Effective 10 October 2026. Our online store is open for browsing, customer registration and ordering to the destinations available at checkout. This policy explains how we process personal information when you use these services or contact us.
Who we are
The website and online store at https://elsamilu.com are operated by 东莞市石龙爱莎咪露宠物食品用品批发工作室, trading as Elsamilu. This operator is responsible for the personal information described in this policy.
English translation of the operator’s name, for reference: Dongguan Shilong Elsamilu Pet Food and Supplies Wholesale Studio. The Chinese name above identifies the registered operator.
Business address: No. 33, Guowu, Shilong Town, Dongguan, Guangdong 523000, China (广东省东莞市石龙镇郭屋33号).
Privacy contact: elsamilu@outlook.com. Telephone: +86 186 6641 1641. Please use this contact for questions about this notice and requests concerning your personal information.
Information we collect
When you shop, create an account or contact us, we collect the information you provide. This can include your name, email address, telephone number, billing and delivery addresses, account details, items ordered, order history and customer-service correspondence.
When you request custom sizing, we process the contact details and pet measurements you provide, your selected product and customisation requirements, and related correspondence. The request record can also include our proposed finished-garment measurements, quotation, fees, estimated production timing, linked order information and production status. These details are associated with your request and any resulting order. We send service emails to acknowledge new custom-size requests and notify you of new quotations. These emails may contain a private link to your request; keep that link confidential. They are transactional messages, not marketing subscriptions.
We keep records of the quotation and terms presented to you and your confirmation when you submit payment, including the recorded time and quotation version. This confirmation records your agreement to the quoted order and authorises production after payment has been verified. It is separate from any choice about optional marketing, tracking or publication of customer photos. Submitting a payment request does not itself establish that payment has been received.
Our website also processes technical information needed to operate the store, such as your IP address, browser and device information, cart and session identifiers, and access or error logs. Information required to complete an order is identified in the checkout form; without it, we may be unable to process or deliver your order.
If you submit a review or comment, we process the information you provide, including your name, email address, review or comment text and, for product reviews, your star rating. We also process technical details used for moderation and spam prevention. We use relevant purchase records to check eligibility to review a product. Published reviews or comments can display your name and submitted content; product reviews also display a star rating and may show a verified-owner label. Avoid including personal information you do not want made public.
Our store is configured to accept product reviews only from customers who have purchased the relevant product, to require a star rating and to require manual approval before reviews or comments are published. The information used to verify a purchase is separate from the review text you submit.
How we use information
We use personal information to process orders, arrange delivery, manage accounts, send order and account messages, respond to enquiries, handle returns or other order issues, protect the store against fraud and misuse, and meet applicable record-keeping obligations.
We use custom-order information to assess your request, prepare and revise your quotation, make the garment to the agreed specifications, manage payment and production, and address after-sales questions or disputes.
Where the EU GDPR or UK GDPR applies, the purposes and proposed legal bases are:
• Taking requested steps towards a purchase and performing our contract with you: account services you request, quotations, orders, payment administration, delivery and contractual after-sales support.
• Consent: optional marketing measurement and publication of customer gallery media. These choices are separate from accepting sales terms or authorising custom production.
• Legitimate interests, subject to your rights and a balancing assessment: proportionate security and fraud prevention, handling non-contractual enquiries, moderating reviews, maintaining evidence of transactions and defending legal claims. These interests are operating a reliable store, protecting customers and resolving disputes.
• Legal obligations: record keeping and disclosures required by laws that provide an applicable legal-obligation basis under the relevant GDPR. A foreign tax obligation is not automatically such a basis; necessary foreign-tax records are assessed separately, including the legitimate-interest basis where appropriate.
Service providers and other recipients
We use Alibaba Cloud for website hosting, Brevo to deliver transactional messages such as order confirmations and password-reset emails, and Microsoft Outlook to receive and respond to customer correspondence. These services process information relevant to their functions, which can include email addresses, message content, technical logs and delivery information.
