Privacy Policy

1.1 Personal Information Defined

For the purposes of this Privacy Policy, personal information means any data or information that relates to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person. This definition aligns with applicable data protection laws in the United States and internationally.

1.2 Non-Personal Information

We may also collect, use, and share aggregated, anonymized, or de-identified data that does not identify any individual person. Such data is not considered personal information under this Privacy Policy and may be used for any lawful purpose, including research, analytics, service improvement, and commercial benchmarking, without additional notice or consent.

1.3 Geographic Scope

Ximeng Clothing Inc. is headquartered in the United States at 877 E 100 N, Payson, Utah 84651-2346, and provides Services primarily to clients domiciled within the United States. However, our Website is accessible globally, and we may receive personal information from individuals located in other jurisdictions. Where applicable data protection laws of other countries apply to your personal information, we endeavor to comply with those laws to the extent they govern our processing activities.

2.1 Identity and Contact Information

When you fill out a contact form on our Website, send us an email, call our phone line at +1 (740) 876-7536, or engage with us through any other communication channel, we may collect your full name, job title, company affiliation, email address, telephone number, mailing address, and any other contact details you voluntarily provide. This information enables us to respond to your inquiries, provide requested information about our Services, and establish a business relationship.

2.2 Professional and Business Information

In the course of delivering our computer systems design, integration, consulting, software engineering, infrastructure management, and cybersecurity services, we may collect information about your organization, including company name, industry sector, number of employees, existing technology infrastructure details, system architecture documentation, business processes, project specifications, technical requirements, budgets, timelines, and strategic objectives. This information is essential for providing tailored professional and technical services.

2.3 Technical and Usage Data

When you visit our Website, our servers automatically record certain technical information transmitted by your browser and device. This includes your Internet Protocol (IP) address, browser type and version, operating system, device type, screen resolution, referring and exit pages, date and time stamps of visits, pages viewed, time spent on each page, clickstream data, scroll depth, and other browsing behavior metrics. This data is collected through server logs, analytics services, and other automated means.

2.4 Communication Records

We maintain records of all communications between you and Ximeng Threads, including email correspondence, telephone call logs, meeting notes, support tickets, project management updates, and any other form of written or verbal communication. These records help us maintain context across interactions, improve service quality, and fulfill our contractual and legal obligations to clients.

2.5 Payment and Transaction Information

When you engage our Services under a contractual agreement, we may collect billing and payment information necessary to process invoices and payments. This may include billing address, payment method details, bank account information for wire transfers, purchase order numbers, and transaction history. We do not directly store full credit card numbers on our own servers; payment card processing is handled by PCI-DSS-compliant third-party payment processors.

2.6 Client System Access Credentials

As a computer systems design and integration firm, we may from time to time receive access credentials, API keys, security tokens, or authentication information that allows us to interface with your existing technology systems for diagnostic, integration, migration, or managed service purposes. Such credentials are treated with the highest level of security and handled in accordance with our internal access control policies and the confidentiality provisions of our service agreements.

3.1 Direct Collection

The majority of personal information we collect is provided directly by you when you voluntarily fill out forms on our Website, send us emails, speak with our representatives by phone, participate in consultation meetings, respond to surveys, submit requests for proposals, or provide information during the client onboarding process. You are under no statutory obligation to provide personal information to us; however, certain Services cannot be performed if you decline to provide necessary information.

3.2 Automated Collection

As you navigate our Website, certain information is collected automatically through cookies, web beacons, pixel tags, server logs, and similar tracking technologies. These automated mechanisms capture technical and usage data as described in Clause 2.3. You may configure your browser to refuse cookies or alert you when cookies are being sent; however, some features of our Website may not function optimally without cookie support.

3.3 Third-Party Sources

We may receive personal information about you from third-party sources, including but not limited to publicly available databases, professional networking platforms, industry directories, credit reference agencies (with your consent where required), and partners who refer your business to us. When we obtain information from such sources, we take reasonable steps to verify that the data was lawfully collected and that we have a legitimate basis for processing it.

