The SHEIN website (“Site”) and mobile application (“App”) are provided by Infinite Styles Services Co., Limited (“ISSL”), which is the controller of the personal data collected and responsible for processing and protecting such personal data. In this Notice, the terms “SHEIN,” “Company”, “we”, “us” or “our” refer to ISSL.
This Privacy Notice ("Notice") explains how ISSL collects, uses, shares, and processes your Personal Data when you use or access the Site, App, or use any of our services, including any written, electronic, and oral, communication, online and offline, purchases performed, and any other related services we own (collectively the “Services”) . The Notice also describes your rights regarding your personal data and explains how you can contact us to learn more about our data practices or to exercise your rights.
Please read our Terms and Conditions and this Notice before accessing or using our Services. If you cannot agree with this Notice or the Terms and Conditions, please do not access or use our Services.
Changes to this Notice: SHEIN is required under Data Protection law to ensure that it processes personal data transparently. As the way in which we process personal data may change, we may be obliged to update this Notice accordingly from time to time, to reflect how we are processing your data, and if we make changes, we will notify you by revising the effective date or last modified date at the top of this Notice. If we make significant changes that materially affect your privacy rights, we will provide advanced notice and make that clear on the Site or App, or by some other means of contact such as email, so that you are able to review the changes before you continue to use the Services.
Other information: In addition, we may provide you with additional information about the personal data processing practices of specific parts of our Services, via other notices such as e.g. our Cookies Notice or the Terms and Conditions of certain promotions. Such notices may supplement this Notice or provide you with additional choices about how we process your personal information.
Click on the links below to go to a specific section of this Policy.
We respect the privacy of the visitors to our digital properties and the users of our products and services, and we are committed to protecting it through our compliance with this Notice. We process personal data when you provide it to us, when we collect it automatically, when it is generated by your use of our Services and when we receive it from other sources.
Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal data does not include data that has been effectively irreversibly anonymized or aggregated so that it can no longer enable us or others, whether in combination with other information or otherwise, to identify you.
“Processing” of personal data includes the collection, storage, analysis, accessing, sharing, transmitting and deletion of personal data.
Some of the personal data we collect from you is necessary for us to provide our Services, for example, we need your name and delivery address to ship your parcel and complete customs formalities and to manage returns, we may need your clothes or shoe size to complete your order, and we need your payment details to process your order. Without this information, we will be unable to enter into or perform our contract with you. The collection of other personal data about you, such as your style preferences or marketing consent, is entirely voluntary: declining to provide it to us will not prevent you from using our Services, though it may limit certain features such as personalised product recommendations.
As a global e-commerce platform, SHEIN sells products directly to customers and also connects customers across the European Economic Area with products offered by other international sellers. By using our Services, you benefit from the ability to purchase goods from sellers located outside your country of residence. To fulfil your order, including preparing and packaging your parcel, affixing the necessary shipping labels, completing import and export customs formalities, and delivering the parcel to your chosen address, your personal data will necessarily be transferred to and processed by parties located in other countries, including countries outside the European Economic Area. These transfers are an inherent and essential part of the international purchasing process, and by placing an order with us or with another seller via the Site, you acknowledge that such transfers are required to deliver the Services you have requested. We ensure that all such transfers are carried out in accordance with applicable data protection laws and subject to appropriate safeguards. You will find additional information regarding international data transfers in Section 9 of this Privacy Notice.
The table below sets out the categories of personal data about you that we process, the purpose for which each category is processed, the legal basis on which we rely for that processing, and information on our retention practices.
