Privacy Policy

Effective Date: September 17, 2026

This Privacy Policy describes how Heyi Culture Limited, doing business as Rivay (“Rivay,” “we,” “us,” or “our”), collects, uses, discloses, and otherwise processes personal information when you visit or use our online store, purchase our products, communicate with us, or otherwise interact with our services (collectively, the “Services”).

Heyi Culture Limited is the operator of the Rivay online store and is responsible for the personal information described in this Privacy Policy.

By using our Services, you acknowledge that your personal information may be processed as described in this Privacy Policy.

1. Personal Information We Collect

The personal information we collect depends on how you interact with us and which features of our Services you use.

Information You Provide to Us

We may collect information that you provide directly to us, including:

• Contact information, such as your name, email address, telephone number, billing address, and shipping address.
• Order and transaction information, such as the products you purchase, order history, order value, returns, refunds, and shipping information.
• Account information, if you create an account with us, such as your login credentials, account preferences, and saved information.
• Payment-related information. Payments are generally processed by third-party payment providers. We may receive transaction confirmations and limited payment-related information but do not necessarily receive or store complete payment card details.
• Customer service information, including messages, questions, feedback, reviews, support requests, and other communications with us.
• Custom-order information, including information, specifications, preferences, measurements, images, or other materials you voluntarily provide in connection with a customized jewelry request.
• Marketing preferences, including whether you have subscribed to or opted out of marketing communications.
• Any other information you choose to provide to us.

Some information is necessary for us to process and deliver your order. If you do not provide required information, we may be unable to complete your purchase or provide certain Services.

Information We Collect Automatically

When you visit or use our Services, we or our service providers may automatically collect certain information, including:

• IP address;
• browser type and settings;
• device type and identifiers;
• operating system;
• approximate location derived from IP address;
• pages viewed;
• products viewed or searched for;
• referring and exit pages;
• shopping cart activity;
• date and time of visits;
• interactions with our website, advertisements, and communications; and
• information collected through cookies, pixels, tags, software development kits, and similar technologies.

Information We Receive from Third Parties

We may receive personal information from third parties that help us operate our business, including:

• Shopify;
• payment processors;
• shipping and logistics providers;
• marketing and advertising providers;
• analytics providers;
• social media platforms;
• fraud prevention and security providers; and
• other service providers and business partners.

2. How We Use Personal Information

We may use personal information for the following purposes:

Providing Our Services

We use personal information to:

• process and fulfill orders;
• process payments and refunds;
• arrange shipping and delivery;
• provide order confirmations and updates;
• manage returns and after-sales service;
• create and maintain customer accounts;
• provide customer support;
• respond to inquiries;
• provide custom jewelry services; and
• otherwise perform our obligations to you.

Improving Our Store and Products

We may use information to:

• understand how customers use our Services;
• analyze website performance;
• improve our website, products, and customer experience;
• understand customer preferences;
• develop new products and services; and
• measure the effectiveness of marketing campaigns.

Marketing and Advertising

Subject to applicable law and your choices, we may use personal information to:

• send promotional emails or other marketing communications;
• recommend products that may be of interest to you;
• measure advertising performance;
• create advertising audiences;
• personalize advertising; and
• display advertisements on third-party platforms.

Where required by applicable law, we will obtain consent before using non-essential cookies or using personal information for certain advertising or marketing purposes.

Security and Fraud Prevention

We may use personal information to:

• detect, investigate, and prevent fraud;
• protect our customers, business, and Services;
• secure customer accounts;
• prevent unauthorized transactions or misuse; and
• enforce our terms and policies.

Legal and Compliance Purposes

We may process personal information when reasonably necessary to:

• comply with applicable laws and regulations;
• meet tax, accounting, and recordkeeping obligations;
• respond to lawful requests from courts, regulators, law enforcement, or other authorities;
• establish, exercise, or defend legal claims; and
• protect our legal rights and the rights of others.

3. Legal Bases for Processing

Where the European Economic Area (“EEA”), United Kingdom, Switzerland, or another jurisdiction requires us to identify a legal basis for processing personal information, we may rely on one or more of the following:

Performance of a Contract

We process information when necessary to provide products or Services you request, including processing orders, taking payment, arranging delivery, providing customer support, and handling returns.

Legitimate Interests

We may process information when necessary for our legitimate business interests, including:

• operating and improving our business;
• securing our Services;
• preventing fraud;
• understanding how customers use our store;
• improving our products;
• providing customer support; and
• carrying out certain marketing and analytics activities where permitted by law.

We consider and balance these interests against the rights and interests of individuals.

Consent

We rely on consent when required by law, including for certain marketing communications, advertising activities, cookies, and similar tracking technologies.

You may withdraw your consent at any time where processing is based on consent. Withdrawal does not affect processing that occurred before consent was withdrawn.

Legal Obligations

We may process personal information when necessary to comply with legal, regulatory, tax, accounting, or other obligations.

4. How We Disclose Personal Information

We may disclose personal information to third parties when reasonably necessary to operate our business and provide our Services.

