Privacy policy

Effective Date: 5 September 2026

ART CATCHER LIMITED, trading as SANKTOYS (“SANKTOYS”, “we”, “us” or “our”), respects your privacy and is committed to handling your personal information responsibly.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information when you visit sanktoys.com, create an account, place an order, contact us, subscribe to marketing communications, submit content or otherwise interact with our website and services.

For the purposes of applicable data protection laws, ART CATCHER LIMITED is the controller of your personal information and, under the laws of Hong Kong, the relevant data user.

1. Scope of This Privacy Policy

This Privacy Policy applies to personal information processed through:

  • our website at sanktoys.com;

  • customer accounts and order processing;

  • customer service enquiries and product claims;

  • newsletters and other marketing communications;

  • product reviews and other content submitted through the website; and

  • other interactions with SANKTOYS that refer to this Privacy Policy.

This Privacy Policy does not govern websites, applications or services operated independently by third parties. Their own privacy policies apply to their processing activities.

2. Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information.

Identity and Contact Information

This may include your name, billing address, delivery address, email address, telephone number and other contact details.

Order and Transaction Information

This may include the products you purchase, order number, order date, purchase amount, currency, discounts, delivery method, payment status, refund information, return or claim history, and other information relating to your transaction.

Payment Information

Payments are processed by Shopify and the relevant payment service providers. These providers may collect and process payment card details, bank account information, digital wallet information or other payment credentials.

SANKTOYS generally receives payment confirmations and limited payment information, such as the payment method, card type or the last digits of a payment card. We do not normally receive or store complete payment card numbers or card security codes.

Customer Account Information

If you create a customer account, we may process your account identifier, profile information, saved addresses, order history and authentication-related records.

Passwords and other authentication credentials may be handled by Shopify or the relevant authentication provider and are not normally accessible to SANKTOYS in readable form.

Shopping and Preference Information

This may include products viewed, products added to or removed from a shopping cart, wish-list activity, purchase preferences, language, currency, country or region, marketing preferences and other information about how you interact with our store.

Communications and Claim Information

When you contact us, we may collect your messages, enquiries, complaints and customer service records.

If you submit a damaged, defective, incomplete or incorrect-item claim, we may also collect photographs, videos, packaging images, shipping labels and other evidence you provide for the purpose of reviewing the claim.

Please avoid including unnecessary personal information about yourself or other people in photographs, videos or other materials submitted to us.

Reviews and Other Content

If you submit a product review, comment, photograph or other content, we may process the content itself, your display name, rating, submission date and related account or order information.

Device and Website Usage Information

When you use our website, we and our service providers may automatically collect information such as:

  • IP address;

  • browser type and version;

  • device type and operating system;

  • language and time-zone settings;

  • approximate location derived from your IP address;

  • pages viewed and links selected;

  • referring website or source;

  • dates and times of visits;

  • session and interaction information; and

  • cookie, pixel or similar technology identifiers.

Marketing and Privacy Preference Information

This may include whether you have subscribed to email or SMS marketing, the date and method of your subscription, consent records, unsubscribe requests, cookie preferences and requests to exercise privacy rights.

Fraud Prevention and Security Information

We may process IP addresses, device information, transaction patterns, account activity, payment verification results, delivery information and other indicators used to prevent fraud, abuse, unauthorised transactions or security incidents.

3. Sources of Personal Information

We may collect personal information:

  • directly from you when you place an order, create an account, contact us or submit information;

  • automatically through cookies, pixels, local storage and similar technologies when you use our website;

  • from Shopify and other service providers that support our online store;

  • from payment processors, fraud-prevention providers, delivery companies and logistics providers;

  • from marketing, analytics or advertising providers where those services are enabled and permitted by law;

  • from social media platforms if you choose to interact with us through those platforms; and

  • from another person acting on your instructions, such as someone placing an order or contacting us on your behalf.

4. Whether Providing Personal Information Is Mandatory

Some personal information is required for us to provide products or services to you. Required fields will generally be identified when the information is requested.

If you do not provide information necessary to process an order, arrange delivery, verify payment, prevent fraud or comply with legal requirements, we may be unable to complete the relevant transaction or provide the requested service.

Providing information for marketing purposes is voluntary. Refusing or withdrawing marketing consent will not prevent you from purchasing products or receiving essential communications about an existing order.

5. How and Why We Use Personal Information

We may use personal information for the following purposes.

