Version history
| Version | Effective date | Summary of changes |
|---|---|---|
| 1.1 | 2026-11-04 | Moved to a pass-through model. Order personal data is no longer written to persistent storage; the gateway relays it in transit only. The retention table for order data was replaced with a no-retention statement. The previous claim — that destroying an encryption key made backup copies unrecoverable — was removed, because the key arrangement did not support it; it was replaced with commitments we can evidence: backups are encrypted under a key held separately from operational credentials, backup sets are destroyed within 35 days, and every restore is controlled and audited. Section 2 now states that personal data is not copied to disk; section 8 no longer claims encryption of data at rest, because no such store exists; section 11 states that most requests will be handled by the seller, where the data actually resides. |
| 1.0 | 2026-11-04 | Initial publication. Sets out the processor role of the gateway; the categories of data relayed and the minimal set of order fulfilment personal data stored under the model then in use; the legal basis; the retention schedule applicable at that time; sub-processors; cross-border transfers; security measures; the no-cookies statement; children’s data; data subject rights including the seller-as-first-contact rule and the 5-business-day deletion execution; complaints; and contact details. |
Version 1.0 was superseded before this policy was made public. It is listed here so that the history of the text is complete; the operative version is 1.1.
Why version 1.1 changed
Version 1.0 described a retention model for order personal data, and described deletion of that data by destroying the encryption key. The service does not operate that way: it relays order data and does not store it, and the key arrangement did not support per-store key destruction.
A policy that promises a mechanism the system cannot demonstrate is worse than one that stays silent, because it cannot be evidenced at audit. Version 1.1 therefore describes what the system actually does, and limits itself to claims that can be shown: encryption in transit, no copy on disk, backups destroyed within 35 days, and restores that are logged.
No new purpose of processing was introduced by this revision. The scope of personal data handled is unchanged; what changed is that we no longer hold it.
How changes are published
- Material changes are published at least 14 days before they take effect.
- Every revision receives a new version number and a new effective date on the policy page itself.
- Earlier versions remain archived and are available on request from the privacy contact.
- The Chinese and English versions are revised together; if they ever diverge, the English version governs.
Requesting an earlier version
Write to fikawo@163.com and state the version number or the approximate date you need.