3.4 Client-Provided Third-Party Data

In the course of providing our Services, clients may share with us personal information about their employees, contractors, customers, or end users. In these circumstances, we act as a data processor and process such information strictly in accordance with the instructions provided by our client, who acts as the data controller. Our obligations with respect to such data are governed by the terms of our services agreement with the client.

4.1 Contractual Necessity

We process personal information when it is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. This includes processing required to deliver our Services, manage client relationships, process payments, provide support, and fulfill other contractual commitments we have undertaken.

4.2 Legitimate Business Interests

We process personal information where we have a legitimate business interest that is not overridden by your data protection rights. Such legitimate interests include, but are not limited to: improving and personalizing our Website and Services; conducting business analytics and market research; developing new service offerings; ensuring the security and integrity of our systems; preventing fraud and abuse; and marketing our Services to prospective clients who have expressed interest.

4.3 Consent

In certain circumstances, we process personal information based on your explicit, freely given consent. For example, we will obtain your consent before sending marketing communications via email where required by applicable law, before placing certain categories of cookies on your device, and before processing sensitive categories of personal information. You have the right to withdraw your consent at any time by contacting us using the information provided in Clause 14 of this Privacy Policy.

4.4 Legal Obligation

We may process personal information to comply with applicable laws, regulations, court orders, subpoenas, government requests, or other legal processes. This includes maintaining records required by tax, accounting, corporate, and employment laws, as well as cooperating with law enforcement authorities in the investigation of suspected illegal activities where legally required to do so.

4.5 Vital Interests

In rare circumstances, we may process personal information where it is necessary to protect the vital interests of you or another natural person, such as in the event of a medical emergency or a situation involving imminent physical harm.

5.1 Service Delivery and Client Management

We use personal and business information to deliver our contracted Services, including systems architecture and design, systems integration, technical consulting, custom software engineering, IT infrastructure management, and cybersecurity services. This encompasses project planning, resource allocation, progress tracking, deliverable production, quality assurance testing, and post-deployment support and maintenance.

5.2 Communication and Relationship Management

We use your contact information to communicate with you about our Services, respond to inquiries, provide quotes and proposals, send service-related notifications and updates, manage client accounts, process billing and payments, and maintain ongoing business relationships. We may also send you newsletters, industry insights, case studies, and information about service enhancements, provided you have not opted out of such communications.

5.3 Website Improvement and Analytics

Technical and usage data is analyzed to understand how visitors interact with our Website, identify areas for user experience improvement, optimize page load performance, enhance navigation structures, measure the effectiveness of content, diagnose technical issues, and inform our web development and digital strategy decisions.

5.4 Security and Fraud Prevention

We process information to monitor, detect, investigate, and prevent security incidents, unauthorized access to our systems, fraudulent activities, violations of our Terms of Service, and other malicious or illegal conduct. This includes analyzing traffic patterns, logging access events, and deploying automated security monitoring tools.

5.5 Research and Development

We may use aggregated and anonymized data derived from personal information for internal research, statistical analysis, service development, technical benchmarking, and the creation of industry reports and whitepapers. No individually identifiable information is disclosed in any such research outputs.

5.6 Marketing and Business Development

With your consent where required by applicable law, we may use your contact information to send you marketing communications about our Services, invite you to webinars and industry events, share relevant content, and conduct client satisfaction surveys. You may opt out of marketing communications at any time by using the unsubscribe link provided in each email or by contacting us directly.

6.1 Retention Criteria

When determining appropriate retention periods, we consider: the amount, nature, and sensitivity of the personal information; the potential risk of harm from unauthorized use or disclosure; the purposes for which we process the personal information and whether we can achieve those purposes through other means; the duration of our contractual relationship with you; applicable statutes of limitations for legal claims; and any legal, regulatory, tax, accounting, or reporting requirements that mandate retention for a specified period.

6.2 Data Location

All personal information we collect is stored on secure servers located in the United States. We may utilize cloud infrastructure services provided by reputable third-party providers who maintain data centers within the United States. We ensure through contractual agreements that any such third-party infrastructure providers implement appropriate technical and organizational security measures consistent with the standards described in this Privacy Policy.

