rights in the EEA

To exercise your data protection rights, please contact us:

Email: service@torytalestore.com

Please clearly identify the right you wish to exercise and provide sufficient information for us to identify the relevant account, order, or personal information.

We may request reasonable information to verify your identity before processing a request.

We will respond to valid requests without undue delay and generally within one month, in accordance with applicable law.

In certain circumstances, this period may be extended where permitted by law, for example if a request is particularly complex or if multiple requests have been submitted.

If an extension applies, we will inform you as required by applicable law.

Exercising GDPR rights is generally free of charge.

However, where permitted by law, we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.

Marketing, Advertising, and Cookies in the EEA

Where required by applicable European law, we will obtain your consent before using non-essential cookies or similar technologies for certain advertising or analytics purposes.

You may manage your preferences through cookie or privacy controls made available on our website.

Where those controls are available, you may modify or withdraw your consent preferences at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

International Transfers

Torytale operates outside the EEA and uses service providers that may process personal data in countries other than the country in which you reside.

Where we transfer personal data outside the EEA and applicable law requires specific safeguards, we will use a legally recognized transfer mechanism.

Depending on the destination country and the circumstances, these mechanisms may include:

• An adequacy decision issued by the European Commission.

• The European Commission's Standard Contractual Clauses.

• Other transfer mechanisms or safeguards permitted under applicable data protection law.

Where applicable to transfers from the United Kingdom, we will similarly use transfer mechanisms recognized under applicable UK data protection law.

Complaints to a Supervisory Authority

If you are located in the EEA and have concerns about how we process your personal data, you may contact us at:

service@torytalestore.com

You may also have the right to lodge a complaint with a competent data protection authority, including the authority in the EEA country where you:

• Reside.

• Work.

• Believe an infringement may have occurred.

Your right to lodge a complaint with a supervisory authority does not prevent you from contacting Torytale directly.

Representative in the European Union

Where the GDPR requires Torytale to appoint a representative in the European Union, the representative's contact information will be provided in this Privacy Policy or through another appropriate privacy notice.

Nothing in this section limits any rights or remedies available to you under the GDPR or other applicable European data protection law.

Complaints

If you have a complaint about how we process your personal information, please contact us using the details provided at the end of this Privacy Policy.

Depending on where you reside, you may also have the right to:

• Appeal a decision relating to a privacy request.

• Lodge a complaint with the competent data protection authority.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

• Our practices.

• Our Services.

• Our operations.

• Legal or regulatory requirements.

When we make changes, we will publish the revised version on our website, update the “Last Updated” date, and provide any additional notice required by applicable law.

Contact

If you have questions about our privacy practices or this Privacy Policy, or if you would like to exercise any rights that may be available to you, please contact us:

Torytale

Legal Entity: 香港合海貿易有限公司

Address: 28柯士甸道, AA28 大廈 6 樓 19 室, 尖沙咀, Kowloon, Hong Kong SAR

Email: service@torytalestore.com