Privacy Policy
Your Rights, Our Responsibility
Transparency is part of our quality promise. Below you'll find the full legal documentation governing your use of this website and our services — designed to comply with both EU and UK regulations.
1. Introduction
Lisa Clothing ("LISA Clothing", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website, submit an inquiry, or use our services.
This policy complies with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the UK GDPR as incorporated into UK law by the Data Protection Act 2018. It applies to all visitors to our website, with particular regard to users located in the United Kingdom and the Federal Republic of Germany.
Data Controller: Lisa Clothing
Address: 2nd to 3rd Floors, No.1 Shangpu Building, Chongcheng Road, Miaobian Village, Changsha, Kaiping City, Guangdong Province, China.
Factory: Kaiping City, Jiangmen, Guangdong Province, China
Email: privacy@lisa-clothing.com
2. Personal Data We Collect
We collect and process the following categories of personal data:
2.1 Data You Provide Voluntarily
| Data Category | Examples | Source |
|---|---|---|
| Contact Data | Name, email address, WhatsApp number, brand name | Inquiry form, email, WhatsApp |
| Business Data | Role/title, target market (UK/Germany/Both), quantity, project description | Inquiry form |
| File Uploads | Tech packs, sketches, reference images, specification documents | Inquiry form file attachment |
| Correspondence | Messages exchanged via email, WhatsApp, or website chat | Email, WhatsApp |
2.2 Data Collected Automatically
| Data Category | Examples | Source |
|---|---|---|
| Technical Data | IP address, browser type, operating system, device type | Server log files, cookies |
| Usage Data | Pages visited, time spent, referring URL, click path | Analytics tools, cookies |
| Location Data | Approximate geographic region (country/city level) | IP-based geolocation |
3. Legal Basis for Processing (Art. 6 GDPR)
We process your personal data on the following legal bases:
| Legal Basis | Purpose | Data Categories |
|---|---|---|
| Art. 6(1)(a) Consent | Cookies, marketing communications, analytics | Technical data, usage data |
| Art. 6(1)(b) Contract | Processing inquiries, preparing quotes, fulfilling orders (DDP shipping) | Contact, business, file uploads |
| Art. 6(1)(c) Legal Obligation | Tax records, customs documentation, invoice retention | Contact, business, transaction data |
| Art. 6(1)(f) Legitimate Interests | Website security, fraud prevention, business communication | Technical, usage, IP data |
When processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal. To withdraw consent, contact privacy@lisa-clothing.com.
4. Purposes of Processing
We process your personal data for the following specific purposes:
- Inquiry Processing: To review your tech pack, assess feasibility, and provide a quotation within 24 hours.
- Sample Development: To develop, iterate, and ship denim samples based on your specifications.
- Order Fulfilment: To manage production, quality control, DDP shipping, and customs clearance for deliveries to the UK and Germany.
- Communication: To respond to your questions, provide project updates, and seek feedback on samples.
- Legal Compliance: To maintain records required by Chinese, EU, and UK tax and customs authorities.
- Website Operation: To ensure the security, functionality, and improvement of our website.
5. Data Retention Periods
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law:
Security and IT operations Consent (Art. 6(1)(a))| Data Type | Retention Period | Legal Basis for Retention |
|---|---|---|
| Inquiry Data | 24 months after last contact | Legitimate interest (customer relationship) |
| Order & Contract Data | 10 years | Tax and commercial law (China, EU, UK) |
| Customs & Shipping Documents | 10 years | Customs regulations (EU UCC, UK Customs Acts) |
| Tech Packs & Design Files | Duration of project + 36 months | IP protection, quality reference |
| Server Log Data | 14–30 days | |
| Marketing Data (with consent) | Until consent withdrawn |
6. Recipients of Your Data
We do not sell your personal data. We may share your data with the following categories of recipients:
- Internal Staff: Employees involved in inquiry processing, sample development, production, and shipping, strictly on a need-to-know basis.
- Shipping & Logistics Partners: DDP courier services (e.g., DHL, FedEx) for delivery to UK/DE addresses. Only shipping name, address, and contact details are shared.
- Customs Brokers: For import/export clearance procedures required by UK and German customs authorities.
- IT Service Providers: Hosting, email, and analytics platforms that process data on our behalf under Data Processing Agreements (DPAs).
- Legal Authorities: Where required by law, court order, or competent regulatory authority.
All service providers acting as data processors are bound by written agreements in accordance with Article 28 GDPR, ensuring appropriate technical and organisational measures for data protection.