6.3 Data Deletion and Disposal

Upon expiration of the applicable retention period, personal information is securely deleted, destroyed, or irreversibly anonymized using methods appropriate to the format and sensitivity of the data. For digital records, this includes secure deletion protocols, cryptographic erasure where applicable, and physical destruction of storage media when hardware is decommissioned. For physical records, this includes cross-cut shredding and certified destruction processes. We maintain a data disposal log for audit purposes.

6.4 Backup Retention

Personal information may persist in our secure backup systems for a limited additional period beyond active retention, in accordance with our backup rotation and disaster recovery policies. Backup data is retained solely for business continuity purposes and is not actively processed or accessed except in the event of a data recovery scenario. Backup media is subject to the same deletion and disposal standards as primary data storage.

7.1 Service Providers and Business Partners

We may share personal information with carefully selected third-party service providers and business partners who perform services on our behalf. These include cloud hosting and infrastructure providers, email and communication platform providers, customer relationship management (CRM) software vendors, payment processors, accounting and professional services firms, analytics and marketing platform providers, and cybersecurity monitoring services. All such service providers are bound by contractual agreements that require them to protect personal information with security standards at least as stringent as our own and to use the information solely for the purposes we specify.

7.2 Legal Compliance and Protection

We may disclose personal information when we believe in good faith that such disclosure is necessary to: comply with a legal obligation, court order, subpoena, or government request; protect and defend the rights, property, or safety of Ximeng Clothing Inc., our employees, our clients, or the public; enforce our Terms of Service or other contractual agreements; detect, prevent, investigate, or address fraud, security breaches, or other illegal activity; or exercise or defend legal claims.

7.3 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, joint venture, assignment, transfer, or other disposition of all or a portion of our business or assets (including in connection with bankruptcy or similar proceedings), personal information may be transferred to the acquiring or successor entity. We will require any such entity to adhere to this Privacy Policy with respect to previously collected personal information and will notify you via email, a prominent notice on our Website, or other appropriate means before your personal information becomes subject to a materially different privacy policy.

7.4 With Your Consent

We may share personal information with third parties when we have obtained your express, informed consent to do so. For example, if you request that we share your project details with a technology vendor partner as part of a joint solution proposal, we will seek your explicit authorization before making such a disclosure.

7.5 Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified data that does not identify any individual person with third parties for research, marketing, analytics, industry benchmarking, and other lawful purposes. Such data is not considered personal information and is not subject to the restrictions of this Privacy Policy.

8.1 What Are Cookies

Cookies are small text files that are placed on your computer or mobile device when you visit a website. They are widely used to make websites work more efficiently, to remember your preferences, and to provide information to the website operators. Cookies may be session-based (deleted when you close your browser) or persistent (remaining on your device for a set period or until manually deleted). In addition to cookies, we may use web beacons, pixel tags, local storage objects, and similar technologies for similar purposes.

8.2 Categories of Cookies We Use

Essential Cookies: These cookies are necessary for the basic operation of our Website, including navigation, access to secure areas, and form submission functionality. Our Website cannot function properly without these cookies, and they do not require your consent under applicable law.

Performance and Analytics Cookies: These cookies collect information about how visitors use our Website — which pages are most frequently visited, how visitors navigate between pages, and whether they encounter error messages. We use this information to improve the performance and design of our Website. These cookies collect aggregated, anonymous information.

Functional Cookies: These cookies allow our Website to remember choices you make, such as your language preference or the region you are in, and provide enhanced, more personalized features.

Targeting and Advertising Cookies: These cookies may be set through our Website by our advertising partners. They may be used to build a profile of your interests and show you relevant advertisements on other websites. We do not currently deploy extensive advertising cookies, but reserve the right to do so in the future with appropriate notice and consent mechanisms.

8.3 Your Cookie Choices

Most web browsers allow you to manage cookie preferences through the browser settings. You can typically configure your browser to block all cookies, accept only first-party cookies, delete cookies when you close the browser, or notify you each time a cookie is set. Please note that blocking or deleting cookies may impact the functionality and performance of our Website and may prevent certain features from working as intended. For more detailed information about managing cookies, consult the help documentation for your specific browser.