Personal Data Processed | Purpose | Legal Basis | Retention |
Your name and either an email address or phone number (you may provide both), plus a nickname and password, to register with our Site or App. |
| Necessary for the performance of a contract with us or another seller or to take steps at your request prior to entering into a contract with us or another seller. Necessary for compliance with a legal obligation. | For as long as your account remains active. You may close your account at any time. Deletion will occur within 5 days except where data is required to process any unfulfilled orders, resolve any unresolved matters, to complete our statutory or contractual obligations to you, or to satisfy legal obligations such as pending litigation and legal and regulatory filing obligations. |
Email address, phone number and WhatsApp contact details |
| Consent | For as long as you consent. |
|
| Consent (see note below regarding special category data) | Until or unless you remove these preferences from your account profile |
Activity on the site or app, including products browsed, purchased or added to wish lists. |
| For the Legitimate Interests of research and development of our services and products and of marketing of products. | For as long as your account remains active, plus a reasonable time thereafter to resolve any unresolved matters. You may close your account at any time. You may opt out of direct marketing and the Recommender System. |
Shipping information: name, postal address, phone number, order number. |
| Necessary for the performance of a contract or to take steps at your request prior to entering into a contract. | For as long as your SHEIN account remains active, plus a reasonable time thereafter to resolve any unresolved matters. You may close your account at any time. |
Transaction details: purchases, return and refund details, gift card number |
| Necessary for the performance of a contract or to take steps at your request prior to entering into a contract. | For as long as your account remains active, plus a reasonable time thereafter to resolve any unresolved matters. You may close your account at any time. |
Payment details – your credit or debit card details, gift card details, account credit, voucher and coupon details, billing address |
| Necessary for the performance of a contract or to take steps at your request prior to entering into a contract. | Retained subject to legal requirements and national laws regarding retention of financial records for tax compliance purposes |
| Necessary for compliance with a legal obligation. | Retained subject to the record keeping requirement imposed by the relevant legislation. | |
|
| Retained until conclusion of the legal or regulatory dispute and any subsequent appeals or reviews. | |
Purchase history |
| For the Legitimate Interest of research and development of our services and products. Our specific legitimate interest is in understanding customer purchasing behaviour to improve product curation, range planning, and the relevance of recommendations. We have assessed that this interest is not overridden by customer privacy interests, given that: (i) analysis is principally conducted at an aggregated level; (ii) data is not shared with external parties for this specific purpose; and (iii) customers may close their account at any time and object to this processing. |
|
Location of your IP address |
| For the Legitimate Interest of providing an optimised user experience for the website and app. Our specific legitimate interest is in directing users to the correct regional store, language, and pricing environment, and in providing accurate estimated delivery times. This processing relies only on IP-level location (not precise geolocation), is limited to the duration of the user session, and is necessary for the basic operation of a global ecommerce platform. | For the duration of your session on the app or website. |
Your communications with us via various channels, such as email, phone, social media, mail, instant chat, and our customer service platform. |
| The Legitimate Interest of providing customer service and account administration. Our specific legitimate interest is in maintaining accurate records of customer communications to resolve queries and disputes, ensure service continuity, and fulfil our contractual obligations to you. We consider this interest proportionate, given that records are retained only for the period of account activity and a reasonable period thereafter, and that customers retain the right to object. | For as long as your account remains active, plus a reasonable time thereafter to resolve any unresolved matters. You may close your account at any time. |
| The Legitimate Interest of engaging with Regulatory Agencies and defending our Legal Interests. Our specific legitimate interest is in preserving evidence and maintaining records necessary to respond to legal claims, regulatory investigations, and enforcement actions. This interest is proportionate, as retention is strictly limited to the duration of the relevant proceedings and any subsequent appeals. | Retained until conclusion of the legal or regulatory dispute and any subsequent appeals or reviews. | |
Your Device Information, browser type, operating system, account setting information and login data. |
| For the Legitimate Interest of securing your account and our site and app, and providing an optimised user experience. Our specific legitimate interest is in detecting and preventing fraudulent activity, unauthorised access, and security threats, in order to protect both our customers and the integrity of our platform. This processing is necessary for the secure operation of any largescale e-commerce service and is proportionate to the security risks involved. | For as long as your account remains active, plus a reasonable time thereafter to resolve any unresolved matters. You may close your account at any time. |
Biometric Authentication Enrollment Status |
We use this information, together with other device and account signals, to detect suspicious activity, prevent fraud, protect customer accounts, and maintain the security and integrity of our services. | We process this device security information for our legitimate interests in preventing fraud, protecting our users, enforcing our terms, safeguarding our platform, and maintaining the security of our services. | For as long as your account remains active, plus a reasonable time thereafter to resolve any unresolved matters. You may close your account at any time. |
