Privacy policy

Last updated: July 24, 2026

This Privacy Policy explains how NORLUA LIMITED (“NORLUA,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes personal information when you visit norlua.com, purchase a product, communicate with us, or otherwise use our services (collectively, the “Services”).

1. Who controls your information

NORLUA LIMITED is the business responsible for the personal information described in this policy. Our store is hosted by Shopify, which provides the ecommerce platform that enables us to offer the Services.

2. Personal information we collect

Depending on how you interact with the Services, we may collect the following categories of personal information:

· Contact and identification information, such as your name, billing address, shipping address, email address, and telephone number.

· Order and transaction information, such as products viewed or purchased, order number, payment status, delivery details, returns, refunds, and customer service history.

· Payment-related information. Payment providers process payment card or account information. NORLUA generally does not receive or store your full payment card number.

· Account information, if customer accounts are offered, such as login details, account preferences, and saved information.

· Communications and content you provide, such as messages, reviews, survey responses, photographs, and return or support materials.

· Device and online activity information, such as Internet Protocol address, browser, device identifiers, operating system, referral page, pages viewed, clicks, session activity, approximate location derived from network information, and cookie or pixel identifiers.

· Marketing preferences and information about how you interact with our emails or advertisements.

· Fraud-prevention, security, and risk signals, as well as inferences used to understand likely interests or improve the Services.

3. Sources of personal information

We collect personal information directly from you; automatically through the Services; from Shopify and other service providers that support payments, fulfillment, analytics, security, customer support, or marketing; and from advertising or social media partners where permitted by law.

4. How we use personal information

We may use personal information to:

· Provide and operate the Services, process payments and orders, arrange delivery, manage returns or refunds, and provide customer support.

· Create and manage customer accounts and remember preferences.

· Communicate with you about orders, the Services, policy changes, and support requests.

· Detect, investigate, and prevent fraud, misuse, security incidents, and other harmful or unlawful activity.

· Measure site performance, understand customer use, improve products and content, and conduct analytics.

· Send marketing communications where you have consented or where otherwise permitted, and measure or personalize advertising.

· Comply with legal, tax, accounting, regulatory, and contractual obligations; establish or defend legal claims; and enforce our terms.

· Carry out another purpose disclosed to you when the information is collected or with your consent.

5. Cookies, pixels, and similar technologies

We and our partners may use cookies, software development kits, pixels, tags, local storage, and similar technologies to keep the store working, remember choices, understand use, prevent fraud, measure performance, and support advertising. A cookie is a small data file stored by your browser or device.

Where required, non-essential technologies will be used according to your consent or privacy choices. You can use the cookie banner or customer privacy controls displayed on the site and can also adjust browser settings. Blocking some technologies may affect site functions.

6. How we disclose personal information

We may disclose personal information to the following categories of recipients for the purposes described in this policy:

· Shopify and ecommerce infrastructure providers.

· Payment processors, fraud-prevention providers, banks, and financial institutions.

· Warehouses, fulfillment partners, carriers, customs agents, and other logistics providers.

· Cloud hosting, information technology, security, customer service, email, survey, and business operations providers.

· Analytics, advertising, and social media partners, which may include Google, Meta, and TikTok when those services are enabled.

· Professional advisers, auditors, insurers, regulators, law enforcement, courts, or other parties when reasonably necessary to comply with law, protect rights, or respond to valid process.

· A buyer, investor, successor, or other relevant party in connection with a proposed or completed financing, merger, reorganization, sale, or transfer of all or part of our business.

· Other parties at your direction or with your consent.

7. Targeted advertising; sale or sharing under certain laws

NORLUA does not sell personal information for money. However, when advertising or analytics services are enabled, we may disclose identifiers, device information, and online activity to advertising partners so they can measure campaigns or show ads based on activity across different businesses, websites, or applications.

Some U.S. state privacy laws may define those activities as a “sale,” “sharing,” or processing for “targeted advertising,” even when no money is exchanged. Where applicable, you may opt out through the “Your Privacy Choices” or “Do Not Sell or Share My Personal Information” control displayed on our site, by sending a request to care@norlua.com, or through a legally recognized browser-based opt-out preference signal, such as Global Privacy Control.

8. Marketing communications

You can unsubscribe from marketing emails at any time by using the unsubscribe link in the message or by contacting us. Opting out of marketing will not stop transactional or service messages, such as order confirmations, delivery updates, or responses to your requests.

9. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including to provide the Services, maintain business and transaction records, comply with legal or tax obligations, resolve disputes, prevent fraud, and enforce agreements. Retention periods vary according to the type of information and applicable requirements.

10. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No transmission or storage system can be guaranteed completely secure, so please do not send sensitive information through an unsecured channel.

11. International processing

NORLUA is based in Hong Kong and uses service providers that may process information in the United States and other countries. Those countries may have data protection laws different from the laws where you live. Where required, we use appropriate measures for international transfers.

12. Your privacy rights

Depending on where you live and subject to legal exceptions, you may have rights to request access to personal information; correction; deletion; a portable copy; restriction of or objection to certain processing; withdrawal of consent; or an appeal of a decision. You may also have the right to opt out of sale, sharing, or targeted advertising and to receive equal service and pricing after exercising a privacy right.

To submit a request, use the customer privacy control displayed on our site or email care@norlua.com with the subject line “Privacy Request.” We may need to verify your identity and authority before completing a request. An authorized agent may submit a request where permitted by law, but we may require proof of authorization.

If we are subject to the California Consumer Privacy Act for the relevant period, California residents may also request the categories or specific pieces of personal information collected, the sources and purposes, and the categories of third parties to which information was disclosed, sold, or shared. Rights apply only to the extent required by applicable law.

13. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so that we can review and delete it where appropriate.

14. Third-party sites and services

The Services may link to websites or services operated by others. Their privacy practices are governed by their own policies, and NORLUA is not responsible for those practices.

15. Changes to this policy

We may update this Privacy Policy to reflect changes in the Services, technology, business practices, or law. We will post the updated version with a revised “Last updated” date and provide additional notice where required.

16. Contact us

For privacy questions or requests, contact our Privacy Lead at care@norlua.com or write to: NORLUA LIMITED, Portion 1 of Unit No. 721A, 7/F, Star House, Tsim Sha Tsui, Kowloon, Hong Kong SAR.