7. International Data Transfers
As our company is established in the People's Republic of China, your personal data will be transferred to and processed in China. China is not currently recognised by the European Commission or the UK Government as providing an adequate level of data protection (adequacy decision).
To ensure an appropriate level of protection for your personal data during such transfers, we rely on the following safeguards:
- Standard Contractual Clauses (EU SCCs): European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, for transfers to recipients in China.
- UK International Data Transfer Addendum: As issued by the UK Information Commissioner's Office (ICO) under section 119A of the Data Protection Act 2018.
- Transfer Impact Assessment (TIA): Conducted in accordance with the recommendations of the European Data Protection Board (EDPB) to evaluate the legal framework of the destination country and supplementary measures.
- Binding Corporate Rules (if applicable): For intra-group transfers where applicable.
We have implemented supplementary technical measures including end-to-end encryption for data in transit, access controls, and pseudonymisation of personal data where possible. A copy of the SCCs and the Transfer Impact Assessment is available upon request at privacy@lisa-clothing.com.
8. Your Data Protection Rights
Under the EU GDPR and UK GDPR, you have the following rights:
| Right | Description |
|---|---|
| Right of Access (Art. 15) | Request a copy of the personal data we hold about you and information about how we process it. |
| Right to Rectification (Art. 16) | Request correction of inaccurate or incomplete personal data. |
| Right to Erasure (Art. 17) | Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations. |
| Right to Restriction (Art. 18) | Request that we restrict the processing of your personal data under certain conditions. |
| Right to Data Portability (Art. 20) | Receive your personal data in a structured, commonly used, and machine-readable format, and transmit it to another controller. |
| Right to Object (Art. 21) | Object to processing based on legitimate interests or for direct marketing purposes. |
| Right to Withdraw Consent (Art. 7(3)) | Withdraw consent for processing based on consent at any time, without affecting prior lawfulness. |
| Right to Lodge a Complaint (Art. 77) | Lodge a complaint with the competent supervisory authority in your jurisdiction. |
To exercise any of these rights, contact us at privacy@lisa-clothing.com or through our EU/UK representatives. We will respond to your request within one month, extendable by two months for complex requests (Art. 12(3) GDPR).
9. Supervisory Authorities
If you believe that our processing of your personal data infringes the GDPR or UK GDPR, you have the right to lodge a complaint with a supervisory authority:
Germany (EU GDPR)
- Authority: Der Landesdatenschutzbeauftragte Ihres Bundeslandes
- Federal Overview: Die Datenschutzbehörden der Länder — datenschutzkonferenz-online.de
United Kingdom (UK GDPR)
- Authority: Information Commissioner's Office (ICO)
- Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
- Website: ico.org.uk
- Telephone: +44 303 123 1113
10. Automated Decision-Making & Profiling
We do not use your personal data for automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). All inquiries and orders are reviewed and processed by human staff.
11. Data Security Measures
We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Encryption: TLS 1.2/1.3 encryption for data in transit (HTTPS); AES-256 encryption for data at rest.
- Access Control: Role-based access controls (RBAC), multi-factor authentication for administrative accounts.
- Network Security: Firewalls, intrusion detection systems, and regular security monitoring.
- Data Minimisation: Collection limited to data strictly necessary for the stated purposes.
- Staff Training: Regular data protection training for all personnel with access to personal data.
- Incident Response: Documented breach notification procedures in accordance with Art. 33–34 GDPR (notification to supervisory authority within 72 hours).
12. Cookies
We use cookies and similar technologies on our website. Detailed information about the types of cookies we use, their purposes, and how to manage them can be found in our Cookie Policy.
Cookies that are not strictly necessary require your prior consent. You can withdraw or modify your cookie consent at any time via the cookie settings on our website.
13. Children's Data
Our website and services are intended for business-to-business (B2B) customers aged 18 and over. We do not knowingly collect personal data from individuals under the age of 16 (EU GDPR Art. 8) or 13 (UK). If you believe that a child has provided us with personal data, please contact us and we will take steps to delete such data.
14. Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. The updated version will be posted on this page with a revised "last updated" date. We will notify you of material changes by email or through a prominent notice on our website.
We encourage you to review this policy periodically to stay informed about how we protect your data.
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact:
- Data Controller: Lisa Clothing
- Privacy Email: privacy@lisa-clothing.com
- General Email: hello@lisa-clothing.com
- WhatsApp: +86 -13827005025（Lisa）
- EU Representative: privacy-eu@lisa-clothing.com
- UK Representative: privacy-uk@lisa-clothing.com