Privacy Notice

Last updated: 17 July 2026

1. Identity of the Data Controller

This Privacy Notice describes how Golden Amulets Co. Ltd, operating through goldenamulets.com and, where applicable, trading under the name “RFX” (“Golden Amulets,” “Company,” “we,” “usour), collects, receives, records, uses, discloses, stores, transfers, and otherwise processes personal information.

Unless another organisation is expressly identified as the controller of particular information, Golden Amulets is the controller responsible for personal information processed in connection with:

• our website and online store;
• customer accounts;
• product enquiries and purchases;
• payments, refunds, returns, and exchanges;
• shipping, customs, and order fulfilment;
• customer support communications;
• marketing communications;
• fraud prevention and transaction security;
• website analytics; and
• other interactions with Golden Amulets.

Our contact information is provided in section 20 of this Notice.

2. Scope of This Notice

This Notice applies when you:

• visit, browse, or otherwise interact with our website;
• create or use a customer account;
• place, attempt to place, amend, cancel, or dispute an order;
• make or attempt to make a payment;
• request a refund, return, exchange, replacement, or chargeback;
• contact our customer service team;
• subscribe to marketing communications;
• participate in a survey, promotion, competition, or other activity operated by us; or
• otherwise provide personal information to Golden Amulets.

This Notice does not govern the independent processing activities of third parties whose websites, platforms, payment services, applications, or services you use. Those organisations may act as independent controllers and process personal information under their own privacy notices.

This Notice is intended to explain our processing activities and does not create contractual rights beyond those provided under applicable law. Nothing in this Notice limits any right that cannot lawfully be excluded or restricted.

3. Summary of Our Processing Activities

• We collect information that you provide when placing an order, creating an account, contacting us, or requesting customer support.
• We collect transaction and payment-related information from payment providers such as Stripe, PayPal, and, where applicable, Wise.
• We collect delivery and fulfilment information from postal operators, couriers, warehouses, suppliers, and logistics providers.
• We automatically collect certain technical, device, security, and website-usage information.
• We may use Google Analytics and other cookies or similar technologies, subject to applicable consent requirements.
• We use personal information to operate the store, complete transactions, deliver products, prevent fraud, resolve disputes, communicate with customers, improve our services, and comply with legal obligations.
• We disclose information to service providers and other recipients where reasonably necessary to operate our business, perform our obligations, protect our interests, or comply with law.
• We do not ordinarily receive or retain complete payment-card numbers or card security codes where payment is completed through a third-party payment processor.
• We do not knowingly sell personal information in exchange for monetary payment. Certain advertising or analytics disclosures may nevertheless be characterised as “selling,” “sharing,” or targeted advertising under particular privacy laws.
• Privacy rights are not absolute. We may retain or continue processing information where permitted or required for tax, accounting, fraud prevention, security, dispute resolution, legal compliance, or the establishment, exercise, or defence of legal claims.

4. Categories of Personal Information We Collect

4.1 Identity and contact information

We may collect:

• first and last name;
• account username;
• email address;
• telephone number;
• billing address;
• delivery address;
• country, region, state, province, city, and postal code; and
• other contact information you choose to provide.

4.2 Account information

Where customer accounts are available, we may collect:

• account identifier;
• login and authentication information;
• account preferences;
• saved addresses;
• order history;
• wish-list or saved-product information;
• marketing preferences; and
• information concerning account restrictions, verification, security, or closure.

Passwords should be stored in a protected or cryptographically secured form. We do not ask customers to disclose their account password to customer-service personnel.

4.3 Order and transaction information

We may collect:

• order and invoice numbers;
• products viewed, selected, ordered, returned, or exchanged;
• product variations, quantities, and prices;
• discounts, vouchers, or promotional codes;
• transaction currency;
• payment status;
• payment-provider transaction identifiers;
• tax information;
• billing and delivery information;
• refund, return, dispute, and chargeback information;
• communications concerning an order;
• evidence submitted in support of a claim; and
• records concerning suspected fraud, misuse, or breach of our terms.

4.4 Payment information

Payments may be processed by third-party payment and financial-service providers, including:

• Stripe;
• PayPal; and
• Wise, where Wise is used in connection with a payment, transfer, currency conversion, settlement, reimbursement, or refund.

