Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how MiniCity (Hongkong) Co., Limited ("MiniCity", "we", "us" or "our") collects, uses, discloses, shares and protects personal information when you visit our website at manchengcw.com (the "Website"), when you contact us, and when you use the MiniCity Management App ("the App"), which we distribute through the Apple App Store and Google Play.

The scope of our business — wholesale and retail of trendy toys, figurines, cultural and creative gifts and home ornaments; cultural and creative product design; business information consultation; import and export of goods and technology; and general trade (excluding regulated businesses such as finance, insurance and lending) — shapes which information we collect. In simple terms: we handle the personal information of business contacts, customers, suppliers, distributors, app users and website visitors.

This Policy is designed to satisfy the requirements of the GDPR and UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act, Brazil's LGPD, Canada's PIPEDA, the Australian Privacy Principles, Singapore's PDPA, India's DPDP Act and PDPB Act, Japan's APPI, South Korea's PIPA, and other applicable privacy and consumer protection laws.

2. Data We Collect

We collect the following categories of personal information:

• Account and contact data. When you create an account in the App or send an enquiry, we collect your name, business email address, company name, job title, telephone number, country or region and any commercial details you provide, such as order quantities, product categories and delivery addresses.
• Device and technical data. We collect device model, operating system and version, app version, screen resolution, browser type and language, time zone, network operator, crash logs and diagnostic events.
• Usage data. We record the features you use in the App, screens visited, search terms, orders placed, items viewed, session duration, referral source and interactions with our Website and marketing communications.
• Optional location data. If you enable location services, we may collect your approximate location to support regional inventory, delivery estimates and compliance checks. Location data is optional and is not required to use the App.
• Advertising identifiers. We and our advertising partners may collect device advertising identifiers such as the Apple Advertising Identifier (IDFA) and the Android Advertising ID (AAID), together with advertising preference signals described in Section 15.
• Communications. We keep records of emails, support tickets, enquiry forms, telephone notes and messages sent to us, together with any attachments you provide.
• Business information consultation records. Where you request market reports or consultation deliverables, we record the topics requested, the reports licensed to you and your internal distribution list.

3. How We Use Your Data

We use personal information to:

• Provide, operate, maintain and personalise the App and the Website.
• Process orders, quotations, invoices, shipments, customs documentation and returns.
• Manage wholesale and retail distribution, stock levels and supply chain visibility.
• Provide business information consultation reports and related services.
• Deliver product design collaboration, approvals and sample reviews.
• Communicate with you about products, orders, shipments, support requests and, where permitted, marketing news.
• Protect the security, integrity and availability of our systems, and prevent fraud and abuse.
• Comply with legal, tax, customs, sanctions and regulatory obligations.
• Measure and improve our services, including through aggregated analytics.
• Personalise advertising and measure its effectiveness, subject to your consent where required.

4. Legal Bases for Processing

Where a law requires a lawful basis, we rely on the following. If you are in the European Economic Area, the United Kingdom, Switzerland or another jurisdiction with equivalent requirements, the closest applicable basis is indicated.

5. Sharing and Processors

We do not sell personal information for money. We share personal information only with the categories of recipients below, and only to the extent needed to provide the services you use:

• Service providers and processors — hosting and cloud infrastructure, payment processing, customer support, email delivery, analytics, crash reporting and App distribution partners acting on our instructions under written data processing terms.
• Advertising partners — advertising networks listed in Section 9, subject to your consent and opt-out choices.
• Trade and logistics partners — freight forwarders, customs brokers, inspection agencies and payment providers, to the extent required to complete an order or shipment you requested.
• Professional advisers and auditors — legal, tax, accounting and compliance advisers bound by confidentiality duties.
• Authorities — where disclosure is required by law, court order, or customs, tax, sanctions or regulatory obligations.
• Corporate transactions — in connection with a merger, acquisition or asset sale, subject to appropriate safeguards and continued notice to you.

6. International Transfers

MiniCity is based in Hong Kong and our App is hosted and supported through infrastructure that may be located outside Hong Kong and your country of residence. Where personal information is transferred internationally, we rely on an appropriate transfer mechanism, which may include standard contractual clauses, an adequacy decision, or another legally recognised safeguard.

You may request a copy of the safeguards we apply by writing to support@manchengcw.com.

7. Retention Periods

We keep personal information only for as long as necessary for the purposes described in this Policy, including:

• Account and order records — for the duration of the business relationship and the period required by tax, customs and accounting law.
• Enquiry and support records — typically for 24 months after the last interaction.
• Consultation and design records — for the life of the project plus the statutory retention period.
• App telemetry and crash logs — typically up to 24 months, aggregated thereafter.
• Advertising identifiers — in line with the retention periods set by the relevant advertising platform, and reset or deleted on request or on the withdrawal of consent.
• Marketing records — until you unsubscribe or withdraw consent, plus a suppression record to honour that choice.

When information is no longer required, we delete or anonymise it.

8. Security

We apply technical and organisational measures appropriate to the risk, including transport encryption, encryption of sensitive records at rest, role-based access controls, multi-factor authentication for administrative access, logging and monitoring, regular patching, vulnerability assessment, business continuity planning, and periodic testing of our controls.

No system is completely secure. If we become aware of a personal information breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within the timeframe required by applicable law and notify affected users where required.

9. Advertising and Monetisation

Our Website and the MiniCity Management App are supported by advertising. The App integrates third-party advertising software development kits (SDKs) and mediation platforms that may display ads, measure their performance and, where you have consented, personalise them using information such as your device type, operating system, app usage, approximate location and advertising identifiers.