Our WooCommerce installation is configured to share store configuration and usage statistics with Automattic, and to send diagnostic information when relevant errors occur. Usage reporting can include the store website address, administrator email address, software and server configuration, order and product counts, revenue statistics by payment gateway, and interactions with WooCommerce administration features. This helps improve WooCommerce and troubleshoot problems. Diagnostic information can include the website address, the affected request, software or browser versions and error details. WooCommerce applies filtering to reduce the inclusion of sensitive information in these logs.
Because usage tracking and order attribution are enabled, statistical attribution information is also shared with Automattic on a per-order basis. According to WooCommerce’s documentation, this attribution-sharing feature does not send customer email addresses or billing or delivery details. See WooCommerce usage tracking, order attribution information and Automattic’s privacy policy for more information.
Our website is configured to use Gravatar, an Automattic service, to display profile images, for example alongside comments or reviews. When an avatar is requested, a hash derived from the email address provided for that profile, comment or review is sent to Gravatar to look up an associated image. When a page loads images directly from Gravatar, the service can also receive the viewer’s IP address and browser information. An available profile image may appear publicly beside a published comment or review. For more information, see Automattic’s privacy policy.
For an order, the payment service you select receives information needed to process that transaction. The delivery service receives necessary recipient contact and address details, parcel information and customs information. Overseas shipments may use Yanwen Logistics and its delivery partners; Macao shipments may use SF Express. Preparing carrier bookings manually still involves providing delivery information to the carrier. The service and tax arrangements for your particular order are identified before payment.
The proprietor handles bookkeeping and tax reporting personally. We may supply necessary records to tax or other competent authorities as required by law and disclose necessary information to establish, exercise or defend legal claims.
Customer Gallery
If you give us permission to feature your photos or videos in our Customer Gallery, our team may upload and publish the agreed content on the website. Published gallery content is publicly accessible. Giving us information for an order or confirming production does not by itself authorise publication of your photos or videos.
To withdraw your permission or request removal of Customer Gallery content from our website, email elsamilu@outlook.com and identify the relevant photo or video where possible. After checking your request, we will promptly remove the relevant content from our website.
We retain the related permission record while the content is displayed. We review gallery media and permission records at least once every 12 months and remove or delete material that is no longer needed. We retain information that remains necessary to handle an outstanding request or dispute, or to meet applicable legal obligations.
Cookies, email tracking and embedded content
WordPress and WooCommerce use cookies and similar identifiers to support logins, shopping carts and checkout. With the default WooCommerce settings, cart-change cookies last for the browsing session and the cart session identifier lasts for approximately two days. WordPress login cookies normally last for two days, or two weeks when “Remember Me” is selected.
With your consent to Marketing measurement, we use WooCommerce order attribution to understand which websites, links and campaigns lead to purchases. It records referring pages and campaign identifiers, device type and the number of pages viewed during a visit. It uses first-party cookies whose names begin with sbjs_. Under our current configuration, sbjs_session lasts for 30 minutes and the other attribution cookies last for the session. When you place an order, available attribution details are saved with that order. The expiry or removal of a browser cookie does not automatically delete attribution information already stored with an order; that information is subject to our order-data retention arrangements.
We use Complianz to present our cookie choices and WP Consent API to communicate those choices to compatible website components, including WooCommerce order attribution. Our banner offers Accept all, Reject optional and View preferences. Essential cookies remain active to provide requested store functions. Optional order-attribution cookies are blocked until you allow Marketing measurement.
You can change or withdraw your permission using the Cookie settings control on our website. Choose Reject optional, or turn off Marketing measurement and select Save preferences. This stops optional order-attribution tracking in that browser. Withdrawing permission does not by itself erase information already saved with an order; you can contact us about that information using the details below.
We store first-party cookies to remember and apply your choices. The Complianz cookies cmplz_functional, cmplz_preferences, cmplz_statistics, cmplz_marketing, cmplz_consented_services, cmplz_policy_id and cmplz_banner-status are configured with a 365-day lifetime. Cookies whose names begin with wp_consent_ store consent-category choices and are configured for 30 days. These consent-management cookies do not themselves perform the optional marketing measurement described above. Choices are stored in the browser you use; another browser or device may require a separate choice.