Depending on the selected payment method and technical integration, payment information may be submitted directly to the relevant payment provider rather than being entered into systems controlled by Golden Amulets.

We may nevertheless receive or retain limited payment and transaction information, including:

• payment-provider name;
• transaction identifier;
• payment amount and currency;
• payment status;
• card type or brand;
• the last digits of a payment card;
• payment account email address;
• billing address;
• fraud or risk indicators;
• refund and dispute information; and
• other information supplied by the payment provider.

Golden Amulets does not ordinarily receive or store the complete payment-card number or card verification value where those details are processed through the payment provider’s hosted or embedded payment interface.

Payment providers may process your information for their own fraud-prevention, regulatory, identity-verification, sanctions-screening, compliance, risk-management, and service-development purposes. Their independent processing is governed by their respective privacy notices:

• Stripe Privacy Policy
• PayPal Privacy Statement
• Wise Privacy Notice

4.5 Delivery and fulfilment information

We may collect or receive:

• delivery address and recipient information;
• tracking numbers;
• shipping and delivery status;
• delivery-attempt records;
• proof of delivery;
• recipient signatures, where used;
• carrier communications;
• customs and import information;
• information concerning refused, failed, delayed, damaged, or missing deliveries; and
• information concerning returned parcels.

4.6 Communications and customer-service information

We may collect communications sent through email, contact forms, telephone, social media, payment-platform dispute systems, or other support channels.

This may include:

• the content and metadata of communications;
• complaints and enquiries;
• documents, photographs, and videos;
• product-condition evidence;
• identity-verification information;
• returns and refund documentation;
• records of resolutions offered or accepted; and
• internal notes reasonably necessary to administer or defend a claim.

We may preserve communications where reasonably necessary to maintain an accurate transaction history, prevent inconsistent claims, establish compliance with our obligations, resolve disputes, or defend legal rights.

4.7 Technical, device, and usage information

When you visit or use our website, we or our service providers may automatically collect:

• Internet Protocol address;
• browser type and version;
• device type;
• operating system;
• language and regional settings;
• screen or display information;
• referring and exit pages;
• pages and products viewed;
• links or buttons selected;
• search activity on the website;
• shopping-cart activity;
• checkout events;
• date, time, and duration of visits;
• approximate geographic location derived from network information;
• cookie, device, session, and advertising identifiers;
• error, diagnostic, and performance information;
• security events and attempted misuse; and
• other information generated through interaction with the website.

We do not ordinarily request precise GPS location through the website unless a particular feature expressly requires it and an appropriate notice or permission is provided.

4.8 Marketing and preference information

We may collect:

• email-subscription status;
• marketing consent or objection records;
• communication preferences;
• responses to promotions or surveys;
• email delivery, opening, and interaction information, where permitted;
• product interests; and
• information used to determine whether a communication may be relevant to you.

4.9 Fraud, security, and compliance information

We may collect, generate, or receive information reasonably necessary to:

• verify a transaction;
• identify suspicious ordering activity;
• detect account compromise;
• prevent payment fraud;
• investigate false non-delivery, return, or refund claims;
• respond to chargebacks;
• enforce purchasing limitations;
• screen transactions against sanctions or legal restrictions;
• protect customers, the Company, payment providers, and carriers; and
• establish, exercise, or defend legal claims.

This information may include device, network, payment, transaction, identity, address, behavioural, fulfilment, communication, and prior-dispute information.

4.10 Sensitive information

Golden Amulets does not intentionally request sensitive personal information unless it is reasonably necessary for a specific transaction, legal obligation, fraud investigation, dispute, accessibility request, or other legitimate purpose permitted by law.

You should not provide medical information, government identification documents, biometric information, passwords, complete payment-card details, or other highly sensitive information unless we or an authorised service provider specifically requests that information through an appropriate and secure process.

A payment or identity-verification provider may independently request identity documents or other regulated information. That provider’s collection and use are subject to its own privacy documentation.