Your product Reviews, which may include photos of you. |
| Consent. | For as long as you consent. You may remove a review at any time. |
Your photographic image and, where necessary proofs of your identity. These are processed by a third party and only the positive or negative result of the age check is returned to SHEIN. | To conduct age assurance prior to allowing you to view or purchase certain products, where such restriction to adults is required under the EU Digital Services Act and other applicable national laws. | For compliance with legal obligations. | For as long as is required to conduct the age verification process, with instant deletion of the data thereafter. |
Customer-service chat content (de-identified before AI review) | Quality assessment of customer-service interactions; training AI quality models; improving accuracy of service-quality evaluations | Legitimate Interests. Our specific legitimate interest is in maintaining and continuously improving the quality, accuracy, and consistency of our customer service operations, including through the use of AIassisted quality assessment tools. We have assessed that this interest is not overridden by customer privacy interests, given that: (i) chat content is de-identified before any AI or human review; (ii) personal identifiers are removed prior to processing; and (iii) customers may object to this processing at any time. | Stored only as long as necessary for quality-assessment cycles; AI training data stored in deidentified form; user can object at any time |
1.1 Note on special category personal data:
Where your style preferences include maternity wear, the processing of such data may constitute processing of special category personal data under Article 9 GDPR. In addition to your consent under Article 6(1)(a) GDPR, we rely on your explicit consent under Article 9(2)(a) GDPR for this processing. You may withdraw your explicit consent at any time by removing the relevant preferences from your account profile. If you decline to provide this information, we will not be able to offer maternity-related product recommendations.
Please note: When communicating with us by email or through forms on our Services, or when you publicly share content through our Services, we ask that you please do not send us any sensitive information pertaining to yourself or to others.
SHEIN sends direct marketing via e-mail, SMS, WhatsApp message and push notification. As required under the relevant laws, direct marketing is not sent to you unless you have given your prior consent.
This consent may be given by you via the website or app at account signup or at a later time through the use of the website or app.
You may withdraw your consent at any time, and SHEIN will take steps to ensure you no longer receive direct marketing via that channel. If you withdraw your consent for only one channel, you may continue to receive direct marketing via other channels, until you also withdraw consent for that channel.
Please be aware that there may be a brief delay before your marketing consent status is updated and that you may continue to receive direct marketing messages during that time.
To change your consent status for any of our Direct Marketing Channels, go to your account profile and you will find “Contact Preferences” under the “Other Services” subheading. There you can give or withdraw consent to each type of Direct Marketing.
To stop receiving Direct Marketing via email, you may also click “unsubscribe” at the bottom of any marketing email. Please note that some emails from SHEIN may not contain direct marketing and therefore may not contain an “unsubscribe” link.
If you choose not to consent to receiving Direct Marketing from SHEIN you may still receive service messages from us. These are essential messages giving you important information about your account and purchases.
Message and data rates may apply to all messages sent to and from you. If you have any questions about your telephone package, it is best to contact your mobile operator.
When you provide an email, phone number or WhatsApp contact to us you should ensure that it is your own and that it is correct. Providing the contact details of another person, whether deliberately or inadvertently, may lead to your private account details being disclosed to the true owner of the contact details. In order to protect your account and to avoid inconvenience to third parties, we may be obliged to suspend your account if it appears that the contact details associated with it are not those of the account owner.
SHEIN may also contact you, either for direct marketing or for other purposes, via notifications from the app. You can make changes to how you receive these notifications via the settings on your smart device.
When you buy a product from our service, we ask you to complete a review. This is to assist other users who may be considering buying the same product. Although we reward customers with points for posting reviews, whether you do so is entirely at your own discretion, and you may remove your reviews at any time.
You should be aware that your reviews will be accessible to all users of the site. If you post a photograph with the review, you should be aware that you or your surroundings may be recognisable from the photo.
If you post an image of a third party, including your children, you should first obtain their consent to do so. You should be aware that they may have the right to have the photo removed under applicable law, including Data Protection law. If a third party asks you to remove a photo of them that you have posted, we recommend that you do so. Use of Customer Service Chats for Quality Assessment and Training of AI Models
1.4 Customer Service Chat Quality Assessment:
When you contact our customer-service team through chat, we process the content of your communications to provide assistance and resolve your queries. In addition, we also use de-identified versions of these chat interactions to assess the quality and accuracy of responses provided by our customer-service representatives. This assessment is carried out using both human review and AI-powered quality assessment tools. These tools help us measure service quality, identify areas for improvement, and train our internal service-quality models.
