Privacy notice

This Privacy Notice describes how Blue Sky Cashmere LLC (“Blue Sky Cashmere”, “we”, “us”) collects, uses, and discloses personal information when you access or use our client portal at portal.blueskycashmere.trade(the “Portal”). It applies to the Portal specifically. The privacy practices for our public storefront are described separately in the storefront privacy policy.

By using the Portal, you acknowledge that you have read this notice and understand how we handle your information.

Blue Sky Cashmere LLC is a vertically integrated Mongolian cashmere manufacturer (Reg. No. 5209811; State Reg. No. 9019032116). We operate the Portal for our trade clients and production partners. For the purposes of UK and EU data-protection law, Blue Sky Cashmere LLC is the data controller of personal information processed through the Portal. Our registered office is SOR Building, 2nd Khoroo, Khan-Uul District, Ulaanbaatar, Mongolia.

When we use the term “personal information,” we mean information that identifies or can reasonably be linked to you. For Portal users this is limited to:

• Account data: your name, work email, company, role, language and theme preferences, and the password you set. If you enable multi-factor authentication, we also store the metadata needed to verify your second factor.
• Order data: purchase orders, specifications, production milestones, shipping information, invoice records, and any provenance details we make available to you.
• Uploaded files: documents and message attachments you upload through the Portal.
• Communications: the content of messages, sample requests, and support enquiries you send us through the Portal or by email.
• Usage and access data: access logs (IP address, browser and device identifiers, timestamps, pages viewed) used to operate the service, detect misuse, and protect your account.

We do not run third-party advertising trackers or behavioural profiling. The Portal is a transactional service, not a marketing channel.

• Directly from you when you sign in, update your account settings, send a message, request a sample, or upload a file.
• From your account manager at Blue Sky Cashmere when they create your Portal account, record an order, share a document with your company, or post an update.
• Automatically from your device through standard web technologies (IP address, user agent, session cookies) when you access the Portal.

• To provide the Portal: authenticate you, show you the right orders and documents for your company, send transactional notifications about your account and orders, and generate AI-assisted summaries to help you scan an order quickly.
• To communicate with you: respond to messages, sample requests, and support enquiries.
• To keep the Portal secure: detect suspicious sign-ins, investigate potential fraud or abuse, enforce our terms, and protect the rights and safety of our users.
• To meet legal obligations: comply with applicable tax, accounting, and regulatory requirements, and respond to lawful requests from competent authorities.

We do not sell your personal information, and we do not share it with advertisers.

We rely on a small number of trusted service providers to operate the Portal. They process personal information only as needed to provide their service to us, under written confidentiality and security commitments:

• Supabase— database, authentication, file storage, and realtime services.
• Vercel— application hosting and content delivery.
• Resend— transactional email delivery (account invites, password resets, notifications).
• Sentry— error monitoring and diagnostics.
• Google (Gemini API)— AI-generated order summaries. We send the order text to be summarised and receive the summary back. We do not include personal identifiers in these requests beyond what is needed to describe the order itself.

We may also disclose personal information:

• With colleagues at your own company who have Portal accounts, so you can collaborate on an order.
• In connection with a corporate transaction such as a merger, acquisition, financing, or restructuring of our business.
• Where required by applicable law, to comply with valid legal process, or to protect our rights, the Portal, our users, or others.

Blue Sky Cashmere is based in Hong Kong, and our service providers operate globally. Personal information may therefore be transferred to, stored in, and processed in countries other than the one in which you live.

Where we transfer personal data out of the United Kingdom or the European Economic Area, we rely on the recognised safeguards in those laws — most commonly the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum — unless the destination country has been formally recognised as offering an adequate level of protection.

• Order records: for the life of our commercial relationship plus seven years, consistent with UK accounting requirements.
• Account data and uploaded files: for as long as your Portal account is active, and deleted within 30 days of a written request unless retention is legally required.
• Access and audit logs: for up to 12 months, for security and dispute-resolution purposes.

We protect your information with industry-standard measures including encrypted storage, encrypted transit (HTTPS / TLS), per-row access controls, and optional multi-factor authentication on your account. No system is perfectly secure, but we work to reduce risk and will notify affected users promptly in the event of a personal-data breach as required by law. We recommend that you choose a strong password, keep your second factor private, and avoid sharing your login credentials with anyone.

Depending on where you live, you may have some or all of the following rights in relation to your personal information. These rights are not absolute and may be limited by applicable law.

• Access: request a copy of the personal information we hold about you.
• Correct: ask us to correct information that is inaccurate or incomplete.
• Delete: request that we delete personal information we hold about you, subject to legal retention obligations.
• Portability: receive a structured copy of certain personal data and ask us to transfer it to another controller.
• Object or restrict: ask us to stop or limit how we process your information for certain purposes.
• Withdraw consent: where we rely on consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email blueskycashmere.store@gmail.com. We will respond within 30 days. We may need to verify your identity before acting on a request. We will not retaliate against you for exercising your rights, and you can also lodge a complaint with the data-protection supervisory authority in the country where you live or work.

The Portal is intended for business use by trade clients and is not directed at children. We do not knowingly collect personal information from anyone under the age of majority in their jurisdiction.

We may update this Privacy Notice from time to time to reflect changes in our practices or in applicable law. When we do, we will update the “Last updated” date below and, for material changes, notify Portal users by email.

For privacy questions, requests, or complaints, email blueskycashmere.store@gmail.com, call us at +976 9910 9463, or write to us at Blue Sky Cashmere LLC, SOR Building, 2nd Khoroo, Khan-Uul District, Ulaanbaatar, Mongolia. For the purposes of applicable data-protection law, Blue Sky Cashmere LLC is the data controller of your personal information.