5. Sources of Personal Information

We may obtain personal information from:

• you directly, including through checkout, account registration, email, forms, or customer-service communications;
• your device or browser, through server logs, cookies, pixels, tags, scripts, software development kits, and similar technologies;
• payment providers, including Stripe, PayPal, and Wise;
• postal operators, couriers, warehouses, suppliers, and logistics providers;
• fraud-prevention, security, address-validation, identity-verification, and risk-management providers;
• analytics, advertising, and marketing providers, including Google Analytics where enabled;
• social networks or third-party platforms, where you communicate with us or interact with our content through such a platform;
• professional advisers, public authorities, courts, regulators, or law-enforcement bodies;
• publicly available sources, where reasonably necessary to verify a claim, address fraud, locate a returned parcel, or comply with law; and
• other parties involved in a transaction, including a purchaser, recipient, authorised representative, or account holder.

6. Purposes for Which We Process Personal Information

We may process personal information for the following purposes.

6.1 Operating the website and customer accounts

• providing website functionality;
• creating and maintaining accounts;
• authenticating account access;
• saving customer preferences;
• maintaining shopping carts;
• providing requested content; and
• diagnosing technical errors.

6.2 Processing and fulfilling orders

• confirming product availability;
• processing orders and payments;
• issuing invoices and receipts;
• arranging fulfilment and delivery;
• providing tracking information;
• communicating about an order;
• processing customs information;
• administering returns, refunds, replacements, and exchanges; and
• maintaining transaction records.

6.3 Customer service and dispute administration

• responding to questions or complaints;
• investigating alleged defects, damage, non-delivery, or incorrect fulfilment;
• evaluating refund or return eligibility;
• reviewing evidence and transaction records;
• communicating with payment providers and carriers;
• responding to payment disputes or chargebacks;
• maintaining consistent records of prior communications; and
• establishing, exercising, or defending legal rights.

6.4 Security, fraud prevention, and protection of the Company

• detecting unauthorised transactions;
• preventing account abuse;
• identifying suspicious ordering patterns;
• investigating suspected return substitution or refund abuse;
• maintaining website and network security;
• protecting our customers, personnel, suppliers, and service providers;
• enforcing our contractual terms and policies; and
• cooperating with payment providers, banks, insurers, carriers, regulators, or authorities.

6.5 Analytics and business improvement

• measuring website traffic and use;
• understanding how visitors locate and interact with the website;
• evaluating product and page performance;
• identifying technical or usability issues;
• improving website functionality;
• conducting internal reporting and forecasting;
• measuring marketing effectiveness; and
• developing or improving products, services, and business operations.

6.6 Marketing

Subject to applicable law, we may process contact and preference information to:

• send information concerning products, offers, promotions, or services;
• send abandoned-cart reminders;
• manage marketing subscriptions;
• measure engagement with communications;
• avoid sending communications to persons who have objected or unsubscribed; and
• personalise marketing where permitted.

You may unsubscribe from electronic marketing by selecting the unsubscribe option contained in the relevant communication or by contacting us.

Unsubscribing from marketing does not prevent us from sending transactional, security, legal, order, account, or customer-service communications.

6.7 Legal and regulatory purposes

• maintaining tax, accounting, customs, and transaction records;
• responding to lawful requests, warrants, subpoenas, court orders, or regulatory enquiries;
• complying with consumer, payment, sanctions, anti-fraud, data-protection, and other laws;
• protecting or enforcing legal rights;
• responding to privacy-rights requests;
• maintaining evidence concerning consent, objections, and policy acceptance; and
• reporting suspected unlawful conduct where appropriate.

7. Legal Bases for Processing

Where the UK GDPR, European Economic Area GDPR, or another law requiring a legal basis applies, we may rely on one or more of the following grounds.

7.1 Performance of a contract

We process information where necessary to:

• take steps requested before entering into a contract;
• process and fulfil an order;
• administer payment, delivery, returns, refunds, or exchanges;
• maintain a customer account; or
• otherwise perform our obligations arising from a transaction.

7.2 Legitimate interests

We may process information where reasonably necessary for our legitimate interests or those of another party, provided that such interests are not overridden by applicable individual rights.

Our legitimate interests may include:

• operating and improving our ecommerce business;
• providing customer service;
• maintaining complete and accurate transaction records;
• preventing fraud, abuse, theft, or security incidents;
• protecting our financial and commercial interests;
• evaluating the effectiveness of our website and services;
• recovering debts or losses;
• responding to disputes and chargebacks;
• enforcing contractual terms;
• conducting internal administration and reporting;
• protecting legal rights; and
• communicating with existing customers where permitted.