Processing Orders and Providing Services

We use personal information to:

  • confirm, process and fulfil orders;

  • process payments, refunds and approved claims;

  • arrange shipping and delivery;

  • communicate about order status;

  • maintain customer accounts; and

  • provide customer service.

Where applicable, this processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.

Operating and Improving Our Website

We may use personal information to maintain our website, understand how customers use it, diagnose technical problems, develop new features and improve our products and services.

Depending on the circumstances and applicable law, this processing may be based on our legitimate interests or your consent.

Fraud Prevention and Security

We may use personal information to verify transactions, protect customer accounts, detect and prevent fraud, investigate suspicious activity, enforce our terms and protect our website, customers and business.

This processing may be necessary to comply with legal obligations or for our legitimate interests in maintaining the security and integrity of our services.

Customer Support and Product Claims

We use personal information to respond to enquiries, investigate complaints, assess damaged or defective-item claims, communicate proposed resolutions and maintain records of the outcome.

Legal and Regulatory Compliance

We may process personal information to comply with tax, accounting, customs, consumer protection, product safety, law-enforcement and other legal or regulatory requirements.

Marketing Communications

Subject to your choices and applicable law, we may use your name, email address, telephone number, marketing preferences and purchase history to send information about SANKTOYS products, new releases, restocks, promotions, collaborations and events.

Where consent is required, we will send such communications only after obtaining the necessary consent.

Personalisation, Analytics and Advertising

Where enabled and permitted by law, we may use website activity, shopping preferences and device information to:

  • remember your preferences;

  • personalise website content;

  • measure website performance;

  • understand the effectiveness of marketing campaigns; and

  • deliver or measure relevant advertising.

Where applicable law requires consent, non-essential analytics, personalisation or advertising technologies will be activated only after you have made the relevant choice.

Establishing and Defending Legal Claims

We may retain and use relevant information to establish, exercise or defend legal claims, respond to disputes and protect our legal rights.

Business Transactions

If our business or assets are reorganised, financed, sold, transferred or acquired, personal information may be reviewed or transferred as part of that transaction, subject to appropriate confidentiality and legal safeguards.

Where we rely on legitimate interests, we consider the necessity of the processing and balance our interests against the rights and interests of the individuals concerned.

6. Cookies and Similar Technologies

Our website and its service providers may use cookies, pixels, local storage and similar technologies to operate the website and understand how it is used.

These technologies may include:

  • Essential technologies, which are necessary for functions such as shopping carts, checkout, security, fraud prevention, account access and remembering privacy preferences;

  • Functional technologies, which remember choices such as language, currency and other website preferences;

  • Analytics technologies, which help us understand website usage and performance; and

  • Advertising technologies, which may be used to measure campaigns or provide more relevant advertising where those features are enabled.

Where required by applicable law, we request consent before activating non-essential technologies.

You can manage available choices through the cookie banner or Cookie Preferences control displayed on our website. You may also configure your browser to block or delete cookies, although doing so may affect the operation of certain website features.

For additional information about technologies used by Shopify, please review the Shopify Cookie Policy.

7. When We Disclose Personal Information

We may disclose personal information to the following categories of recipients when reasonably necessary for the purposes described in this Privacy Policy.

Shopify

Our online store is hosted and supported by Shopify. Shopify processes personal information to operate the ecommerce platform, provide checkout and account functions, maintain security and support other store features.

Payment Service Providers

Payment processors, banks, card networks and digital wallet providers may receive personal information necessary to authorise, process, settle or refund transactions and prevent payment fraud.

Delivery and Fulfilment Providers

We may provide names, addresses, telephone numbers, order details and customs information to warehouses, fulfilment partners, postal services, couriers, freight companies and customs agents so that orders can be prepared, shipped, tracked and delivered.

Technology and Security Providers

Cloud hosting, website support, email, customer service, data storage, security, fraud-prevention and anti-bot providers may process information on our behalf.

Marketing, Analytics and Advertising Providers

Where these services are enabled and permitted by law, relevant providers may process device, usage, campaign and preference information to provide analytics, communications or advertising services.

Professional Advisers

We may disclose information to accountants, auditors, insurers, banks, lawyers and other professional advisers when reasonably necessary for their services.

Government Authorities and Other Parties Required by Law

We may disclose personal information when required by applicable law, a valid court order or a lawful request from a competent authority. We may also disclose information where reasonably necessary to protect legal rights, investigate fraud or prevent harm.

Business Transaction Recipients

Personal information may be disclosed to prospective purchasers, investors, lenders and professional advisers in connection with a proposed merger, acquisition, restructuring, financing or sale of all or part of our business, subject to appropriate confidentiality measures.

