Privacy Policy

1. Introduction

GREATWILL SOURCING (HK) LTD ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your personal data when you visit our website, use our services, or otherwise interact with us. We process personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of the Laws of Hong Kong ("PDPO") and the six Data Protection Principles ("DPPs") issued by the Office of the Privacy Commissioner for Personal Data ("PCPD").

2. Data User and Data Processor

We are the "data user" as defined under the PDPO — we control the collection, holding, processing, and use of your personal data. Where we engage third-party service providers (e.g. payment gateways, logistics, IT hosting), we ensure that such "data processors" are bound by contract or other means to comply with the PDPO and to use your data only for the purposes we specify.

3. Information We Collect (DPP1: Purpose and Manner of Collection)

We collect personal data in a lawful and fair way, and only for purposes directly related to our functions or activities. We collect only data that is necessary and not excessive. The types of personal data we may collect include:

• Name, title, and contact information (phone number, email address, postal address)
• Shipping and billing addresses
• Payment-related information (processed securely through third-party providers; we do not store full card details)
• Account credentials (where you create an account) and purchase history
• Product preferences, feedback, and communications with us
• Technical data such as IP address, browser type, and device information when you use our website

Providing certain data may be mandatory (e.g. to fulfil an order); where it is voluntary, we will inform you. We will not use your personal data for a new purpose without your prescribed consent unless permitted under the PDPO.

4. How We Use Your Information (DPP3: Use of Personal Data)

We use the personal data we collect to:

• Process and fulfil your orders and manage your account
• Communicate with you about your orders, deliveries, and our products and services
• Send you marketing or promotional communications only with your prior consent (you may opt out at any time)
• Improve our website, services, and customer experience
• Comply with applicable laws, regulations, and legal process
• Establish, exercise, or defend our legal rights where necessary

5. Information Sharing and Disclosure (DPP3)

We do not sell your personal data. We may share your data with service providers who assist us in operating our website and business (e.g. payment processors, couriers, IT and cloud providers). These parties are required to maintain confidentiality and to use your data only for the purposes we specify. We may also disclose your data where required by law, court order, or governmental authority, or to protect our rights, safety, or property. If we transfer personal data outside Hong Kong, we will take practicable steps to ensure that the data is protected in accordance with the PDPO (e.g. through contractual or other means).

6. Data Retention (DPP2: Accuracy and Duration of Retention)

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. When data is no longer required, we will securely delete or anonymise it. You may request erasure of your data subject to our legal and operational obligations.

7. Data Security (DPP4: Security of Personal Data)

We take practicable steps to safeguard your personal data against unauthorised or accidental access, processing, erasure, loss, or use. Measures include access controls, encryption where appropriate, and secure processing by our staff and processors. However, no method of transmission over the Internet or electronic storage is completely secure; we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

8. Your Rights (DPP6: Access to and Correction of Personal Data)

Under the PDPO, you have the right to:

• Request access to your personal data held by us
• Request correction of any inaccurate personal data
• Request deletion of your personal data, subject to our legal and legitimate operational needs
• Withdraw consent for processing where we rely on consent (e.g. marketing), and opt out of marketing communications at any time

To exercise these rights, please contact us at coco@gwshk.com. We will respond within a reasonable time as required by the PDPO. You may also lodge a complaint with the PCPD if you believe we have contravened the PDPO.

9. Cookies and Similar Technologies

Our website may use cookies and similar technologies to improve functionality, analyse usage, and personalise content. You may adjust your browser settings to refuse or limit cookies; some features may not work properly if you do so. We do not use cookies to collect personal data beyond what is described in this policy without your consent.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will be revised accordingly. We encourage you to review this page periodically. Continued use of our website or services after changes constitutes acceptance of the updated policy, subject to your rights under the PDPO.

11. Contact Us

If you have questions about this Privacy Policy or our handling of your personal data, please contact us at coco@gwshk.com, or write to us at: GREATWILL SOURCING (HK) LTD, Rm 1603, 16/F., Pat Tat Ind Bldg., No.1, Pat Tat St., San Po Kong. Kowloon, HK. We will endeavour to respond promptly and in accordance with the PDPO.