7.3 Consent

We may rely on consent where required, including for certain:

• non-essential cookies;
• analytics technologies;
• advertising technologies;
• electronic marketing communications; or
• other optional processing activities.

Where processing is based on consent, you may withdraw that consent. Withdrawal does not affect processing already lawfully undertaken before withdrawal and does not prevent processing based on another lawful ground.

7.4 Legal obligation

We may process information where necessary to comply with an applicable legal, tax, accounting, consumer-protection, regulatory, judicial, or law-enforcement obligation.

7.5 Legal claims

We may process information where reasonably necessary to establish, exercise, pursue, respond to, settle, or defend a legal claim, dispute, chargeback, investigation, or regulatory proceeding.

7.6 Vital interests and public-interest grounds

In exceptional circumstances, we may process information where necessary to protect a person’s vital interests or perform a task recognised by applicable law as being in the public interest.

8. Disclosure of Personal Information

We may disclose personal information where reasonably necessary for the purposes described in this Notice.

8.1 Payment and financial-service providers

We may disclose information to Stripe, PayPal, Wise, banks, card networks, acquiring institutions, issuing institutions, and other parties involved in processing or administering a transaction.

8.2 Ecommerce, website, hosting, and infrastructure providers

We may disclose information to service providers supporting:

• website hosting;
• domain and content delivery;
• ecommerce functionality;
• database and cloud storage;
• account administration;
• cybersecurity;
• backup and disaster recovery;
• website maintenance; and
• technical support.

8.3 Fulfilment and delivery providers

We may disclose relevant customer and order information to:

• manufacturers;
• suppliers;
• warehouses;
• fulfilment centres;
• postal operators;
• couriers;
• customs agents;
• delivery partners; and
• returns-processing facilities.

These recipients may receive the customer’s name, delivery address, contact information, product information, and other data reasonably required to fulfil, deliver, trace, return, or investigate an order.

8.4 Analytics, marketing, and communications providers

We may disclose or permit collection of information by providers supporting:

• website analytics;
• email delivery;
• marketing communications;
• advertising measurement;
• customer relationship management;
• survey or feedback collection;
• cookie-consent management; and
• social-media communications.

8.5 Fraud-prevention and security providers

We may disclose information to providers assisting with:

• fraud scoring;
• payment risk assessment;
• identity verification;
• address verification;
• sanctions screening;
• account protection;
• bot detection;
• website security; and
• investigation of suspicious transactions or claims.

8.6 Professional advisers and insurers

We may disclose information to accountants, auditors, insurers, banks, lawyers, consultants, debt-recovery providers, tax advisers, and other professional advisers where reasonably necessary for their services or the protection of our interests.

8.7 Authorities and legal recipients

We may disclose information to a court, regulator, tax authority, customs authority, law-enforcement agency, government body, payment network, or other authorised recipient where:

• required or permitted by law;
• necessary to respond to lawful process;
• reasonably necessary to prevent or investigate suspected unlawful conduct;
• required to protect a person’s safety;
• necessary to protect our rights, property, or business; or
• necessary to establish, exercise, or defend a legal claim.

8.8 Business transactions

We may disclose or transfer personal information in connection with an actual or proposed:

• merger;
• acquisition;
• investment;
• financing;
• reorganisation;
• insolvency;
• sale of assets;
• transfer of a website, product line, or business; or
• other corporate transaction.

Information may be disclosed to prospective purchasers, investors, advisers, financiers, and their representatives subject to appropriate confidentiality or legal restrictions where applicable.

8.9 Other disclosures

We may disclose information:

• at your direction;
• with your consent;
• to an authorised representative;
• to another person involved in the transaction; or
• where otherwise permitted under applicable law.

We may add, replace, or cease using service providers as our operations evolve. This Notice identifies material categories of recipients and certain key providers but is not intended to constitute an immutable or exhaustive supplier register.

9. Cookies and Similar Technologies

Our website may use cookies, pixels, local storage, tags, scripts, and comparable technologies to store or access information on a browser or device.

9.1 Strictly necessary technologies

These technologies may be used to:

• operate the shopping cart and checkout;
• maintain a session;
• authenticate an account;
• remember privacy choices;
• prevent fraud;
• protect website security;
• balance network traffic; and
• provide functionality specifically requested by the user.