The advertising platforms listed below are integrated with our App and Website. Each platform is subject to its own privacy policy and, where applicable, its own consent and opt-out mechanism. Links are provided for convenience; the current, maintained version of this table is published on our Website.

Personalised and non-personalised advertising

Where you have consented, we and our partners may serve personalised advertising based on your browsing or app activity, inferred interests and device identifiers. Where consent is not given, we limit advertising to contextual or non-personalised formats, restrict data sharing, and rely on device-level signals such as the Limit Ad Tracking setting on iOS and the "Reset advertising ID" or "Delete advertising ID" option on Android.

GDPR and CCPA consent

In the EEA, the UK, Brazil and other markets with a consent requirement, we present a consent management platform before non-essential cookies or personalised advertising SDKs are loaded. You may withdraw consent at any time through the in-app privacy settings or the Website cookie manager, and we honour the Global Privacy Control signal as described in Section 15.

Apple ATT and AAID / IDFA

On iOS we request the App Tracking Transparency (ATT) authorisation where required, and we do not access the IDFA before you grant it. On Android we read the AAID only where permitted, and we respect the advertising ID reset and deletion controls on your device. If you decline the ATT prompt or disable advertising identifiers, we continue to serve contextual advertising.

10. Advertising Formats and Your Controls

Our App and Website may present the following advertising formats:

• App open ads — displayed when the App is launched. They are skippable and do not obstruct the first interaction.
• Rewarded video ads — offered in exchange for a clearly stated benefit, such as extra catalogue access or a discount. Rewarded video is always initiated by your choice.
• Interstitial ads — displayed at natural break points, such as between content views. They are skipped automatically where the format allows it.
• Banner ads — displayed as a fixed strip within a page or screen, clearly marked as advertising.

You control the experience. You may close or skip an ad where the format permits, disable personalised advertising in your device or app settings, adjust your consent choices at any time, and use paid subscription options where we offer them to remove advertising. We do not present advertising in a manner designed to deceive, and we do not interfere with your ability to close or skip an ad.

11. Cookies and Similar Technologies

The Website uses cookies, local storage and similar technologies. Strictly necessary cookies keep the site functioning and remember choices such as your consent state. Analytics cookies help us understand aggregate usage. Advertising cookies are used to measure campaigns and, with consent, to personalise advertising.

You can manage cookies through your browser settings, and most browsers offer a per-site blocking option. Blocking strictly necessary cookies may affect how the Website behaves for you. We respond to legally recognised opt-out preference signals where they are supported.

12. Your Rights by Region

Depending on where you live, you may hold some or all of the rights below. To exercise any of them, email support@manchengcw.com. We will verify your request, and we respond within the period required by the applicable law — generally within 30 days, or 45 days where the request is complex.

13. Children and Age Policy

Our services are intended for businesses and adults. The MiniCity Management App is not directed to children, and we do not knowingly collect personal information from children under 13 years of age (or under 16 where local law requires a higher threshold). We do not knowingly collect personal information from children under 16 without verifiable parental consent, and in the EEA we rely on consent from the holder of parental responsibility where the processing is based on consent.

Our Website and App are not directed to children under 13 and comply with the Children's Online Privacy Protection Act (COPPA). Our App store listings carry the appropriate age ratings, and we configure our advertising SDKs in line with family-designated and child-directed restrictions where required, including the certified child-directed behaviour of Google Play's Families policy and Apple's Kids Category requirements.

14. App Store Compliance

The MiniCity Management App is distributed through the Apple App Store and Google Play, and we comply with the policies that govern those platforms:

• Apple App Store Review Guidelines — including privacy, data collection and disclosure, and the requirement that apps collect only data that is relevant to their stated functionality.
• Apple Privacy Nutrition Labels — the data types declared in our App Store listing match the actual data practices described in this Policy.
• Google Play Data Safety section — our declaration matches the data types we collect and share, including advertising identifiers and location data collected with consent.
• Google Play Families policy — child-directed behaviour, appropriate advertising treatment, and restrictions on identifiers for child users.
• Account deletion — where the App supports account creation, users can request deletion of their account and associated data by writing to support@manchengcw.com.

15. Do Not Track and Global Privacy Control

Some browsers and mobile operating systems send a "Do Not Track" (DNT) or "Global Privacy Control" (GPC) signal. Because there is still no uniform industry standard for these signals, their effect varies. Where a signal is recognised as a legally valid opt-out in your jurisdiction, we act on it — in particular, we treat a valid GPC signal as a request to opt out of the sale or sharing of personal information and to limit personalised advertising. We do not track visitors across third-party websites for our own purposes in a way that would conflict with a recognised opt-out signal.

16. Changes to This Policy

We may update this Policy from time to time, for example to reflect changes in our products, the law, or how we use information. The revised version is published on this page with an updated effective date. Where a change is material, we will provide notice in the App, by email, or through an in-app notice before the change takes effect. You can request the previous version by emailing support@manchengcw.com.

17. Contact Us

If you have any questions about this Policy, or wish to make a request, please contact us:

• Business support and privacy requests: support@manchengcw.com
• Key accounts: chengxing@manchengcw.com
• Company: MiniCity (Hongkong) Co., Limited
• Office: E8 ROOM 1207, 12/F, BLOCK 2, GOLDEN IND BLDG, 16-26 KWAI TAK ST, KWAI CHUNG, HONG KONG
• Website: manchengcw.com

18. Effective Date

This Privacy Policy is effective from October 9, 2026 and applies to all processing carried out by MiniCity (Hongkong) Co., Limited from that date. The most current version is always available at manchengcw.com/privacy.html.