These parties may include:

Ecommerce and Technology Providers

Our online store is hosted and powered by Shopify. Shopify processes personal information in connection with your interactions with our store and may process information to provide Shopify services and features.

Depending on the Shopify services and features enabled on our store, Shopify may also process information about your interactions with our store, Shopify, and other Shopify merchants for purposes such as personalization, analytics, security, and advertising.

You may review the Shopify Consumer Privacy Policy for additional information about Shopify's processing practices and use the Shopify Privacy Portal to exercise certain rights directly with Shopify where applicable.

Payment Providers

We may disclose information to payment processors, banks, card networks, digital wallet providers, fraud-prevention providers, and other financial service providers as necessary to process transactions.

Shipping and Fulfillment Providers

We may provide your name, address, telephone number, email address, order information, and other necessary information to shipping carriers, customs agents, warehouse providers, fulfillment companies, and other logistics providers.

Advertising and Analytics Providers

Subject to applicable law and your privacy choices, we may disclose certain information to advertising, analytics, social media, and marketing providers.

This may include information about your device, browser, purchases, website activity, and interactions with our advertisements.

Professional Advisers

We may disclose information to accountants, auditors, insurers, lawyers, consultants, and other professional advisers where reasonably necessary.

Legal Authorities

We may disclose personal information when we believe disclosure is required or permitted by law, including in response to lawful government requests, court orders, subpoenas, regulatory requirements, or to protect our rights, customers, or others.

Business Transactions

If Rivay or Heyi Culture Limited is involved in a merger, acquisition, financing, restructuring, sale of assets, insolvency proceeding, or similar business transaction, personal information may be disclosed or transferred as part of that transaction, subject to applicable law.

We do not authorize service providers to use personal information for purposes unrelated to the services they provide to us, except where they independently process information under their own legal obligations or privacy policies.

5. Shopify

Our Services are hosted by Shopify.

When you visit our store or make a purchase, Shopify may collect and process personal information necessary to provide ecommerce, infrastructure, security, payment, personalization, analytics, and other services.

If Shopify Network Intelligence or other Shopify Enhanced Services are enabled, information about your interactions with our store may be combined or processed with information from your interactions with Shopify and other Shopify merchants in order to provide services such as improved personalization, fraud prevention, analytics, and more relevant advertising.

Information processed by Shopify may be transferred to or processed in countries other than the country in which you live.

For further information, please review the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

6. Cookies and Similar Technologies

We and our service providers may use cookies, pixels, tags, local storage, and similar technologies.

These technologies may be used for:

• Strictly necessary purposes, such as maintaining your shopping cart, processing checkout, maintaining security, and enabling basic website functions.
• Functional purposes, such as remembering your preferences and improving website functionality.
• Analytics purposes, such as understanding website traffic, visitor behavior, and store performance.
• Advertising purposes, such as measuring advertisements, creating audiences, personalizing advertising, and understanding interactions across websites or services.

Where required by applicable law, non-essential cookies will not be used unless you have provided the required consent.

You may be able to manage your preferences through the cookie or privacy settings available on our website.

Your browser may also allow you to delete or block cookies, although doing so may affect certain functions of the Services.

7. Targeted Advertising and Sale or Sharing of Personal Information

We do not sell personal information in exchange for money.

However, some privacy laws use the terms “sale” or “sharing” more broadly.

For example, when we use certain advertising, analytics, or social media technologies, information about your activity may be disclosed to third parties in ways that may be considered a “sale,” “sharing,” or processing for targeted advertising under applicable U.S. state privacy laws.

Depending on the technologies we use, this information may include:

• identifiers;
• device and browser information;
• internet or electronic activity;
• commercial or purchase information;
• approximate location information; and
• information used to understand interests or preferences.

Where applicable, you may opt out of these activities using the Privacy Choices, Do Not Sell or Share My Personal Information, or similar privacy control provided through our website.

Where required by applicable law, we also process recognized Global Privacy Control (“GPC”) signals as opt-out requests.

We do not knowingly sell or share the personal information of individuals under the age of 16.

8. Marketing Communications

If you subscribe to marketing communications, we may send you information about Rivay products, collections, promotions, events, and other updates.

You may unsubscribe at any time by using the unsubscribe option contained in our marketing communications or by contacting us.

Even if you opt out of marketing messages, we may still send non-promotional communications relating to your orders, account, transactions, customer service requests, legal notices, or other Service-related matters.

9. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

The appropriate retention period may depend on:

• the nature of the information;
• the purpose for which it was collected;
• whether you maintain an account or ongoing relationship with us;
• legal, tax, accounting, customs, and regulatory requirements;
• fraud-prevention and security requirements;
• dispute-resolution requirements; and
• the need to establish, exercise, or defend legal claims.

When personal information is no longer reasonably necessary, we may delete, anonymize, or otherwise dispose of it in accordance with applicable law.

10. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

However, no method of transmission over the internet or electronic storage system is completely secure, and we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of any account credentials used to access our Services.