Where legally permitted, strictly necessary technologies may operate without optional consent because the website or requested service cannot function properly without them.

9.2 Functional technologies

Functional technologies may remember preferences such as language, region, previously selected settings, or other optional website features.

9.3 Analytics technologies

Analytics technologies help us understand website performance and visitor interaction, including:

• number of visitors;
• traffic sources;
• pages and products viewed;
• navigation paths;
• device and browser information;
• approximate geographic region;
• checkout and purchase events;
• errors and performance issues; and
• aggregated or statistical usage patterns.

9.4 Advertising and marketing technologies

Where used, advertising technologies may help:

• measure advertisements;
• limit repeated advertising;
• attribute visits or purchases to campaigns;
• create or measure audiences;
• display advertising believed to be more relevant; or
• send abandoned-cart or product reminders, where permitted.

9.5 Cookie choices

Where applicable law requires consent, we will seek an appropriate choice before using non-essential cookies or similar technologies.

You may be able to manage optional technologies through:

• our cookie banner or cookie-settings tool;
• browser settings;
• device privacy settings;
• advertising-platform controls; or
• other opt-out mechanisms made available by the relevant provider.

Blocking or deleting cookies may affect the availability, reliability, or operation of certain website features.

10. Google Analytics

We may use Google Analytics to measure and analyse use of the website. Google Analytics may collect information through cookies and similar technologies, including device, browser, interaction, session, referral, approximate-location, and website-event information.

Google may process Analytics information in accordance with its own terms, data-processing provisions, and privacy documentation.

You can review Google’s privacy information at:

Google Privacy Policy

Google also provides a browser add-on intended to prevent website activity from being made available to Google Analytics:

Google Analytics Opt-out Browser Add-on

Depending on our Google Analytics configuration, we may:

• restrict advertising personalisation;
• restrict collection by geographic region;
• configure user-level and event-level retention periods;
• use consent-related controls;
• delete certain user-level information where technically available; and
• disable particular Analytics features.

Our use of Google Analytics does not mean that Golden Amulets has access to every item of information Google may possess concerning a visitor.

11. Sale, Sharing, and Targeted Advertising

Golden Amulets does not ordinarily sell personal information to third parties in exchange for monetary payment.

However, privacy laws in certain United States jurisdictions use broad definitions of “sale,” “sharing,” targeted advertising, or cross-context behavioural advertising. Under those definitions, the use of some analytics, advertising, social-media, or marketing technologies may be treated as a regulated disclosure even where no money is paid for the information.

Where such laws apply to Golden Amulets, eligible residents may have the right to opt out of:

• the sale of personal information;
• the sharing of personal information for cross-context behavioural advertising;
• targeted advertising; or
• certain profiling activities producing legal or similarly significant effects.

Where legally required and technically applicable, we will treat recognised browser-based opt-out preference signals, including Global Privacy Control signals, as an opt-out request for the browser or device from which the signal is received.

An opt-out signal may not identify you across different browsers, devices, accounts, or offline interactions. You may therefore need to repeat your choice on each browser or device.

12. Automated Processing and Fraud Decisions

We and our payment, fraud-prevention, security, or ecommerce providers may use automated systems to assess:

• transaction risk;
• payment validity;
• address consistency;
• device or network risk;
• suspected account compromise;
• unusual ordering behaviour;
• possible sanctions or compliance concerns;
• return or refund abuse; and
• other indicators of fraud or misuse.

These systems may result in:

• a payment being declined;
• an order being held for manual review;
• a request for additional information;
• an account or transaction being restricted;
• an order being cancelled;
• a refund being delayed while an investigation is completed; or
• information being referred to a payment provider or competent authority.

Where applicable law grants a right concerning a decision based solely on automated processing that produces legal or similarly significant effects, you may contact us to request information or review. That right remains subject to applicable exceptions and may need to be directed to the relevant payment or fraud provider where that organisation made the decision independently.

13. International Transfers

Golden Amulets operates an international ecommerce business and may use service providers, payment providers, carriers, suppliers, infrastructure, or personnel located outside the country in which a customer resides.

