Privacy Policy
PDPO (Personal Data Protection Ordinance) Compliance - Hong Kong
Last updated: January 2025
Data Controller: 水O'-Terroir Virtuel Limited, a Hong Kong company (registered office: Hong Kong SAR). This policy explains how we collect, use, and protect your personal data in accordance with Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486), as well as applicable international standards (GDPR/EU, PIPL/China, APPI/Japan, PIPA/Korea) for our worldwide operations.
Principle 1: Data Collection
- We only collect personal data necessary for our services to function.
- QR scan data is anonymized before storage - no biometric data is retained.
- Only aggregated metadata (anonymous statistics) is used for analytics.
- Viewing preferences (waters/wines viewed, language, device type, source of consultation) are recorded in pseudonymized form to measure product engagement without directly identifying the end consumer.
Principle 2: Purpose of Use
- Your data is used exclusively for purposes declared at the time of collection.
- Product engagement analysis (anonymized)
- QR scan and product-view measurement to provide establishments with aggregated B2B statistics
- User experience improvement
- Marketing communication (only with your explicit consent)
Principle 3: Consent
- We obtain your explicit consent before collecting any personal data.
- You can withdraw your consent at any time.
- Contact data (email, phone) is only collected with your prior agreement.
Principle 4: Data Security
- All data is encrypted in transit and at rest.
- User logs are separated from anonymous analytical data.
- Data access is restricted based on the principle of least privilege.
- Regular security audits are conducted.
Principle 5: Transparency
- This policy is available in English and Traditional Chinese.
- You can request access to your personal data at any time.
- We respond to access requests within 40 days.
Principle 6: Access and Correction
- You have the right to access your personal data.
- You can request correction of inaccurate data.
- You can request deletion of your data.
- Pseudonymized analytics events are retained for a maximum of 24 months, unless otherwise required by law or irreversibly anonymized for statistical purposes.
B2B Data Sharing
- Establishments can add distributor partners.
- When adding a partner, the following data is shared: establishment name, address, order history, account number.
- This data is used exclusively for order management.
- You can withdraw your consent by deleting the partner.
Cookie Policy
✓ Essential Cookies
Used for site functionality (language preferences, session).
⚙ Analytics Cookies
Used only with your consent to improve our services.
We do not use advertising tracking cookies.
Protection of Minors
We do not knowingly collect personal data from minors under 18 without parental consent.
Contact - Data Protection Officer
To exercise your PDPO rights or for any questions:
privacy@shui-o.com