At Your Direction

We may disclose information when you ask or authorise us to do so.

We do not disclose personal information to unrelated third parties for their own direct marketing in a manner that requires consent under applicable law unless the required consent has first been obtained.

8. Shopify’s Role

Our store is powered by Shopify. Shopify generally processes customer personal information on our behalf to provide its ecommerce platform and related services.

For certain Shopify consumer features, network services or enhanced services, Shopify may process information for its own stated purposes and may act as an independent controller or business under applicable privacy laws.

You can learn more by reviewing:

Requests relating specifically to Shopify’s independent processing may need to be submitted directly through Shopify’s Privacy Portal.

9. hCaptcha

We use hCaptcha to help protect website forms and other functions against spam, abuse and automated activity.

When hCaptcha is activated, it may process information such as your IP address, device and browser information, website interaction data and other security or behavioural indicators to determine whether an interaction is likely to have been made by a person or an automated system.

This processing helps us maintain the security and reliability of our website. hCaptcha’s own processing is governed by its:

10. Public Content and Third-Party Links

Content submitted to a public part of our website, such as a product review or public comment, may be visible to other users and may be copied, shared or indexed by search engines.

Please do not include confidential information, payment information or unnecessary personal information in publicly submitted content.

Our website may contain links to websites, social media platforms or services operated by third parties. We do not control their privacy or security practices. We recommend reviewing the relevant third party’s privacy policy before providing personal information.

11. Direct Marketing

Subject to applicable law and your choices, we may use your name, email address, telephone number, marketing preferences and relevant purchase history to send information about:

  • SANKTOYS art collectibles and related products;

  • new product releases and restocks;

  • promotions and special offers;

  • brand collaborations; and

  • SANKTOYS news and events.

Where required by law, we will obtain your consent or indication of no objection before using personal information for direct marketing.

Marketing consent is separate from the purchase of products and is not a condition of completing an order.

You may unsubscribe at any time by:

  • selecting the unsubscribe link in a marketing email;

  • following the opt-out instructions in an SMS message, where applicable; or

  • contacting us at sanktoys@gmail.com.

We do not charge a fee for processing a direct-marketing opt-out request.

After you unsubscribe, we may retain limited information on a suppression list to ensure that we respect your request. Unsubscribing from marketing does not prevent us from sending transactional or service communications relating to your account, orders or customer service requests.

12. Retention of Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, tax, fraud-prevention, dispute-resolution and regulatory requirements.

The applicable retention period depends on the nature of the information and the reason for processing it. In particular:

  • order, transaction, tax and accounting records are generally retained for at least seven years after the relevant transaction, or longer where required by law;

  • customer account information is retained while the account remains active and afterwards only for as long as necessary for legal, security, fraud-prevention or dispute purposes;

  • customer service correspondence and claim evidence are retained for the time reasonably necessary to resolve the enquiry or claim and address related legal or operational requirements;

  • marketing information is retained until you unsubscribe or the information is no longer required, although a limited suppression record may be kept after an opt-out;

  • public reviews or other submitted content may remain available until removed, withdrawn or no longer required, subject to applicable law; and

  • cookies and device identifiers are retained according to their applicable duration or until they are deleted or withdrawn through available privacy controls.

When personal information is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it.

13. Information Security

We use reasonable administrative, technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include access controls, secure communications, service-provider controls, monitoring, staff procedures and payment processing through specialist providers.

No internet transmission, website or storage system can be guaranteed to be completely secure. You should use a unique password for your customer account and avoid sending complete payment card information, identification documents or other highly sensitive information through ordinary email or website contact forms unless we have specifically requested it through an appropriate channel.

If we become aware of a personal data breach, we will assess the incident and provide notifications where required by applicable law.

14. International Transfers

SANKTOYS is operated by a company incorporated in Hong Kong. Personal information may be processed in Hong Kong and in other countries or regions where Shopify, payment providers, delivery companies, technology providers and other service providers operate, including Canada and the United States.

Data protection laws in those locations may differ from those in your country or region.

Where applicable law requires safeguards for an international transfer, we will use an appropriate lawful mechanism. Depending on the circumstances, this may include:

  • a transfer to a country recognised as providing an adequate level of protection;

  • approved standard contractual clauses;

  • the United Kingdom International Data Transfer Agreement or UK Addendum;

  • binding corporate rules; or

  • another transfer mechanism permitted by applicable law.

