Privacy Policy

This Privacy Policy (the “Policy”) is issued by “日貨小店” (the “Shop”). It explains how the Shop collects, holds, processes, uses, discloses and retains personal data. It is intended to serve as both a Personal Information Collection Statement under Data Protection Principle 1(3) of the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (the “Ordinance”) and a Privacy Policy Statement under Data Protection Principle 5. By using the Shop website, browsing products, placing an Order, paying, looking up an Order, uploading Payment proof, opening or managing an Account, saving an Address book or Bookmarks, submitting a Review, or sending a Contact message, you acknowledge the collection and use described here. This document is not legal advice.

1. Data user and scope

The Shop is a data user under the Ordinance. The Shop holds goods in Hong Kong and sells Japanese goods to Hong Kong customers, priced in Hong Kong dollars. Delivery is limited to Hong Kong (including outlying islands). Macau and overseas addresses are out of scope. This Policy applies to visitors, Guest customers who place an Order by email, customers with an Account, recipients named on an Order or in an Address book, and persons who submit a Contact message. “Personal data” means data relating to a living individual who can be identified, where access to and processing of the data are practicable. If you supply another person’s personal data (for example when ordering for a family member), you confirm that you are authorised to do so and that you have provided this Policy to that person. The Shop may ask you to demonstrate that authority. A recipient who believes the Shop should not hold their data may request access or correction as described below.

2. The Ordinance and the six Data Protection Principles

The Shop handles personal data in accordance with the Ordinance and the six Data Protection Principles in Schedule 1. Principle 1: collect data lawfully and fairly, for a purpose directly related to a function or activity of the data user, that is adequate but not excessive, and inform the data subject of the purpose, the classes of transferees, whether supply is voluntary or obligatory and the consequences of not supplying, and of access and correction rights and the person who handles those requests. Principle 2: take practicable steps to ensure accuracy and not retain data longer than is necessary for the purpose. Principle 3: not use data for a new purpose without prescribed consent unless the Ordinance permits. Principle 4: take practicable steps to protect data against unauthorised or accidental access, processing, erasure, loss or use. Principle 5: make generally available the data user’s policies and practices, the kinds of data held and the main purposes of holding them. Principle 6: data subjects may request access and correction, as supplemented by Part 5 of the Ordinance. Section 33 of the Ordinance (restriction on transfer of personal data outside Hong Kong) is not in force. The Shop nonetheless describes processing that may occur outside Hong Kong. Contravention of a Data Protection Principle is not itself a criminal offence, but the Privacy Commissioner may serve an enforcement notice. Failure to comply with an enforcement notice, breach of the direct-marketing rules, and certain other provisions of the Ordinance can be offences attracting a fine or imprisonment.

3. Kinds of personal data collected

The Shop collects only what it needs to operate the store, fulfil Orders and comply with the law. Depending on how you use the Shop, this may include: (1) identity and contact data: email address and Account identifier; sign-in data when you register with email and password. The Shop does not store passwords in recoverable form. (2) Order data: Order number, Variant, quantity, price, Payment method (FPS or bank transfer), amounts payable, Promo code, status and timestamps. (3) Delivery data: recipient name, Hong Kong mobile number, area to sub-district, street / building / floor / unit or the SF Pickup point name and address, optional delivery note, and any later tracking number. (4) Payment-matching data: a screenshot you choose to upload, which may show the payer’s name, FPS identifier, bank account number or a partial number, amount and reference. Do not send online-banking passwords, one-time codes or full payment-card details. (5) Account sidecars: Address book, Bookmarks and Account Cart. (6) Reviews: Account identifier, email, rating and text; after approval, only rating and text are published, not email or name. (7) Contact messages: name, email and body. (8) Technical and security data: IP address and user-agent string that a browser may send, which may be used to prevent abuse. The Shop does not run a separate advertising-analytics service. A Guest Cart and “recently seen” products live on your device and are not a customer file on the Shop’s servers.

4. Purposes of collection and use

The Shop uses personal data for purposes directly related to its functions as a shop, including: verifying identity and preventing impersonation; creating, identifying, looking up and fulfilling Orders; reserving and releasing Stock; displaying payment details for the chosen rail and matching incoming funds by amount and Order number; arranging SF Express delivery or Pickup; sending transactional Mail about the Order (at least Order created, and Shipped with tracking if any); managing Accounts, Address books, Bookmarks and Carts; moderating and publishing Reviews; handling enquiries, disputes, cancellation and refund records processed outside the website; detecting fraud, false Payment proof and security incidents; keeping accounting, tax and legally required records; enforcing the terms of service; and establishing, exercising or defending legal claims to the extent the Ordinance allows. The Shop does not currently use personal data for direct marketing. If a new purpose arises, the Shop will obtain prescribed consent unless the Ordinance permits the use without it.

