Privacy

1 — What we collect and why (DPP1: purpose and manner of collection)

We collect the least we can and only for a purpose directly related to running this shop.

• When you order: name, email address, telephone number, delivery address, destination country, and what you bought. All of it is needed to address the parcel, price its carriage, prepare export and quarantine paperwork, take payment, and reach you if something goes wrong.
• When you write to us through the contact form or the cancellation form: name, email address, and whatever you choose to write, plus an order reference and piece number for a cancellation.
• Your destination country while you browse. This one is held in your browser for the length of the visit so the shop can tell you what it can send you, and it is saved with an order because we cannot ship or clear a parcel without it.
• Server logs: IP address, time, page requested, and user agent, kept briefly for security and to keep the site running.

We do not collect body measurements, room measurements, or any measurement about you. There is no measuring tool on this site — the millimetres here belong to the objects.

We do not build a profile from your destination country, we do not use it to train a recommendation, and we do not use it for advertising.

There are no customer accounts, so there is no password and no account record. Supplying personal data is voluntary; if you do not supply the fields marked required at checkout we cannot take the order.

2 — What we do with it (DPP3: use)

We use it for the purpose it was collected for and for a directly related purpose: fulfilling and supporting your order, answering your message, complying with a legal obligation, and defending a legal claim. We use it for nothing else without your consent.

We do not send marketing email. There is no newsletter on this site and no box to untick.

3 — Who else sees it (DPP3: transfer)

• Our carrier and its customs broker — name, address, telephone, and the customs description of the goods.
• The plant health authority issuing a phytosanitary certificate, where a plant-fibre piece needs one — consignee name and address.
• Our payment provider — your card details go to it directly and never through us. It is PCI DSS compliant and is the party that holds them.
• Our email and hosting providers — as processors, to send you order email and to serve this site.

Nobody in that list may use your data for their own marketing. We do not sell, rent or trade personal data to anyone, for any purpose.

Because we ship internationally, fulfilling an order necessarily involves transferring your delivery details to the destination country and to the carriers between here and there.

4 — Accuracy and how long we keep it (DPP2)

• Order records: seven years from the order, which is what Hong Kong business records rules require.
• Correspondence: two years from the last message, then deleted.
• Server logs: thirty days.
• Destination country while browsing: until you close the browser tab.

If something we hold about you is wrong, tell us and we will correct it. If you want your correspondence deleted before the two years are up, ask and we will delete it.

5 — Keeping it safe (DPP4: security)

The site runs over HTTPS with HSTS. Access to order data is limited to the people who need it to fulfil orders and is protected by multi-factor authentication. Card details are never on our systems. Data at rest with our providers is encrypted.

Hong Kong does not currently impose a mandatory data breach notification duty on data users, and we make no claim about a statutory reporting window because none exists. We will nonetheless tell you, and the Privacy Commissioner for Personal Data, as soon as we can if a breach happens that is likely to affect you. That is our own commitment.

6 — Being open about all this (DPP5)

This page, the collection statement and the cookie page together describe every kind of personal data we hold and what we do with it. If something is unclear, ask and we will explain it.

7 — Seeing it and correcting it (DPP6)

You have the right to ask whether we hold personal data about you, to be given a copy of it, and to have it corrected if it is wrong. Write to support@starlivehk.com or to the registered office. We answer within forty days, which is the period the Ordinance sets. We may charge a fee for a copy that is not more than the direct cost of producing it, and we will tell you the amount first.

If you think we have handled your data wrongly you may complain to the Privacy Commissioner for Personal Data, Hong Kong, which can investigate and enforce. Complaining to us first usually resolves things faster, but it is not a precondition.

If you live in the European Economic Area or the United Kingdom, you may also have rights under the law where you live — access, rectification, erasure, restriction, portability and objection — and a right to complain to your own supervisory authority. Write to us and we will handle a request under whichever framework gives you more.

8 — Cookies

Set out on their own page, with the choice to refuse the optional ones made exactly as easy as accepting them. See cookies.

9 — Children

This shop is not aimed at children and we do not knowingly collect personal data from anyone under 18. If you believe we have, write to us and we will delete it.

10 — Changes to this policy

Hong Kong’s data protection law is under review and amendments have been proposed. If the requirements change, this policy will be updated and the date at the top of the page will change with it. Material changes to how we use data you have already given us will be notified by email before they take effect.