You may contact us if you would like further information about the safeguards relevant to a particular transfer, subject to confidentiality and legal restrictions.

15. Children and Young Persons

SANKTOYS products are marketed primarily as collectible products for persons aged 15 and above. They may contain small parts and are not intended for very young children.

A person who has not reached the age at which they may independently enter into a contract or provide valid consent under applicable law should use our website and purchase products only with the involvement and permission of a parent or legal guardian.

We do not knowingly collect personal information from a child where parental authorisation is required by law. If you are a parent or legal guardian and believe that a child has provided personal information to us without the required authorisation, please contact us so that we can assess and, where appropriate, delete the information.

16. Your Privacy Rights

Your rights depend on your location, our relationship with you and the applicable law. Rights may be subject to legal exceptions and verification requirements.

Hong Kong

Under the Personal Data (Privacy) Ordinance, eligible individuals may have the right to:

  • request access to personal data held about them;

  • request correction of inaccurate personal data; and

  • require us to stop using their personal data for direct marketing.

We may request information necessary to verify your identity and locate the relevant records. We will process valid requests within the period required by applicable law.

European Economic Area and United Kingdom

Where the applicable data protection law of the European Economic Area or United Kingdom applies, you may have the right to:

  • be informed about the processing of your personal data;

  • request access to your personal data;

  • request correction of inaccurate or incomplete personal data;

  • request deletion of personal data in certain circumstances;

  • request restriction of processing;

  • receive certain personal data in a structured, commonly used and machine-readable format;

  • object to processing based on legitimate interests;

  • object to direct marketing;

  • withdraw consent at any time where processing is based on consent; and

  • request safeguards or human review in relation to certain decisions based solely on automated processing.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

You may also lodge a complaint with the data protection authority in the country where you live, work or believe an infringement occurred. A list of European data protection authorities is available through the European Data Protection Board.

Information about making a complaint in the United Kingdom is available from the Information Commissioner’s Office.

Certain United States States

If an applicable United States state privacy law covers our processing of your personal information, you may have rights such as the right to:

  • know or access the personal information processed about you;

  • correct inaccurate personal information;

  • request deletion of personal information;

  • obtain a portable copy of certain information;

  • opt out of the sale or sharing of personal information, or targeted advertising, where applicable;

  • limit certain uses of sensitive personal information, where applicable;

  • appeal a decision concerning a privacy request; and

  • exercise your rights without unlawful discrimination.

These rights apply only where the relevant law covers both you and our business activities. Inclusion of this section does not mean that every listed law or right applies in every case.

How to Exercise Your Rights

To submit a privacy request, contact us at sanktoys@gmail.com.

Please clearly describe your request and provide enough information for us to identify the relevant records. We may ask for additional information reasonably necessary to verify your identity and protect your information from unauthorised disclosure.

Where permitted by law, an authorised agent may submit a request on your behalf. We may require proof of the agent’s authority and may ask you to verify your identity directly.

We will respond within the time required by applicable law. If we cannot fulfil a request, we will explain the reason where legally required.

17. Automated Fraud and Security Assessments

Shopify, payment processors, fraud-prevention providers and security providers may use automated tools to assess transaction, account or device information for indications of fraud, abuse or security threats.

These assessments may affect whether a transaction requires additional verification, is delayed for review or cannot be completed.

Where a decision producing legal or similarly significant effects is based solely on automated processing and applicable law grants you additional rights, you may contact us to request information or human review.

18. Questions and Complaints

If you have a question, concern or complaint about how we handle personal information, please contact us using the details below.

We will review the matter and respond within a reasonable period or within the period required by applicable law.

You may also have the right to complain directly to a competent privacy or data protection authority. Contacting us first is not a condition of exercising that right.

For Hong Kong privacy matters, information about the relevant authority is available from the Office of the Privacy Commissioner for Personal Data, Hong Kong.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, services, technology, service providers or legal obligations.

The updated version will be published on this page with a revised effective date.

Where a change materially affects how we use personal information, we will provide additional notice or request consent where required by applicable law.

20. Contact Us

For privacy enquiries, requests or complaints, please contact:

ART CATCHER LIMITED
Trading as SANKTOYS

Email: sanktoys@gmail.com
Customer Service Telephone: +86 180 2075 7626

Registered Office:
Flat 03, 15/F, Carnival Commercial Building
18 Java Road
North Point
Hong Kong

ART CATCHER LIMITED is the controller of your personal information and, under Hong Kong law, the relevant data user.