5. Voluntary or obligatory supply, and consequences of not supplying

Supply of personal data is voluntary, but some fields are obligatory if you want the related function. Without a valid email, the Shop cannot create an Order, allow a Guest to look up an Order or upload Payment proof with Order number plus email, or send Order Mail. Delivery requires recipient name, Hong Kong mobile number and address. Pickup requires recipient name, Hong Kong mobile number and the chosen point. Without those data the Shop cannot hand the parcel to the courier. An Account requires an email and a password. You may still place an Order as a Guest without an Account, but you cannot use an Address book, Bookmarks or Account order history. The Contact form requires name, email and body or the message cannot be stored. Payment proof is optional. Not uploading it does not itself fail the Order, but matching payment may be slower. If Awaiting payment lasts seventy-two hours with no payment recorded, the Order may Expire and Stock is released.

6. Disclosure and service providers: what is shared with whom

The Shop does not sell personal data and does not provide personal data to a third party for that party’s direct marketing. It provides only what is needed, not every category of data, to the following classes of persons for the purposes in this Policy.

To S.F. Express (Hong Kong) Limited and the affiliates, contractors and pickup-point operators it uses to complete that shipment (together, “SF Express”), the Shop provides waybill data needed to carry the parcel: recipient name, Hong Kong mobile number, delivery address or Pickup point, a description of the goods (for example category or product name, to prepare the waybill), and any later tracking number. The Shop does not give SF Express your email, Account password, Payment proof, FPS or bank-account details, Contact-form content, Bookmarks or Cart. Hong Kong domestic delivery does not ordinarily require an identity card; the Shop will not submit identity documents to SF Express for that purpose. SF Express is itself a data user in respect of the waybill. Its privacy policy is at https://hk.sf-express.com/hk/tc/protocol/privacy . By choosing Delivery or Pickup you agree that the Shop may give SF Express the waybill data above so that SF Express can collect, hold, deliver or release the parcel. SF Express may retain waybills, call recordings or delivery records under its own policy; that retention is not controlled by the Shop.

To Google LLC and its affiliates (together, “Google”), the Shop provides customer data needed to run the store so that Google can host the website, store data and files, and process email-and-password Account sign-in on the Shop’s behalf. The Shop remains the data user; Google generally processes those data only on the Shop’s instructions. The data provided include: email, Account identifier, passwords in a form that cannot be reversed to clear text, Orders and Address book, Contact messages, Reviews, Payment-proof files, and IP address and user-agent string that may be processed to prevent abuse. The Shop does not give Google your FPS or online-banking passwords. Google may use its affiliates and subcontractors. Google’s Privacy Policy is at https://policies.google.com/privacy . The Shop does not authorise Google to use customer personal data to market products other than the Shop’s to you.

Shop operators (Admins) access relevant data to fulfil Orders, match payment, moderate Reviews and read Contact messages. The Shop may also disclose, under confidentiality, data needed by professional advisers such as accountants or lawyers; to a Hong Kong public body, law-enforcement agency or court where required or permitted by law; and to a proposed transferee if the Shop’s business is transferred, subject to appropriate confidentiality and the Ordinance. Order Mail is currently generated by the Shop’s own system. If an external mail vendor is used later, the Shop will update this Policy and will give that vendor only the email, Order number and payment or tracking details needed to send that message.

7. Processing outside Hong Kong

Data provided to Google may be processed or backed up outside Hong Kong, including in the United States and other places where Google maintains facilities. Section 33 of the Ordinance is not in force, but that does not leave overseas processing unregulated: Principle 1 still requires notice of classes of transferees, and Principle 4 still requires security. The Shop takes practicable steps, including encrypted transmission and relying on Google’s contractual and security commitments in its processor role. By using the Shop you acknowledge that this overseas processing is necessary to provide the website, Accounts and Order records. If you do not want data processed outside Hong Kong, do not open an Account or place an Order.

8. Retention

The Shop takes practicable steps not to retain personal data longer than is necessary for the purpose of collection, except where the law, accounts, tax, disputes or security so require. Hong Kong business records are commonly kept for seven years. Accordingly: completed, cancelled or expired Orders and their delivery and payment-matching data are generally kept until seven years after the Order ends. Payment proof is kept with the Order and then deleted or irreversibly processed. An Account, Address book, Bookmarks and Account Cart are kept until you delete the Account. Deleting an Account does not delete Orders already created and does not delete Reviews you submitted (public Reviews do not include email). Contact messages are kept for a reasonable period after they are handled, in case of follow-up. After Account deletion, sign-in data are removed from live and backup systems in accordance with Google’s description of the systems it operates for the Shop. A Guest Cart and recently seen products are stored by your browser and are removed when you clear site data. Actual deletion or anonymisation may complete slightly later because of backup cycles.

9. Security

The Shop takes practicable steps to protect personal data, including: encrypted transport on the website; an HttpOnly, SameSite session cookie lasting about one hour; passwords stored in a form that is not clear text; Payment proof held in restricted file storage so a customer cannot read another person’s file; and operator access on a need-to-know basis. Data sent over the internet cannot be guaranteed absolutely secure. Do not give the Shop, or anyone claiming to represent it, your online-banking password. If you believe an Account or Order has been used without authority, notify the Shop at once through Contact us.