1.5 Legal Basis:
We process de-identified chat content for these quality-improvement purposes based on our legitimate interest in maintaining and improving the quality of our customer-service operations, ensuring consistent service standards, and enhancing your experience. You may exercise your right to object to this processing at any time.
1.6 Human Review:
Certain chat transcripts may also be reviewed by trained customer-service personnel located in specific jurisdictions (including China and the Philippines) for the purpose of validating AI outputs and ensuring quality accuracy. Access is strictly controlled and subject to data-minimisation and confidentiality safeguards. For further information on International transfers of personal data, please see Section 9.
1.7 De-Identification Measures:
Before any chat is used for AI analysis, we remove personal identifiers such as your name, phone number, address, email, order numbers, and any other identifiable elements. We continuously monitor and improve our de-identification processes.
1.8 Your Options:
You may choose to opt out of having your chat content used for these quality-assessment purposes. If you opt out, your chat records will not be processed for AI or manual qualitycontrol activities.
We may disclose and share your Personal Data with the parties as described below.
A. Within Our Corporate Organization. ISSL is a part of a corporate organization that has several legal entities, business processes, management structures, and technical systems. These entities provide services to each other and the provision of such services may require the processing of personal data. We may share your personal data with our related group companies and, in some cases, other affiliates of our corporate group for business maintenance and personalization continuity purposes, for instance, so that you may enjoy a personalized user experience across our digital properties, to provide you with the Services, or to take actions based on your requests or preferences.
B. Third Party Sellers. Our Website and App is a Marketplace, where other sellers,including sellers from the SHEIN group, sell products. When you purchase from a third-party seller on our Site and App and the third-party seller will ship the products to you directly, we will share your personal data (user ID, name, email address and other contact and shipping information) with them so that they may respond to you or fulfil your order and provide your personal data to their service providers in order to ship the products to you. Independently from us, the third-party seller is the controller of such personal data and responsible for any processing that they perform after we have shared this personal data with them, including compliance with any limitations imposed by our agreement with them.
C. Service Providers. We may share your personal data with the following types of third-party service providers as set out in the table below:
Supplier/Service Provider/Processor | Services Offered |
IT system and software service provider | Website hosting services (including cloud storage), mobile app or software optimization services, customer relationship management software, email service providers, or system maintenance services. |
Payment service provider | Third-party payment processing services. |
Marketing and advertising services | Assistance in reaching potential new customers across multiple communications channels, or sharing with affiliated companies that promote our products on their websites. |
Order fulfillment service provider | Provision of logistics, warehousing and distribution services, return and exchange services, and order status notification services for your purchased items. |
Customer service provider | Assistance with customer services and support. |
Fraud prevention and information security service provider | Identity verification, fraud prevention, or credit risk reduction services to protect our website/app and our business. |
Professional Advisors | Including lawyers, consultants and accountants and other providers of expert advice. |
Other Service providers selected by you | Other third parties, such as size recommendations and fit prediction services providers, if you have chosen to help us provide you with product recommendations. |
AI Quality-Assessment Service Providers: We use third-party AI providers, including ChatGPT, to assist with automated analysis of de-identified customer-service chat content. These providers process only de-identified text, and we take steps to ensure that the information we share does not contain personal identifiers.
We strive to ensure that our third-party service providers can only use your data for the contractual purposes for which it was provided to them and to the extent necessary for such purposes, in accordance with our written instructions (where they act as our data processors).
D. To Maintain Legal and Regulatory Compliance. We have the right to disclose your personal data for compliance with a legal obligation, or when we believe that disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, request from a regulator, or any other legal process served on us. We also may disclose your information where we reasonably believe that the disclosure is necessary to enforce our agreements or policies, or if we believe that disclosure will help us protect the rights, property, or safety of the Company or our customers.