For further information about the cookies and similar technologies listed for our website, including their purposes and storage periods, see our Cookie Policy.
You can manage cookies through your browser. Blocking necessary cookies may prevent parts of the store, including account or cart features, from working correctly.
Where a page includes third-party embedded content, its accompanying information and cookie choices explain the provider and any optional processing before that content is enabled.
We use Brevo to send transactional emails, including order and account messages. We have enabled per-contact consent controls for tracking email opens and link clicks, with tracking disabled for contacts whose consent is unknown. Brevo may still process delivery, bounce and other deliverability information needed to operate its email service. These settings concern email engagement tracking and are separate from the cookie preferences available on our website.
Where information is processed
The store is operated from China, and its website and store database are hosted on an Alibaba Cloud Simple Application Server in Virginia, United States. We manage store information from China to process orders and provide customer service. Information may therefore be stored or accessed in a country different from the country where you live. Our other service providers may process information in additional countries according to the services and account configurations used.
We purchased the hosting service through Alibaba Cloud’s China website, aliyun.com. Its published Simple Application Server service agreement describes handling customer business data to fulfil service requests and storing it in the selected data centre, subject to the agreement’s provisions on authorised and legally required disclosures.
We use Brevo to deliver transactional emails. Brevo reports that its databases are hosted in the European Union, including France, Germany and Belgium. Its services may also involve processing by affiliates and subprocessors in other countries, including the United States and India, depending on the services and support involved.
Brevo publishes data-processing and international-transfer commitments in its Terms of Service. Microsoft and Automattic also describe international processing in their privacy statements. Provider statements do not mean that every provider stores data only in your country. Contact us for information about the safeguards applicable to your information.
We use Microsoft Outlook.com to receive and respond to customer emails. Microsoft states that personal data may be stored and processed in the United States and other countries where Microsoft, its affiliates or service providers operate facilities. Its Privacy Statement describes safeguards for relevant international transfers, including standard contractual clauses.
Information shared through WooCommerce reporting and Gravatar is handled by services within the Automattic group. Automattic’s published privacy policy explains that information processed through its services in the European Union or United Kingdom may be used, stored or accessed outside the European Economic Area or United Kingdom by its staff, group companies and service providers. It describes international-transfer measures, including standard contractual arrangements approved by the European Commission or United Kingdom government where required by applicable law.
You can contact us at elsamilu@outlook.com for further information about international processing and the applicable safeguards.
How long we keep information
We keep account and order information for as long as needed to provide account services, fulfil orders, handle after-sales matters and disputes, and meet applicable record-keeping requirements. We review these records manually at least once every 12 months and delete or anonymise personal information that is no longer needed. Accounting and tax records are retained for the periods required for those record types. Where Chinese tax rules require it, relevant tax books, bookkeeping vouchers, reports, tax-payment documents, invoices, export documents and other tax-related records are kept for 10 years, unless applicable law provides a different period. This requirement concerns the relevant tax records and does not apply automatically to every item of customer information. Records relating to unresolved matters are retained until those matters are resolved and any applicable retention requirements have been met.
For custom-sizing enquiries that do not result in an order, we manually review the related request, measurements and quotation records once 12 months have passed since the enquiry was resolved, and delete personal information that is no longer needed.
For custom orders, we include measurements, quotation versions, payment-time confirmations and production records in our manual order-record review at least once every 12 months. This includes related records held separately from the order. We delete or anonymise personal information that is no longer needed. In both cases, we retain information that remains necessary for after-sales support, disputes or applicable legal obligations for as long as those purposes require. These review intervals are not automatic deletion deadlines.
We retain published reviews while they remain useful for product information and customer reference. At least once every 12 months, we manually check our review and comment records and delete or anonymise personal information that is no longer needed. During moderation, we address spam and personal information disclosed unintentionally. We retain information that remains necessary for after-sales support, disputes or applicable legal obligations for as long as those purposes require. These review intervals are not automatic deletion deadlines.