10. Direct marketing

Part 6A of the Ordinance requires a data user, before using personal data in direct marketing or providing it to a third party for direct marketing, to give the prescribed notice and obtain consent or an indication of no objection. Silence is not consent. Contravention can attract a fine and imprisonment. The Shop does not currently use personal data for direct marketing and does not provide it to a third party for direct marketing. It does not send promotional mail or sell email lists. If that changes, the Shop will first notify you under Part 6A of the kinds of data and the classes of marketing subjects, provide a response channel, and will not so use the data until consent is obtained. You may later require the Shop to cease; the Shop must then stop using the data for direct marketing.

11. Cookies and local storage

The Shop uses storage that is necessary to operate, not advertising trackers. After sign-in, a session cookie verifies the Account. It is HttpOnly and lasts about one hour. A Guest Cart and recently seen products are stored in your browser’s local storage. Those local data are not uploaded as a separate server-side customer file. You may restrict cookies in your browser; if necessary cookies are blocked, Account features may not work. The Shop does not sell advertising identifiers and does not set separate third-party advertising or analytics cookies. Server logs may record technical data to keep the service running and secure, retained only as long as those purposes require.

12. Minors

The Shop is aimed at general Hong Kong customers, not at children. The Ordinance does not set a single digital age of consent of the kind found in some overseas laws. The Privacy Commissioner advises against collecting personal data from minors who cannot make an informed decision without prior consent from a person with parental responsibility. The Shop does not recommend that persons under eighteen open an Account or place an Order without that consent. If the Shop learns that it has collected a minor’s data without such consent, it may delete the Account or stop using those data. Orders already created must still be handled as law and fulfilment require.

13. Access and correction

You may ask the Shop to say whether it holds your personal data; if it does, to supply an intelligible copy; and to correct data that are inaccurate. A relevant person (including a person you have authorised in writing, or a person with parental responsibility for a minor data subject) may make the request on your behalf. Please submit the request in writing in Chinese or English through the Contact us page (path /contact), marked “data access request” or “data correction request”. The Shop may ask you to use form OPS003 issued by the Privacy Commissioner (available at www.pcpd.org.hk) and to supply enough information to verify identity (for example email and Order number). The Shop must reply in writing within forty calendar days of receiving the request. If it holds none of the requested data, it must still say so in writing within that time. If it cannot comply fully within forty days, it must explain why within that period, comply to the extent it can, and finish complying as soon as practicable thereafter. The Shop does not currently charge a fee for complying with a data access request, but it reserves the right to impose a fee that is not excessive under the Ordinance, and will tell you the amount within forty days. It may refuse to comply with an access request until that fee is paid. The Shop must or may refuse if the request is not in writing in Chinese or English, identity cannot be verified, compliance would disclose a third party’s personal data, or another ground in section 20 of the Ordinance applies, and must give written reasons within forty days. You may update email, password and Address book yourself after sign-in. An address and goods copied onto an Order snapshot do not change if you later edit the Address book. If you discover an error before shipment, contact the Shop as soon as possible.

14. Account deletion and Orders

You may delete your Account in Account settings. Deletion removes the login and the Address book, Bookmarks and Account Cart. It does not delete Orders already created and does not delete Review records. Guest Orders are identified by email, whether or not an Account exists. There is no right under the Ordinance identical to the EU “right to be forgotten”. The Shop may still retain Orders under Principle 2 and for legal and accounting needs.

15. Data security incidents

If a security incident involving personal data occurs, the Shop will assess the risk to data subjects, take practicable steps to contain, investigate and remediate, and where appropriate notify affected persons and the Office of the Privacy Commissioner for Personal Data. The Ordinance does not impose a notification deadline identical to some overseas regimes, but the Shop will not delay without reason. Do not post other people’s Order or contact details in public.

16. Changes to this Policy

The Shop may update this Policy. Continuing to use the Shop, placing an Order or keeping an Account after an update means you acknowledge the updated Policy. Material changes to purposes of collection or classes of transferees will be published on this page so far as practicable. Prior versions are not archived page-by-page on the website; if you need the text that applied on a given date, contact the Shop.

17. Contact and the Privacy Commissioner

For this Policy, access or correction, use Contact us. The title of the individual who handles those requests is the Shop’s privacy officer, reached through that form. The Shop has not yet published a separate office postal address in this Policy; you may ask in the form for further communication by reply email. That is the channel that is practicable today. It does not remove the Ordinance’s requirement to provide the name or title and address of the person who handles requests; if a fixed correspondence address is later available, it will be added here. You may also complain to the Office of the Privacy Commissioner for Personal Data, 12/F, 248 Queen’s Road East, Wan Chai, Hong Kong, telephone (852) 2827 2827, website www.pcpd.org.hk, email enquiry@pcpd.org.hk. The Commissioner’s office is independent of the Shop and oversees the Ordinance.