E. Co-Branded Services and Features. Portions of our Services may be offered as part of co-branded services and features. We will share your personal information with our co-branded partners based on your voluntary use of or participation in a co-branded service or feature. The co-branded partners will be identified on the co-branded feature or service, along with an applicable co-branded partner's privacy policy. Use of your personal information by a co-branded partner will be subject to a co-branded partner’s privacy policy. If you wish to opt-out of a cobranded partner’s future use of your personal information, you will need to contact the co-branded partner directly.
F. Consent. We may disclose your personal information for any purpose with your consent.
G. Corporate Transactions. We may disclose personal information—including account information, Wallet balance or points information—to a buyer, prospective buyer, corporate affiliate, or other successor based on our legitimate interests in the event of a merger, divestiture, restructuring, reorganization, dissolution, or sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding in which personal information held by us about our Services users is among the assets transferred. You acknowledge and agree to our assignment or transfer of rights to your personal information.
Please note that we may disclose, without restriction, aggregated or anonymized information about the users of our Services, which is information that does not identify any specific individual.
3.1 What are cookies?
A cookie is a small text file that a website stores on your computer or mobile device when you visit the site.
First party cookies are cookies set by the website you’re visiting. Only that website can read them.
In addition, a website might potentially use external services, which also set their own cookies, known as third-party cookies.
Persistent cookies are cookies saved on your computer and that are not deleted automatically when you quit your browser.
Session cookies are deleted when you quit your browser.
When you visit our websites for the first time, you will be prompted to accept or refuse cookies. The purpose is to enable the site to remember your preferences (such as user name, language, etc.) for a certain period of time. That way, you don’t have to re-enter them when browsing around the site during the same visit. You can change your preferences at any time by clicking on the “manage cookies” link at the bottom of every page or delete cookies using the tool provided by your browser.
Cookies can also be used to establish anonymised statistics about the browsing experience on our sites.
3.2 How can you control SHEIN’s use of cookies?
When you land on our website, you will be presented with a cookie management tool, which asks for your consent to deploy several types of cookies. You can use this tool to give or withdraw your consent to the use of these cookies. If you do not make a choice using the tool, the website will deploy only strictly necessary cookies (see below).
If you wish to change the preference you made via the cookie management tool, you should click on “manage cookies” at the bottom of the web page. This will recall the cookie management tool for you to make new choices.
3.3 How do we use cookies?
Currently, there are five types of cookies that may be generated as you browse our site:
Strictly Necessary Cookies, Performance Cookies, Functional Cookies, Targeting Cookies and Social Media Cookies
A. Strictly Necessary Cookies.
B. Performance Cookies
These cookies collect information about how you use a website, like which pages you visited and which links you clicked on. None of this information can be used to identify you. It is all aggregated and, therefore, anonymized. Their sole purpose is to improve website functions. This includes cookies from third-party analytics services as long as the cookies are for the exclusive use of the owner of the website visited.
Statistical information is used in reports and to improve our site. For example, we have used analytics data to add, remove or change features of the site based on how popular they are with users.
We track, for example:
C. Functional cookies.
D. Targeting cookies.
E. Social Media Cookies.
You can delete all cookies that are already on your device using the settings in your browser. This will remove all cookies from all websites you have visited. Be aware though that you may also lose some saved information (e.g. saved login details, site preferences).
Be aware though that you may also lose some saved information (e.g. saved login details, site preferences).
In addition to using the cookie management tool, you can set most modern browsers to prevent any cookies being placed on your device, but you may then have to manually adjust some preferences every time you visit a site/page, and some services and functionalities may not work properly at all (e.g. profile logging-in).
We may use third-party service providers to monitor and analyse the use of our Services. Presently, we use Google Analytics. Google Analytics is a web analytics service that tracks and reports Site traffic. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy?hl=en. Google Analytics Opt-out Browser Add-on provides visitors with the ability to prevent their data from being collected and used by Google Analytics, available at: https://tools.google.com/dlpage/gaoptout
If Google Analytics is structured to collect personal data, the cookie banner on our Site will provide you the opportunity to consent to Google Analytics and the data controller will be Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. We have implemented Google Analytics with the “AnonymizeIP” function, which makes sure that your IP address will be shortened before it is sent to servers in the U.S. Exceptionally, the shortening may take place after such transfer to the U.S. Google uses this data to evaluate your use of our Services, to compile reports on activities on our online services and to provide us with other services related to Site, App and internet use.