Orders marked as “Pending payment” or “Failed” become eligible to be moved automatically to the trash when more than 30 days have passed since their creation. Cleanup runs periodically, so this may not happen immediately. Moving an order to the trash is not immediate permanent deletion. These settings do not apply to orders in other statuses, including “On hold” and “Processing”, and do not determine how long separate copies remain in emails, logs or backups.
Technical security and error logs are used to investigate faults, misuse and security incidents. Their retention depends on the event being investigated, the time needed to resolve it, and any applicable evidence or legal-preservation requirement. They are separate from order records and email logs.
The website’s FluentSMTP email logs are configured for a 14-day retention period. This setting does not determine how long Brevo keeps its own logs or how long messages remain in our Outlook inbox, recipients’ inboxes or backups.
Brevo is configured to automatically delete transactional email logs for all our senders after one month. Deletion can take up to 24 hours after the retention period ends. Our Brevo account is configured not to store HTML previews for new transactional emails. This preview setting does not by itself remove previews stored before it took effect.
Our retention procedure for ordinary customer-service correspondence is to manually review messages once 12 months have passed since the enquiry was resolved, and delete messages that are no longer needed. Records needed as evidence of an order, for ongoing after-sales support, to resolve a dispute or to meet applicable legal obligations are handled separately and retained for as long as those purposes require.
Database backups are scheduled daily and stored on the website server. The backup task is configured to retain the latest seven copies produced by that task. This is a limit on the number of copies, rather than a fixed deletion deadline for every copy of the data. We also keep separately created manual database backups on the website server, a downloaded copy of a manual database backup on our computer, and server disk snapshots with Alibaba Cloud for recovery. These copies are managed outside the daily database backup rotation.
We retain the manual database backup, including its downloaded computer copy, and the server disk snapshot made during the website build for recovery during development. Once the live website has operated stably for 30 days and newer usable backups covering the corresponding recovery needs have been confirmed, we manually review these older copies and delete those that are no longer needed. We assess database backups and server disk snapshots separately because they cover different recovery needs.
For backups made before later major website changes, we carry out the same manual review 30 days after the changes have been verified, subject to the same requirement for newer usable backups covering the corresponding recovery needs. If a copy remains necessary for recovery, an unresolved incident or dispute, or applicable legal obligations, we retain it and set a further review date. These intervals schedule manual reviews; deletion depends on whether a copy is still needed.
Your choices and rights
Depending on the applicable law, you may request access to or a copy of your information, correction, deletion, restriction of processing or data portability. Where we rely on consent, you may withdraw it without affecting earlier lawful processing. You may also request an explanation of our processing rules. Rights and their exceptions depend on the applicable law.
You can update the details available in your account settings. For other requests, contact elsamilu@outlook.com. We request only the information reasonably needed to verify a request. We will respond within the applicable legal time limit and explain any lawful refusal or extension. Records that must be kept for an order, dispute or legal obligation are not automatically deleted. Requests involving custom measurements, quotations or gallery content also cover relevant records held separately from ordinary WooCommerce orders.
Right to object
Where the EU GDPR or UK GDPR applies, you may object to processing based on legitimate interests for reasons connected with your situation. You may object to direct marketing at any time. Contact elsamilu@outlook.com to exercise this right.
You may complain to the data-protection authority responsible for your case, including the UK Information Commissioner where UK law applies, or the authority in your EU country of habitual residence, work or an alleged infringement. You do not have to complain to us first. Rights under other applicable privacy laws remain available.
Provider information
Further provider information is available in the Alibaba Cloud service agreement, Brevo Terms of Service, Brevo data storage information, Microsoft Privacy Statement, Automattic’s privacy policy, WooCommerce usage tracking, order attribution information and Gravatar data privacy information.
Changes and contact
We may update this policy when our services or information practices change. We will publish the revised policy on this page with an updated effective date and provide additional notice where required.
For privacy questions or requests, email elsamilu@outlook.com.