Privacy Policy

This policy explains how we collect, use, store and protect your personal data under the Personal Data (Privacy) Ordinance (Cap. 486, Hong Kong). 1. What we collect Account data (name, email, hashed password, optional phone and birthday, language and currency preference); transaction data (order details, amounts, payment status, delivery address and recipient details, support conversations); technical data (IP address, browser and device information, pages and products viewed, referral source); marketing preference (whether you consented, and when you subscribed or unsubscribed). 2. Why we use it To process and deliver orders, provide customer service and after-sales support, run membership points and offers, keep the site secure (anti-abuse and fraud prevention), measure traffic and advertising performance, and — only with your consent — send you promotions. 3. Who we share with (to deliver the service) Payment providers (cards via Stripe / PayDollar / QFPAY / KPay, PayMe, AlipayHK, FPS, Octopus, PayPal, depending on your choice; we do not store your full card number); couriers (SF Express, Hongkong Post) for delivery and tracking; service providers for email/SMS delivery, Google Analytics and Meta for notifications, statistics and ad measurement. We do not sell your personal data or give it to unrelated third parties except as required by law or for the purposes above. 4. Cookies and tracking Essential cookies keep you logged in and remember your cart, language and currency; when enabled we also use analytics and advertising cookies (e.g. Google Analytics 4, Meta Pixel). You may disable cookies in your browser, but cart and checkout may not work properly. 5. Direct marketing We only use your email or phone for promotions with your consent. Every marketing message includes one-click unsubscribe; afterwards you will not receive promotions (transactional notices such as orders, shipping and refunds are unaffected). 6. Retention Account data until you delete your account or stop using the service; order and transaction records as required for accounting and tax; login and operation logs for a limited period then deleted automatically; system backups rotate (currently around 14 days). 7. Your rights You may access, correct or request deletion of your personal data and object to direct marketing — request deletion in "My Account" or contact us via "Contact us". 8. Security and cross-border processing Hashed passwords, encrypted transmission, role-based admin access with audit logs and regular backups. Our systems are hosted on our cloud infrastructure; some providers may process data outside Hong Kong under contractual and legal safeguards. 9. Updates and contact We may update this policy and will publish the updated version on this page. For any privacy enquiry, please contact our customer service. Company name / address / business registration number: to be filled in the admin. 11. Requesting access and response time — To access or obtain a copy of your personal data, please write to us via "Contact us" with your name, contact details and the scope of data required. We will normally respond within 40 days; a reasonable fee may be charged for handling a data access request (we will tell you in advance where applicable). If you believe your data has been mishandled you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong. Last updated: 12 September 2026 (revised whenever this policy changes).