We also use remarketing services to advertise on third-party websites to you after you visited our Services. For this purpose, visitors are grouped by certain actions on our Services, e.g., by the duration of a visit. This enables us to understand your preferences and to show you personalized advertising even if you are currently surfing on another website that also participates in the Google advertising network.
We use the following tools and services for these purposes: Google Ads remarketing service is provided by Google. Where required by law, we obtain your consent via the Cookie Banner. You can opt-out of this by visiting the Google Ads Settings page: https://www.google.com/settings/ads.
If Google Ads is structured to collect personal data, the data controller will be Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
Bing Ads is a service operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Please read Microsoft’s privacy statement for more information on how Microsoft processes your information https://privacy.microsoft.com/en-US/. When you access our Site via advertisements on Bing Ads, a cookie is set on your computer. In addition, a Universal Event Tracking tag is integrated on our Site. This is a code that, in combination with the cookie, stores data about the use of the Site, e.g. length of time spent on the Site, areas accessed, and ads used to reach the Site. In addition, Microsoft may track your usage patterns across multiple of your electronic devices through so-called cross-device tracking. The information collected is transferred to a Microsoft server in the United States. If Bing Ads is structured to collect personal data, the cookie banner on our Services will provide you the opportunity to consent to Bing Ads.
Facebook Ads. Using Facebook Business Tools, we may show you interest-based ads when you use Facebook. Where required, we obtain your consent via the Cookie Banner before the processing starts. To change your preferences or opt out of personalization for ads served by Facebook, you can visit Facebook Ads Preferencesin addition to the Your Choices section below. We may also show ads to audiences who share similar characteristics to yours. To this end, a list of email addresses is irreversibly hashed and encrypted and uploaded or transmitted from our site, and Facebook compares the hashed data with its users, generating a lookalike audience and deleting the uploaded list. We don't have access to the identity of anyone in the "lookalike" audience, unless they choose to click on one of our ads.
We may also use Tracking Technologies to collect "clickstream" data, such as the domain name of the service providing you with Internet access, your device type, IP address used to connect your computer to the Internet, your browser type and version, operating system and platform, the average time spent on our Site, webpages viewed, content searched for, access times and other relevant statistics, and assign unique identifiers to the device or other credentials you use to access the Site for the same purposes.
Pages of our Site may also use Java scripts, which are code snippets embedded in various parts of websites and applications that facilitate a variety of operations including accelerating the refresh speed of certain functionality or monitoring usage of various online components; entity tags, which are HTTP code mechanisms that allow portions of websites to be stored or “cached” within your browser to accelerate website performance; and HTML5 local storage, which allows data from websites to be stored or “cached” within your browser to store and more quickly retrieve data in HTML5 pages when the website is revisited.
You may be able to adjust the settings of your device so that information about your physical location is not sent to us or third parties by (a) disabling location services within the device settings; or (b) denying certain websites or mobile applications permission to access location information by changing the relevant preferences and permissions in your mobile device or browser settings.
We maintain reasonable physical, electronic, and procedural safeguards designed to guard your personal data from unauthorised processing, use or disclosure. Our security measures include industry-standard physical, technical, and administrative measures to prevent unauthorised access to or disclosure of your information. We also require our service providers to provide privacy and security controls to protect data shared with them in order to perform services.
The Internet is not an absolutely secure environment, and we cannot guarantee that your personal data will be secure. We therefore strongly recommend that you use a unique, complex password to help us ensure the security of your account. We also strongly recommend that you do not share your password with others or re-use passwords on our Services that you use on other sites or apps, as doing so increases the likelihood of your being the victim of a credential stuffing attack or other malicious cyber behavior. If you feel that the security of your account or personal data has been compromised, please immediately contact us at our dedicated Privacy Centeror as otherwise described in the "Contact Us" section below.
You have certain rights relating to processing of your personal data. These rights include:
5.1 Right to Information
You have the right to certain information relating to processing of your personal data by us. This Privacy Notice, along with other relevant publicly available documents, provides this information.
