Privacy Policy

1. Who is responsible

The data controller is yocobe International Limited (尤克比國際有限公司), Room A5, 7/F, Astoria Building, No. 34 Ashley Road, Tsim Sha Tsui, Hong Kong. The controller is established in Hong Kong.

Contact for anything in this policy: [email protected].

2. What we collect

We collect as little as a digital store can work with. There are no advertising trackers and no profiled data.

• —Email address — needed to identify your order, and to reach you about a problem with an order or a refund.
• —Order data: what you bought, when, the amount, the currency and the payment reference. Card details are handled by our payment provider and never reach us.
• —Delivery data: which link was issued for your order, when, and whether the download was used.
• —Server and security logs: IP address, user agent, requested URL and timestamp, kept for security and abuse prevention.

3. Why we process it

• —To perform the contract: take payment, deliver the product, answer support requests.
• —To meet legal obligations: bookkeeping and tax records for sales.
• —For our legitimate interest: keeping the store online and secure, preventing abuse, and measuring whether pages are read (section 6).

4. How long we keep it

• —Order and payment records: as long as Hong Kong record-keeping rules require — currently seven years for business records.
• —Delivery records: as long as needed to re-send a purchase and to handle refunds, then deleted.
• —Server and security logs: 30 days, unless a security incident requires longer.
• —Notification contact, if you opted in: until you unsubscribe.

5. Who processes it with us

We use a short list of processors. Each one is bound by a data processing agreement and may only process data on our instructions.

• —Stripe — payment processing and receipts.
• —Cloudflare — CDN, DNS and edge security, plus privacy-first aggregate analytics.
• —Our hosting provider — the servers that run this store. The provider supplies infrastructure only and does not decide what is stored on it.
• —Google (Gmail) — the mailbox that receives mail sent to the address on the imprint page, including support requests.

6. Cookies and measurement

The store sets only what it needs to work: a region and cache cookie that remembers which country version of the store you are browsing, and cookies that keep a shopping cart together. These are strictly necessary and are not used for advertising.

There is no consent banner because there are no marketing or third-party advertising cookies to consent to. Traffic is measured in aggregate — page views, referrers, countries — without cross-site profiling, and search performance is read from Google Search Console in aggregate.

7. Your rights

You can ask for a copy of your personal data, ask us to correct it, ask us to delete it where we are not required to keep it, ask us to restrict or to object to certain processing, and ask for portability of data you gave us.

Where the EU General Data Protection Regulation applies — that is, where you are in the EU or EEA and we offer goods or services to you there — those are the rights you can rely on. In Hong Kong, the Personal Data (Privacy) Ordinance gives data subjects comparable rights of access and correction.

Write to [email protected]; we answer within 30 days. If you are not satisfied with the answer you can complain to the supervisory authority in your country of residence, or in Hong Kong to the Privacy Commissioner for Personal Data.

8. Transfers outside the EU and EEA

The controller is established in Hong Kong, and some processors are based outside the EU and EEA. Where personal data of a person in the EU or EEA is transferred to us or to a processor outside the EU and EEA, the transfer relies on the European Commission standard contractual clauses or an equivalent safeguard in the processor agreement.

9. Changes to this policy

If this policy changes, the version date at the top changes with it. A material change that affects existing customers is announced on this page before it takes effect.