Privacy Policy

Last updated: October 1, 2026

CatFulfill Limited, a company registered in Hong Kong and operating under the XMDropshipping brand ("CatFulfill," "XMDropshipping," "we," or "us"), is responsible for the personal data described in this policy. This policy applies to our websites, communications, accounts, and dropshipping sourcing and fulfillment services.

Personal Data We Collect

The data we collect depends on how you interact with us. It may include:

• Contact and inquiry data: your name, email address, phone number, business details, and the contents of messages or quote requests you send us.
• Account and store data: account identifiers, Shopify store URL, collaborator access information, integration settings, and information needed to connect and support your store.
• Order and fulfillment data: product identifiers, order contents, quantities, delivery addresses, recipient contact details, tracking information, and service instructions supplied for fulfillment.
• Payment and billing data: invoice details, transaction references, payment status, and billing contact information. Online payment details may be collected directly by the payment provider you choose.
• Technical and usage data: device and browser information, IP address, security and access logs, and information about how the website is used.

Some information is needed to respond to an inquiry, connect a store, or fulfill an order. If you choose not to provide information needed for a requested service, we may be unable to provide that service.

How We Use Personal Data

We use personal data to:

• Respond to inquiries and prepare service quotes.
• Create and support accounts, connect stores, and synchronize orders.
• Source products, process orders, arrange shipping, provide tracking, and handle after-sales requests.
• Issue invoices, confirm payments, maintain business records, and meet legal obligations.
• Protect our systems, prevent fraud or misuse, troubleshoot issues, and improve our website and services.
• Send service updates and, where permitted, business communications. You can ask us to stop promotional communications at any time.

Cookies and Analytics

Our website may use cookies or similar technologies needed for essential functions such as security, session management, and remembering preferences. If analytics tools such as Google Analytics or Plausible are enabled, they may receive technical and usage data to help us understand website performance. You can manage cookies through your browser settings; blocking essential cookies may affect site functionality.

When We Share Personal Data

We do not sell personal data for money. We may disclose relevant information, subject to applicable law, to:

• Service providers supporting website hosting, account authentication, email, analytics, and payment processing.
• Suppliers, factories, warehouse operators, ERP providers, and shipping or delivery partners when needed to provide requested sourcing or fulfillment services.
• Professional advisers, regulators, courts, or public authorities when required by law or reasonably necessary to protect rights and safety.
• A successor entity in connection with a merger, financing, restructuring, or transfer of our business, subject to appropriate safeguards.

International Transfers

To operate a cross-border fulfillment service, relevant information may be processed in Hong Kong, mainland China, or other locations where our service providers and logistics partners operate. Where applicable law requires safeguards for an international transfer, we take steps required by that law.

Data Retention

We retain personal data for as long as reasonably necessary to provide the requested services, maintain our business and accounting records, resolve disputes, enforce agreements, and meet legal requirements. Retention periods depend on the type of data and the reason it was collected. We delete or de-identify data when it is no longer needed, unless the law requires otherwise.

Security

We use reasonable technical and organizational measures designed to protect personal data. No method of transmission or storage can be guaranteed to be completely secure. Please do not send full payment card details or account passwords to us by email or messaging.

Your Rights and Choices

Depending on the laws that apply to you, you may have rights to request access to or correction of personal data, ask for deletion or restriction, object to certain uses, receive a portable copy, or withdraw consent where processing is based on consent. Under Hong Kong's Personal Data (Privacy) Ordinance, you may make a data access request. In the circumstances provided by that Ordinance, you may also request correction of personal data after receiving a copy through a data access request. We may need to verify your identity before responding and may be unable to fulfill a request where an exception under applicable law applies.

To exercise a right or ask a privacy question, email cathy.liao@xmdropshipping.com. You may also contact the Hong Kong Privacy Commissioner for Personal Data if you have a concern about our handling of personal data.

Children's Privacy

Our business services are intended for businesses and adults. We do not knowingly collect personal data directly from children. If you believe a child has provided us personal data, please contact us so that we can review and address it.

Changes to This Policy

We may update this policy as our services or legal requirements change. The revised date will appear at the top of the page. Where required, we will provide additional notice.