You have the right to obtain a copy of personal data which we may hold about you. You should note that we are bound to retain data for no longer than is necessary, and that certain data may therefore have been deleted by the time a request for access is made, in line with the retention practices outlined in this notice.
5.3 Right to Rectification
You have the right to have any inaccurate personal data corrected or updated.
You have the right to have your data deleted when it is no longer required by us for a lawful purpose, as outlined in this Notice. Where data still needs to be kept, e.g., for a legal obligation or for legitimate business purposes the Right to Erasure does not yet apply.
You have the right to have processing of data restricted;
You have the right to obtain a copy of certain personal data in a commonly used, machine readable format. This right is limited to data which;
We provide such personal data in Excel Spreadsheet format.
You have the right to object to the processing of your personal data which is done for the purposes of a legitimate interest or in the public interest or in exercise of official authority vested in us as data controller. Where you object, we must either demonstrate compelling legitimate grounds for the processing, or cease it.
You have the right to object to processing for direct marketing purposes. This right can be exercised by opting out of direct marketing using the means provided.
You have the right to object at any time to the use of your customer-service chat content for our service-quality assessment, including processing carried out by AI or human reviewers for training and quality-improvement purposes. If you object, we will stop processing your chat content for these purposes and will exclude your data from our quality-control workflows.
Where we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to your withdrawal, nor does it affect processing carried out on a different legal basis. We do our best to make withdrawing your consent as easy as giving it, and we continually seek to implement and improve the technical mechanisms available to you for this purposeas technology evolves. The mechanisms currently available are described in the relevant sections of this Notice.
SHEIN notes that where it conducts Age Assurance prior to allowing you to access or purchase certain products where such restriction to adults is required under the EU Digital Services Act and other applicable national laws, that this processing may constitute Automated Decision Making. Because this processing is authorised by EU Member State law, the requirement to provide the opportunity to obtain human intervention, to express your point of view and to contest the decision is not applicable. Further information regarding this processing will be provided to you prior to it occurring.
Where other decisions are made based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you, you will be notified of the outcome and given the opportunity to obtain human intervention by SHEIN, to express your point of view and to contest the decision. In particular, SHEIN may use automated decision-making to suspend or restrict your account where our systems detect unusual activity or a high rate of product returns. For example, where your return history significantly exceeds normal patterns, automated systems may restrict your ability to make further returns or, in certain cases, suspend your account in accordance with our Fair Use Policy for Returns. Because such decisions may significantly affect your access to our Services, you have the right to obtain human intervention, to express your point of view, and to contest the decision by contacting us through our Privacy Center or as described in the "Contact Us" section below. In addition, our product recommendation features use automated profiling based on your browsing activity, purchase history, stated preferences, and (where provided) Kid's Profile information. This profiling does not produce legal effects but is used to personalise the products displayed to you. The key inputs used are your on-platform activity and voluntary preferences; the output is a ranked selection of products presented to you. This processing does not constitute decisionmaking under Article 22 GDPR. You may limit this personalisation at any time by adjusting your account preferences or by exercising your right to object as described in Section 6.7 of this Notice.
To exercise your rights, you may make updates within your customer account on the Site or App, or you may contact us through our dedicated Privacy Center.
In some cases we may require additional information from you to help us identify the data you require. We may request that you provide additional information necessary to confirm your identity as the Data Subject, where there is a reasonable doubt in this regard. In the case of certain manifestly unfounded or excessive requests, we reserve the right to decline a request or to charge a reasonable administrative fee.
We will respond to your request within one month of receiving it. Where requests are complex or numerous, we may extend this period by a further two months (three months in total). In such cases we will notify you of any such extension within one month of receipt of the request, together with the reasons for the extension.
You should be aware that all of the above rights are subject to certain restrictions and limitations. Where such a restriction or limitation applies to one of your requests, we will notify you.
If you believe we have infringed or violated your privacy rights, please contact us at our dedicated Privacy Center so that we may attempt to resolve any issues to your satisfaction.
Under GDPR you also have the right to lodge a complaint or raise a concern with a Data Protection Supervisory Authority. ISSL is established in Ireland and the lead supervisory authority for the purposes of supervision of compliance with the GDPR is the Irish Data Protection Commission (details below). However, if you are located in another EU Member State, you may also lodge a complaint with the supervisory authority in your country of residence.