Personal information may therefore be accessed, stored, or processed in the United Kingdom, European Economic Area, United States, Canada, Australia, or other countries in which we or our service providers operate.

Data-protection laws and government-access rules in those countries may differ from those in your jurisdiction.

Where applicable law requires a transfer safeguard, we may rely on one or more of the following:

• an adequacy regulation or adequacy decision;
• approved standard contractual clauses;
• the United Kingdom International Data Transfer Agreement;
• the United Kingdom Addendum to approved contractual clauses;
• a recognised data-transfer framework;
• binding corporate rules;
• contractual and organisational safeguards;
• your explicit consent, where legally valid; or
• another transfer mechanism or derogation recognised by applicable law.

Payment providers and other independent controllers may separately determine the countries and safeguards involved in their processing.

14. Retention of Personal Information

We retain personal information for no longer than is reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting, tax, fraud-prevention, security, operational, reporting, dispute-resolution, and claims-related requirements.

Retention periods may vary according to:

• the category and sensitivity of the information;
• the nature of the transaction;
• whether an account remains active;
• the risk of fraud or misuse;
• applicable limitation periods;
• tax and accounting obligations;
• payment-provider or carrier requirements;
• whether a complaint, return, dispute, chargeback, investigation, or legal proceeding is pending;
• our ability to delete information from backups; and
• applicable legal requirements.

Our ordinary retention approach may include:

• Order, payment, refund, tax, and accounting records: retained for the period required by applicable tax, accounting, contractual, and limitation rules, which may commonly extend for approximately six to seven years after the relevant transaction or the conclusion of a related dispute.
• Customer-account information: retained while the account remains active and for a reasonable period afterwards, subject to longer retention of transaction, fraud, or legal records.
• Customer-service and complaint records: retained for a reasonable period after the matter is resolved and longer where necessary for dispute prevention, consistency, claims, or legal compliance.
• Fraud, security, chargeback, and abuse-prevention records: retained for as long as reasonably necessary to prevent repeated misuse, protect payment systems, enforce restrictions, and defend claims.
• Marketing information: retained until consent is withdrawn, an objection is received, the information is no longer useful, or another retention requirement applies.
• Suppression records: limited information may be retained after an unsubscribe request so that we can respect the request and avoid restoring the address to an active marketing list.
• Analytics information: retained in accordance with our configured analytics settings, provider controls, business requirements, and applicable law. Aggregated or de-identified information may be retained for longer where it no longer identifies an individual.
• Website and security logs: retained for a period reasonably necessary to operate, secure, troubleshoot, and investigate the website.

When information is no longer required, we may delete, aggregate, de-identify, anonymise, or place it beyond ordinary operational use.

Deletion from active systems may not immediately remove information from encrypted backups, disaster-recovery systems, archived records, payment-provider systems, or systems controlled by independent third parties. Backup information may remain protected and unavailable for ordinary use until overwritten or deleted through the normal backup cycle.

15. Information Security

We use administrative, technical, contractual, and organisational measures that we consider appropriate to the nature of the information and the risks associated with processing.

Measures may include:

• access controls;
• password and authentication controls;
• encrypted transmission;
• payment-provider security measures;
• restricted administrative access;
• security logging and monitoring;
• backup procedures;
• malware, bot, and fraud controls;
• service-provider contractual protections; and
• internal policies concerning access and handling.

No website, payment system, communication method, transmission, database, or storage system can be guaranteed to be completely secure.

Accordingly, to the maximum extent permitted by law:

• we do not warrant that unauthorised access, loss, alteration, interception, or misuse will never occur;
• information transmitted to or from the website is transmitted at the user’s risk;
• customers are responsible for maintaining the confidentiality of account credentials;
• customers should use unique passwords and secure devices and networks; and
• customers must notify us promptly if they suspect unauthorised account use or a compromised transaction.

Where we become aware of a personal-data breach, we will assess and respond to it in accordance with applicable legal obligations.

16. Children and Minors

Our website and products are intended for adults and are not directed to children.

We do not knowingly solicit personal information from, market directly to, or establish customer accounts for persons under eighteen (18) years of age.

By placing an order or creating an account, you represent that:

• you are at least eighteen years old; or
• you are acting with the lawful authority and supervision of a parent or legal guardian where permitted.

