Privacy notice

This Privacy Notice describes how Blue Sky Cashmere LLC (“Blue Sky Cashmere”, “we”, “us”) collects, uses, and discloses personal information when you access or use our portal at portal.blueskycashmere.trade (the “Portal”). It applies to the Portal specifically. The privacy practices for our public storefront are described separately in the storefront privacy policy.

By using the Portal, you acknowledge that you have read this notice and understand how we handle your information.

Blue Sky Cashmere LLC is a vertically integrated Mongolian cashmere manufacturer (Reg. No. 5209811; State Reg. No. 9019032116). We operate the Portal for our staff, our trade clients and our production partners. For the purposes of UK and EU data-protection law, Blue Sky Cashmere LLC is the data controller of personal information processed through the Portal. Our registered office is SOR Building, 2nd Khoroo, Khan-Uul District, Ulaanbaatar, Mongolia.

Most people using the Portal are our own staff: on the factory floor, in the warehouses and in the office. This part is for you.

• What we keep about you: your name, username, role, and your language and display settings. Your password is stored scrambled, so nobody can read it, not even us. If you use two-step sign-in, we keep what is needed to check it.
• What you record: every step, count, check, take-out slip and message you enter is saved with your name and the time.
• Why: so we know who did each piece of work and when, can put mistakes right, and keep our production and stock records accurate.
• Who can see it: colleagues see your name, username and role, and who did the work on the orders and stock they handle. Only executives and Portal administrators see account details such as when you last signed in. A client sees your name only if you write to them in an order's messages.
• How long: your account stays while you work here. When you leave it is switched off, not deleted, because the work you recorded stays part of our production and stock history (see “How long we keep it” below).

If you have a question about your information, ask your manager or use the contact details at the end of this notice.

When we use the term “personal information,” we mean information that identifies or can reasonably be linked to you. For Portal users this is limited to:

• Account data: your name, work email, company, role, language and theme preferences, and the password you set. If you enable multi-factor authentication, we also store the metadata needed to verify your second factor.
• Order data: purchase orders, specifications, production milestones, shipping information, invoice records, and any provenance details we make available to you.
• Uploaded files: documents and message attachments you upload through the Portal.
• Communications: the content of messages, sample requests, and support enquiries you send us through the Portal or by email.
• Usage and access data: access logs (IP address, browser and device identifiers, timestamps, pages viewed) used to operate the service, detect misuse, and protect your account.

We do not run third-party advertising trackers or behavioural profiling. The Portal is a transactional service, not a marketing channel.

• Directly from you when you sign in, update your account settings, send a message, request a sample, or upload a file.
• From your account manager at Blue Sky Cashmere when they create your Portal account, record an order, share a document with your company, or post an update.
• Automatically from your device through standard web technologies (IP address, user agent, session cookies) when you access the Portal.

• To provide the Portal: authenticate you, show you the right orders and documents for your company, and send transactional notifications about your account and orders.
• To communicate with you: respond to messages, sample requests, and support enquiries.
• To keep the Portal secure: detect suspicious sign-ins, investigate potential fraud or abuse, enforce our terms, and protect the rights and safety of our users.
• To meet legal obligations: comply with applicable tax, accounting, and regulatory requirements, and respond to lawful requests from competent authorities.

We do not sell your personal information, and we do not share it with advertisers.

We rely on a small number of trusted service providers to operate the Portal. They process personal information only as needed to provide their service to us, under written confidentiality and security commitments:

• Supabase — database, authentication, file storage, and realtime services.
• Vercel — application hosting and content delivery.
• Resend — transactional email delivery (account invites, password resets, notifications).
• Sentry — error monitoring and diagnostics.
• Google (Gemini API) — reading the figures off a costing sheet. When a member of our team uploads a costing sheet, the photograph or PDF is sent whole, so whatever it contains — supplier and contact names, rates, and handwritten or typed notes — goes with it. We receive the extracted figures back. Nothing else is sent to this service.

We may also disclose personal information:

• With colleagues at your own company who have Portal accounts, so you can collaborate on an order.
• In connection with a corporate transaction such as a merger, acquisition, financing, or restructuring of our business.
• Where required by applicable law, to comply with valid legal process, or to protect our rights, the Portal, our users, or others.

Blue Sky Cashmere LLC is established in Mongolia (see “Who we are”), and our service providers operate globally. Personal information may therefore be transferred to, stored in, and processed in countries other than the one in which you live.

Where we transfer personal data out of the United Kingdom or the European Economic Area, we rely on the recognised safeguards in those laws — most commonly the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum — unless the destination country has been formally recognised as offering an adequate level of protection.

• Order records: for the life of our commercial relationship plus seven years, consistent with UK accounting requirements.
• Account data and uploaded files: for as long as your Portal account is active, and deleted within 30 days of a written request unless retention is legally required.
• Activity history: the record of who did what and when — each production step logged, each change to an order, and every change to warehouse stock and take-out slips — is kept permanently. It cannot be edited or deleted, because stock figures and production records are worked out from it.
• Failed sign-in attempts: for one day, to stop password guessing.
• Technical access logs kept by our hosting and monitoring providers: for the limited periods those providers set.

We protect your information with industry-standard measures including encrypted storage, encrypted transit (HTTPS / TLS), per-row access controls, and optional multi-factor authentication on your account. No system is perfectly secure, but we work to reduce risk and will notify affected users promptly in the event of a personal-data breach as required by law. We recommend that you choose a strong password, keep your second factor private, and avoid sharing your login credentials with anyone.

Depending on where you live, you may have some or all of the following rights in relation to your personal information. These rights are not absolute and may be limited by applicable law.

• Access: request a copy of the personal information we hold about you.
• Correct: ask us to correct information that is inaccurate or incomplete.
• Delete: request that we delete personal information we hold about you, subject to legal retention obligations.
• Portability: receive a structured copy of certain personal data and ask us to transfer it to another controller.
• Object or restrict: ask us to stop or limit how we process your information for certain purposes.
• Withdraw consent: where we rely on consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email b2b@blueskycashmere.trade. We will respond within 30 days. We may need to verify your identity before acting on a request. We will not retaliate against you for exercising your rights, and you can also lodge a complaint with the data-protection supervisory authority in the country where you live or work.

The Portal is intended for business use by our staff and trade clients and is not directed at children. We do not knowingly collect personal information from anyone under the age of majority in their jurisdiction.

We may update this Privacy Notice from time to time to reflect changes in our practices or in applicable law. When we do, we will update the “Last updated” date below and, for material changes, notify Portal users by email.

For privacy questions, requests, or complaints, email b2b@blueskycashmere.trade, call us at +976 9910 9463, or write to us at Blue Sky Cashmere LLC, SOR Building, 2nd Khoroo, Khan-Uul District, Ulaanbaatar, Mongolia. For the purposes of applicable data-protection law, Blue Sky Cashmere LLC is the data controller of your personal information.