11. International Data Transfers

Rivay is operated by Heyi Culture Limited, a company based in Hong Kong SAR.

Our customers, ecommerce platform, service providers, logistics providers, payment providers, and other partners may be located in different countries.

As a result, your personal information may be transferred to, stored in, or processed in countries outside the country in which you live.

These countries may have data protection laws that differ from those in your jurisdiction.

Where required by applicable law, we use appropriate legal mechanisms and safeguards for international transfers of personal information, which may include contractual protections, adequacy mechanisms, or other legally recognized safeguards.

You may contact us for additional information about safeguards used in connection with international transfers where you have a legal right to request such information.

12. Your Privacy Rights

Depending on where you live and subject to applicable law, you may have certain rights regarding your personal information.

These may include the right to:

• request access to personal information we hold about you;
• request information about how we collect, use, or disclose your information;
• obtain a copy of certain personal information;
• request correction of inaccurate information;
• request deletion of personal information;
• restrict certain processing;
• object to certain processing;
• withdraw consent where processing is based on consent;
• request portability of certain information;
• opt out of certain targeted advertising;
• opt out of certain sales or sharing of personal information;
• appeal certain decisions regarding privacy requests where applicable; and
• exercise your rights without unlawful discrimination or retaliation.

Not every right applies in every jurisdiction or circumstance.

To exercise a privacy right, you may contact us at:

service@heyeeculture.com

We may need to verify your identity before processing certain requests. We will use information provided for verification only as permitted by applicable law.

Where permitted by law, an authorized agent may submit a request on your behalf. We may require evidence that the agent has authority to act for you.

We may deny or limit a request where permitted by law, including where information must be retained to comply with legal obligations, complete a transaction, prevent fraud, protect legal rights, or for another legally permitted purpose.

13. United States Privacy Rights

Residents of certain U.S. states may have additional privacy rights under applicable state law.

Depending on the law that applies, these rights may include:

• the right to know or access personal information;
• the right to request deletion;
• the right to correct inaccurate information;
• the right to obtain a portable copy of certain information;
• the right to opt out of the sale or sharing of personal information;
• the right to opt out of targeted advertising;
• the right to limit certain uses of sensitive personal information where applicable;
• the right to appeal certain privacy-request decisions; and
• the right not to receive discriminatory treatment for exercising privacy rights.

The categories of personal information we may collect are described in Section 1, the purposes for which we process information are described in Section 2, and the categories of parties to whom we may disclose information are described in Section 4.

As explained above, we do not sell personal information for monetary compensation. Certain advertising or analytics disclosures may nevertheless qualify as a sale, sharing, or targeted advertising under some U.S. state laws.

Where applicable, you may exercise an opt-out through our website privacy controls or by contacting us.

14. EEA, United Kingdom, and Switzerland

If applicable data protection law in the EEA, United Kingdom, or Switzerland applies to our processing of your personal information, you may have rights including access, correction, deletion, restriction, portability, objection, and withdrawal of consent.

You may also have the right to lodge a complaint with the competent data protection authority in the country where you live, work, or believe a violation has occurred.

Where we rely on legitimate interests, you may have the right to object to processing based on those interests.

You have the right to object at any time to processing of your personal information for direct marketing purposes.

If applicable law requires us to appoint a local data protection representative, information regarding that representative will be made available through this Privacy Policy or another appropriate notice.

15. Hong Kong Privacy Rights

Heyi Culture Limited processes personal data in accordance with applicable Hong Kong privacy requirements.

Subject to applicable law, you may request access to personal data we hold about you and request correction of inaccurate personal data.

Personal data is collected only where reasonably necessary for purposes connected with our business and is retained only for as long as reasonably necessary for those purposes or as otherwise required by law.

Requests regarding access to or correction of personal data may be submitted using the contact information below.

16. Children's Privacy

Our Services are intended for a general adult audience and are not directed to children under the age of 16.

We do not knowingly collect personal information from children in violation of applicable law.

If you believe that a child has provided personal information to us improperly, please contact us so that we can review the matter and take appropriate action.

17. Third-Party Websites and Services

Our Services may contain links to websites, applications, social media platforms, or services operated by third parties.

We are not responsible for the privacy, security, or content practices of third parties that we do not control.

We encourage you to review the privacy policies of third-party services before providing personal information to them.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, technologies, Services, legal obligations, or other operational requirements.

When we make changes, we will update the effective date displayed at the top of this Privacy Policy.

Where required by applicable law, we may provide additional notice of material changes.

19. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or would like to exercise a privacy right, please contact us at:

Heyi Culture Limited
Rivay

Email: service@heyeeculture.com

Address:
ROOM 1009, 10/F, FRONT BLOCK
MING SANG INDUSTRIAL BUILDING
19 HING YIP STREET
KWUN TONG, HONG KONG

For privacy-related requests, please include sufficient information for us to understand and respond to your request. We may request additional information where reasonably necessary to verify your identity.