If we reasonably believe that a minor has submitted personal information without appropriate authorisation, we may suspend the account, cancel the transaction, request verification, or delete the information, subject to any legal obligation requiring retention.

A parent or guardian who believes that a child has submitted personal information may contact us using the information in section 20.

17. Third-Party Websites and Services

Our website may contain links, embedded content, payment interfaces, social-media features, or other connections to third-party websites and services.

Golden Amulets does not control and is not responsible for the independent privacy, security, content, availability, or business practices of third parties.

The presence of a link or integration does not necessarily constitute:

• an endorsement of the third party;
• a representation concerning its security;
• an assumption of responsibility for its processing activities; or
• an agreement that its privacy practices are identical to ours.

You should review the privacy notices and terms of any third-party service before providing information to it.

18. Privacy Rights

Depending on where you live and whether the applicable law applies to Golden Amulets, you may have one or more of the following rights:

• the right to be informed about processing;
• the right to request access to personal information;
• the right to request correction of inaccurate or incomplete information;
• the right to request deletion or erasure;
• the right to request restriction of processing;
• the right to object to processing based on legitimate interests;
• the right to object to direct marketing;
• the right to withdraw consent;
• the right to receive certain information in a portable format;
• rights relating to certain automated decisions;
• the right to opt out of sale, sharing, targeted advertising, or qualifying profiling;
• the right to limit certain uses of sensitive personal information;
• the right to designate an authorised representative;
• the right to appeal certain privacy-request decisions; and
• the right to complain to an appropriate privacy or data-protection authority.

18.1 Rights are not absolute

A request may be limited, rejected, or only partially fulfilled where permitted by law, including where information is reasonably necessary to:

• complete or document a transaction;
• provide a requested product or service;
• maintain accounting, tax, customs, or legal records;
• detect or prevent fraud;
• protect website or payment security;
• identify repeated abuse;
• respond to a dispute or chargeback;
• exercise freedom-of-expression or other protected rights;
• comply with a legal obligation;
• establish, exercise, or defend legal claims;
• protect another person’s rights; or
• retain information that is exempt from the applicable request.

A deletion request does not automatically require us to delete:

• order and payment records;
• tax or accounting records;
• fraud-prevention records;
• records concerning returns, disputes, or chargebacks;
• suppression records required to respect an unsubscribe request;
• information needed to defend a claim; or
• information retained under another lawful exception.

18.2 Verification of requests

Before fulfilling a request, we may take reasonable steps to verify:

• the requester’s identity;
• the requester’s authority;
• the customer account or transaction concerned;
• the jurisdiction from which the request is made; and
• whether the requested right applies.

We may request information reasonably necessary for verification. We will use verification information for security, fraud prevention, request administration, and legal compliance.

We may decline to disclose information where we cannot reasonably verify the requester, where disclosure would adversely affect another person, or where the request is fraudulent, excessive, repetitive, manifestly unfounded, or otherwise exempt under applicable law.

18.3 Authorised representatives

Where applicable law permits an authorised representative to submit a request, we may require:

• evidence of the representative’s identity;
• written authority signed by the individual;
• direct confirmation from the individual; or
• other evidence reasonably required by law.

18.4 Marketing objections

You may object to electronic marketing by:

• selecting the unsubscribe link in a marketing email; or
• contacting us at [email protected].

We may retain a minimal suppression record after the objection to ensure that the address is not inadvertently restored to active marketing lists.

19. Regional Privacy Information

19.1 United Kingdom and European Economic Area

Eligible individuals may have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and protection concerning qualifying automated decisions.

United Kingdom residents may have the right to complain to the Information Commissioner’s Office. European Economic Area residents may have the right to complain to the competent supervisory authority in their country of residence, employment, or the alleged infringement.

We encourage you to contact us first so that we have an opportunity to investigate and respond.

19.2 Canada

Eligible Canadian residents may have rights to access and correct personal information, withdraw consent where processing depends on consent, and challenge compliance with applicable privacy obligations.

Withdrawal of consent may not apply retroactively and may affect our ability to provide products, process transactions, maintain an account, or perform requested services.

19.3 Australia and New Zealand

Eligible residents may have rights to request access to or correction of personal information and to submit a privacy complaint.