8.4 Do Not Track Signals

Some web browsers offer a Do Not Track (DNT) setting that sends a signal to websites indicating the user's tracking preference. Our Website does not currently respond to DNT signals due to the absence of a universally accepted standard for how such signals should be interpreted and acted upon. We will continue to monitor developments in this area and may adjust our practices in the future if a consensus industry standard emerges.

9.1 Technical Security Measures

We employ industry-standard encryption protocols for data in transit (TLS 1.3) and data at rest (AES-256); multi-factor authentication for access to systems containing personal information; network segmentation and firewall protection; intrusion detection and prevention systems (IDS/IPS); regular automated vulnerability scanning and penetration testing; secure coding practices and code review processes; endpoint protection and anti-malware software; and comprehensive access logging and security information and event management (SIEM).

9.2 Administrative Security Measures

Our administrative safeguards include: documented information security policies and procedures reviewed annually; role-based access control enforced through the principle of least privilege; mandatory security awareness and data protection training for all personnel; background checks for employees and contractors with access to personal information; formal incident response and breach notification procedures; third-party vendor risk assessment and due diligence processes; and regular internal and external security audits.

9.3 Physical Security Measures

Physical safeguards include controlled access to facilities where personal information is stored or processed, 24/7 video surveillance at data processing locations, secure locking mechanisms on server rooms and file storage areas, visitor management and escort procedures, and secure disposal of physical media containing personal information through certified destruction services.

9.4 Breach Notification

In the event of a data breach involving personal information that poses a risk of harm to affected individuals, we will notify the relevant supervisory authorities and affected individuals without undue delay, in accordance with applicable legal requirements. Our notification will describe the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences of the breach, the measures we have taken or propose to take to address the breach and mitigate its effects, and contact information for obtaining further information. We maintain a breach response plan that is tested and updated annually.

10.1 Right to Access and Data Portability

You have the right to request confirmation as to whether we process your personal information and, where that is the case, to obtain access to that information along with details about the processing purposes, categories of data, recipients, and retention periods. Where technically feasible, you may also request a copy of your personal information in a structured, commonly used, and machine-readable format for transmission to another data controller.

10.2 Right to Rectification

You have the right to request the correction of inaccurate personal information we hold about you and to have incomplete personal information completed, including by means of providing a supplementary statement. We will make reasonable efforts to promptly update or correct any information you identify as inaccurate.

10.3 Right to Deletion

You have the right to request the deletion of your personal information under certain circumstances, such as when the information is no longer necessary for the purposes for which it was collected, when you withdraw consent and there is no other legal ground for processing, when you object to processing and there are no overriding legitimate grounds, or when the processing was unlawful. We will comply with valid deletion requests unless retention is required by law or necessary for the establishment, exercise, or defense of legal claims.

10.4 Right to Restrict Processing

You have the right to request the restriction of processing of your personal information in certain situations, including when you contest the accuracy of the information (for a period enabling us to verify accuracy), when the processing is unlawful but you oppose deletion and request restriction instead, when we no longer need the information but you require it for legal claims, or when you have objected to processing pending verification of whether our legitimate grounds override yours.

10.5 Right to Object to Processing

You have the right to object, on grounds relating to your particular situation, to processing of your personal information that is based on our legitimate interests. You also have the right to object to processing of your personal information for direct marketing purposes at any time; upon receiving such an objection, we will cease processing for direct marketing without undue delay.

10.6 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. Withdrawal of consent may limit our ability to provide certain Services that were contingent upon such consent.

10.7 Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. This means we will not deny you Services, charge you different prices, provide a different level or quality of Services, or suggest that you may receive a different price or quality of Services as a result of exercising your rights.

10.8 California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we have collected, used, disclosed, and sold (we do not sell personal information); the right to request deletion of personal information; the right to correct inaccurate personal information; and the right to limit the use and disclosure of sensitive personal information. To exercise these rights, please contact us using the information in Clause 14. We will verify your identity before processing your request, which may require you to provide additional information to confirm your identity and California residency.