The Data Protection Commission
6 Pembroke Row
Dublin 2
D02 X963
Ireland www.dataprotection.ie
With respect to your personal data processed by a third party seller on our Site and App as an independent controller, to exercise your rights under the applicable law, you may contact the third party seller directly.
We will retain your personal Data, including any correspondence you have with us, only for as long as is necessary for the purposes set out in this Notice, including retaining Personal Data in order to comply with our legal obligations, to resolve disputes, for information security purposes, and to enforce our legal rights, terms, and policies.
Our App or Site may contain links to third-party sites. This Notice does not apply to those third-party sites. We recommend that you read the privacy statements of any other sites that you visit as we are not responsible for the privacy practices of those sites.
In order to use this site you must be at least 18 years old. SHEIN doesn’t sell products for purchase by children. We may sell children's products for purchase by adults. If you're under 18, you may use SHEIN only with the involvement of a parent or guardian.
If you are under 18, SHEIN may process some of your personal data:
Product reviews: A parent or other adult who buys an item for you may take a photo of you and post it as part of a review of that product. Parents are advised not to post photos where the child’s face is identifiable.
My Kid’s Profiles: If you shop for a child, you can add a Kids' Profile to your existing account to receive personalized product recommendations. We do not intend to collect personal information about children, to set up the profile, we only ask for the child's approximate age (month and year of birth) and gender. You will be asked to create a nickname for the profile; we recommend you do not use the child's real name. The profile is visible to you only.
You can update or delete your Kids' Profile at any time through your account settings. The Kids' Profile exists solely within your own account and is intended only to help us show you product recommendations that may be suitable for the child you shop for. It is not designed to collect, store, or process personal data relating to the child beyond the limited information described above.
This profile will only be visible to the person who creates it.
When you place an order with us, we need to share certain information about you with our affiliated SHEIN Group companies, trusted service providers, logistics partners, carriers and other business partners so that we can process, prepare, ship and deliver your order. For example, your name, delivery address and other order details may need to be shared so that a shipping label can be printed, customs formalities can be completed (where applicable), your parcel can be handled by warehouses and delivery providers, and customer support can assist you if needed. Section 2 of this Notice deals with disclosures of your personal data in greater detail.
Because we operate a global business, some of the companies to which your personal data is disclosed are located, or access your personal data, outside the European Economic Area (“EEA”), including in China, Colombia, Egypt, Morroco, Indonesia, Philippines, Singapore or the US. The purposes of these transfers vary depending on the processing activity carried out on your personal data and the personal data needed for that service. For example, certain transfers to locations outside of the EEA may be necessary to process, prepare, ship and deliver your order, manage returns, provide customer support, support fraud prevention and risk management functions and to otherwise provide our Services and to perform our contractual obligations, while other transfers may relate other purposes described in this Notice.
The types of recipients of your personal data located outside the EEA, or accessing your personal data from outside the EEA, are described in Section 2 of this Notice, dealing with disclosures to third parties.
Whenever we transfer your personal data internationally, we take appropriate steps to protect it. Where an adequacy decision of the European Commission applies to the destination country to which your personal data may be transferred, we rely on that decision as the transfer mechanism. Where there is no adequacy decision of the European Commission, where required under the GDPR, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the primary transfer mechanism. Where we rely on SCCs for transfers to countries that are not covered by an adequacy decision, we assess whether the law and practices of the destination country may affect the effectiveness of those safeguards, and we implement supplementary measures where necessary. A copy of the applicable SCCs or a summary of the safeguards in place can be obtained by contacting us at privacy@sheingroup.com.
If you would like more information about the countries to which your personal data may be transferred or the safeguards we apply, please contact us using the details in Section10 (Contact Us) below.
If you have questions or concerns regarding any information in this Privacy Notice, please contact us at our dedicated Privacy Center.
Our EU Data Protection Officer can be contacted via the email address below or via our postal address below in writing:
Data Protection Officer
Infinite Styles Services Co. Limited
The Sidings,
4th Floor
Grand Canal Quay
Dublin 2,
D04 E7K8,
Ireland,
Email: privacy@sheingroup.com