We may require information necessary to verify the requester and locate the applicable records. Certain information may be withheld where permitted by applicable law.

19.4 United States state privacy notice

Where an applicable United States state privacy law applies to Golden Amulets, the categories of personal information we may have collected during the preceding twelve months include:

• identifiers and contact information;
• customer-record information;
• commercial and transaction information;
• payment and financial transaction metadata;
• Internet and electronic network activity;
• approximate geolocation information;
• communications and customer-support content;
• inferences concerning preferences or suspected fraud;
• account information; and
• other information described in section 4.

We collect this information from the sources identified in section 5, process it for the purposes identified in section 6, and disclose it to the categories of recipients identified in section 8.

Subject to the scope and applicability of the relevant state law, residents may have rights to:

• confirm whether we process their information;
• access information;
• correct inaccuracies;
• request deletion;
• obtain portable information;
• opt out of sale, sharing, targeted advertising, or qualifying profiling;
• limit certain uses of sensitive information;
• receive information about categories or specific recipients;
• appeal a declined request; and
• receive equal service without unlawful discrimination for exercising a privacy right.

We may offer different prices, discounts, or benefits where permitted under a lawful loyalty, promotional, or financial-incentive programme. Legitimate differences resulting from the value of information or the cost of providing a service are not intended as unlawful discrimination.

To the extent that advertising or analytics technologies constitute a regulated sale, sharing, or targeted-advertising activity, you may exercise an applicable opt-out through our cookie settings, a recognised browser signal, or by contacting us.

20. Contact Information

Questions, objections, complaints, and privacy-rights requests may be submitted using the following details:

Please include sufficient information to identify the account, order, transaction, or communication concerned. Do not send complete payment-card details, passwords, or unnecessary identity documents by ordinary email.

21. Submission and Administration of Privacy Requests

To submit a request, email [email protected] with the subject line Privacy Request.

Your request should ordinarily include:

• your full name;
• the email address associated with your account or order;
• the applicable order number, where relevant;
• the country, state, or province in which you reside;
• the right you wish to exercise;
• a clear description of the information concerned; and
• any information reasonably necessary to verify the request.

We will respond within the period required by applicable law. Where permitted, we may extend the response period because of complexity, volume, verification difficulties, or other lawful reasons.

Submitting a privacy request does not:

• cancel an order;
• constitute a return or refund request;
• waive an outstanding payment obligation;
• prevent us from investigating suspected fraud;
• require deletion of legally retained transaction records; or
• affect the validity of processing lawfully completed before the request.

Where a request relates principally to information controlled independently by Stripe, PayPal, Wise, Google, a carrier, or another third party, we may direct you to that organisation.

22. Browser Privacy Signals and Do-Not-Track

Some browsers offer a “Do Not Track” setting. Because there is no single universally adopted interpretation of every Do-Not-Track signal, our website may not respond to all such signals.

This does not affect our obligation to recognise a legally required opt-out preference signal, such as Global Privacy Control, where the signal applies to Golden Amulets and the relevant processing activity.

23. Changes to This Notice

We may amend this Notice from time to time to reflect:

• changes to our website or business;
• new or replaced service providers;
• changes to payment or fulfilment methods;
• changes to cookies, analytics, or advertising technologies;
• new legal or regulatory requirements;
• changes to security, fraud-prevention, or operational practices; or
• other developments affecting personal-information processing.

The revised version shall be identified by the “Last updated” date displayed at the beginning of this Notice.

Where required by applicable law, we may provide additional notice or request renewed consent before materially different processing begins.

You should review this Notice periodically. Continued use of the website after publication of an updated Notice does not constitute consent where applicable law requires a separate affirmative consent mechanism.

24. Interpretation and Severability

Headings are included for convenience and do not limit the meaning of any provision.

References to “including” or “includes” mean “including without limitation.”

Where any part of this Notice is found to be invalid, unlawful, or inapplicable in a particular jurisdiction, that part shall be interpreted or limited to the minimum extent necessary, and the remaining provisions shall continue to apply to the extent permitted by law.

Where a mandatory privacy law provides greater protection than this Notice, the mandatory law shall prevail to the extent of the inconsistency. Nothing in this Notice voluntarily extends a statutory right to a person, transaction, organisation, or processing activity outside the scope of the applicable law.