10.9 Exercising Your Rights

To exercise any of the rights described in this clause, please submit a verifiable consumer request by email to mail@ximengthreads.lat, or by mail to Ximeng Clothing Inc., Attn: Privacy Officer, 877 E 100 N, Payson, Utah 84651-2346, United States. We will respond to your request within the timeframe required by applicable law, typically within 45 days. If we require an extension, we will notify you in writing within the initial response period. We may need to verify your identity as part of our response process.

11.1 Age Verification and Parental Consent

In cases where we become aware that a child under 16 has provided us with personal information, we will take immediate steps to delete such information from our records. We do not have a mechanism for age verification on our Website; accordingly, we rely on parents and guardians to supervise their children's online activities and to prevent minors from submitting personal information without permission.

11.2 COPPA Compliance

We comply with the requirements of the Children's Online Privacy Protection Act (COPPA) and other applicable laws governing the collection of personal information from children. If you are a parent or guardian and believe your child has provided us with personal information in violation of this policy, please contact us immediately using the contact details in Clause 14 so that we may promptly investigate and delete the information as appropriate.

12.1 Safeguards for International Transfers

When we transfer personal information from the European Economic Area (EEA), the United Kingdom, Switzerland, or other jurisdictions with cross-border data transfer restrictions to the United States, we implement appropriate safeguards to ensure an adequate level of protection for the transferred data. These safeguards may include the use of Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Agreement, or other legally recognized transfer mechanisms. You may request a copy of the specific safeguards we apply by contacting us using the details provided in Clause 14.

12.2 Consent to Transfer

By using our Website and Services and providing personal information to us, you acknowledge and consent to the transfer, storage, and processing of your information in the United States as described in this Privacy Policy. If you do not wish for your information to be transferred to the United States, you should not provide us with personal information or use our Services.

13.1 Links to External Sites

When you click on a link that directs you to a third-party website, the privacy policy of that third party will apply to any information you provide while on that site. We encourage you to review the privacy policies of all third-party websites you visit. Ximeng Threads assumes no responsibility or liability for the privacy practices, data collection, content, or security of any third-party websites.

13.2 Social Media and Embedded Content

Our Website may include social media features, such as sharing buttons or embedded content from platforms like LinkedIn, Twitter, or YouTube. These features may collect your IP address, which page you are visiting on our Website, and may set a cookie to enable the feature to function properly. Your interactions with these features are governed by the privacy policies of the companies providing them.

14.1 Contact Details

14.2 Response Time

We acknowledge receipt of all privacy-related inquiries within five business days and endeavor to provide a substantive response within 30 calendar days. If the resolution of your inquiry requires additional time, we will notify you of the delay and the expected timeline for our complete response.

14.3 Supervisory Authority Complaints

If you believe that our processing of your personal information violates applicable data protection law or that we have not adequately addressed your privacy concern, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. For residents of the European Economic Area, you may contact the supervisory authority in your country of residence or the lead supervisory authority where our European representative is established. For United States residents, you may contact the Federal Trade Commission (FTC) or your state's Attorney General office. We would, however, appreciate the opportunity to address your concerns directly before you escalate to a supervisory authority and encourage you to contact us first using the methods described above.

15.1 Notification of Changes

If we make material changes to this Privacy Policy, we will notify you by posting a prominent notice on our Website at least 30 days before the changes become effective, and where appropriate and legally required, we may send you a direct notification via email. The Last Updated date at the top of this page will be revised accordingly.

15.2 Review Responsibility

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information. Your continued use of our Website and Services after the effective date of any revised Privacy Policy constitutes your acknowledgment and acceptance of the updated terms. If you do not agree with the revised policy, you should discontinue use of our Website and Services and, where applicable, contact us to request deletion of your personal information.

15.3 Archived Versions

We maintain an archive of previous versions of this Privacy Policy. If you would like to review a prior version, please contact us using the information in Clause 14 and specify the effective date of the version you wish to review. We will provide archived versions upon request, subject to our reasonable administrative capacity to do so.