Last updated: 26 May 2026

This Privacy Policy explains how Hape HK ("we", "us", "our") collects, uses, stores, discloses and otherwise handles your personal data when you visit our website, use our services, place an order, create an account, contact us, or otherwise interact with us.

By accessing or using our website or services, you acknowledge that you have read and understood this Privacy Policy.

1. Scope of This Privacy Policy

This Privacy Policy applies to personal data collected through our website, online store, customer service channels, social media pages, marketing activities, and any other interactions you have with us in connection with our products and services.

In this Privacy Policy, "personal data" generally means any data:

• relating directly or indirectly to a living individual;
• from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and
• in a form in which access to or processing of the data is practicable.

2. Personal Data We May Collect

Depending on how you interact with us, we may collect the following categories of personal data:

(a) Identity and contact data

• name;
• billing address;
• delivery address;
• email address;
• telephone number.

(b) Account data

• login credentials;
• account preferences;
• saved addresses;
• wishlist or shopping preferences.

(c) Transaction data

• order details;
• purchase history;
• payment status;
• refund, return and exchange records;
• delivery details.

(d) Payment data

We may collect limited payment-related information, but payment card details are generally processed by our third-party payment service providers and are not stored by us in full unless expressly stated.

(e) Technical and usage data

• IP address;
• browser type and version;
• device identifiers;
• time zone and language settings;
• pages viewed;
• referring websites;
• browsing behaviour on our website;
• cookie and analytics data.

(f) Communications data

• messages, emails or enquiries you send to us;
• customer service records;
• survey responses;
• reviews or feedback you submit.

(g) Marketing and preference data

• your marketing preferences;
• subscription status;
• product interests;
• interactions with our advertisements, emails or promotions.

3. How We Collect Personal Data

We may collect personal data in the following ways:

• directly from you, when you place an order, create an account, subscribe to marketing, fill in forms, enter promotions, contact us, or otherwise provide data to us;
• automatically, through cookies, pixels, server logs and similar technologies when you browse or interact with our website;
• from service providers and partners, such as payment processors, logistics providers, Shopify, analytics providers, advertising partners, fraud prevention providers and customer support platforms;
• from publicly available sources, where permitted by law.

4. How We Use Your Personal Data

We may use your personal data for the following purposes:

(a) To provide products and services

• process and fulfil your orders;
• arrange payment processing;
• provide delivery and order updates;
• manage returns, refunds and exchanges;
• create and maintain your account;
• provide customer support.

(b) To operate and improve our business

• administer, maintain and improve our website and services;
• analyse website performance and customer behaviour;
• troubleshoot technical issues;
• develop new products, services and features.

(c) For communications

• respond to your enquiries;
• send service-related notices;
• notify you about changes to our terms, policies or operations.

(d) For marketing

• send newsletters, promotional messages and product updates, where permitted by law;
• personalise content, recommendations and advertising;
• measure the effectiveness of our marketing campaigns.

(e) For security and fraud prevention

• verify identities where appropriate;
• detect, investigate and prevent fraud, abuse, security incidents or unlawful conduct;
• protect our rights, customers, staff and business operations.

(f) For legal and compliance purposes

• comply with applicable laws, regulations, codes of practice and lawful requests from authorities;
• establish, exercise or defend legal claims;
• maintain proper business and accounting records.

5. Legal Basis / Grounds for Handling Personal Data

Where required under applicable law, we handle personal data on one or more of the following grounds:

• to perform a contract with you;
• to comply with a legal obligation;
• for our legitimate business interests, where such interests are not overridden by your rights and interests;
• with your consent, where consent is required.

If you are in Hong Kong, we will handle personal data in accordance with the requirements of the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"), including the applicable Data Protection Principles.

6. Disclosure and Transfer of Personal Data

We may disclose or transfer your personal data to the following categories of recipients where necessary for the purposes described above:

• Shopify and related commerce platform providers;
• payment processors and payment gateway providers;
• delivery, courier and fulfilment providers;
• IT, hosting, cloud storage and cybersecurity providers;
• customer support and CRM providers;
• analytics and advertising partners;
• professional advisers, auditors, insurers and legal counsel;
• regulators, law enforcement agencies, government authorities or courts where required by law;
• actual or proposed buyers, investors or successors in connection with a merger, acquisition, financing, restructuring or sale of business assets.

We do not sell your personal data in the ordinary sense of the word. However, if applicable law gives a broader meaning to "sell", "share" or similar terms, certain advertising or analytics activities may fall within those definitions.

7. Cross-Border Transfer

Your personal data may be transferred to, stored in, or accessed from locations outside Hong Kong, including where our service providers or platform providers operate.

Where personal data is transferred outside Hong Kong, we will take reasonable steps to ensure that the data is protected by appropriate safeguards and handled in a manner consistent with this Privacy Policy and applicable legal requirements.

8. Cookies and Similar Technologies

We use cookies and similar technologies to operate our website, remember your preferences, understand website traffic, improve functionality, and support analytics and advertising.

These technologies may collect information about your device and browsing activities.

You can manage or disable cookies through your browser settings. However, if you disable certain cookies, some parts of the website may not function properly.

If applicable, more information may be provided in our Cookie Policy or through our website’s cookie banner or settings tool.

9. Marketing Communications

Where permitted by law, we may send you direct marketing communications by email, SMS, messaging applications or other channels.

You may opt out of marketing communications at any time by:

• clicking the unsubscribe link in our emails;
• following opt-out instructions in the message;
• contacting us using the details below.

Please note that even if you opt out of marketing, we may still send you non-promotional communications relating to your orders, account or customer service matters.

10. Retention of Personal Data

We retain personal data only for as long as is reasonably necessary for the fulfilment of the purposes for which it was collected, including for legal, accounting, tax, dispute resolution, fraud prevention and record-keeping purposes.

The retention period may vary depending on the type of data, the purpose for which it was collected, and our legal or operational obligations.

When personal data is no longer required, we will take reasonable steps to delete, anonymise or securely destroy it, unless retention is required or permitted by law.

11. Data Security

We take reasonable technical, organisational and administrative measures to protect personal data against unauthorised or accidental access, processing, erasure, loss, use or disclosure.

However, no method of transmission over the internet or electronic storage is completely secure. Accordingly, we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for using secure devices and networks where possible.

12. Your Rights

Subject to applicable law, you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate personal data;
• request deletion of personal data in certain circumstances;
• object to or restrict certain processing in certain circumstances;
• withdraw consent where processing is based on consent;
• request information about our data handling practices.

If you are in Hong Kong, under the PDPO you generally have the right to:

• request access to your personal data; and
• request correction of your personal data.

We may need to verify your identity before processing your request. We may also charge a reasonable fee for complying with a data access request where permitted by law.

13. Children’s Privacy

Our website and services are not directed to children, and we do not knowingly collect personal data from children without appropriate consent where required by law.

If you believe that a child has provided personal data to us inappropriately, please contact us and we will take reasonable steps to investigate and, where appropriate, delete the data.

14. Third-Party Websites and Services

Our website may contain links to third-party websites, applications or services. We are not responsible for the privacy practices, security or content of those third parties.

We encourage you to review the privacy policies of any third-party sites or services you use.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, legal requirements or operational needs.

Any updated version will be posted on this page with a revised "Last updated" date. Your continued use of our website or services after the updated policy takes effect constitutes your acknowledgement of the revised Privacy Policy.