Introduction

Hong Kong Tea House (“we”, “us”, or “our”) operates this online store on the Shopify platform. This Policy explains how we collect, use, share, and protect personal information, and how we use cookies and similar technologies. By using our store, creating an account, or making a purchase, you agree to this Policy.

We generally act as the data controller for customers’ personal information collected through this store. Shopify provides hosted e‑commerce services and typically acts as our service provider (processor) and, in some cases, as an independent controller for certain processing activities carried out on its platform.

Scope

This Policy applies to personal information collected via our Shopify storefront and related features (checkout, accounts, marketing, customer support). If you use third‑party apps, payment gateways, logistics, or embedded services, those third parties may collect and process information under their own policies. Please review their terms and privacy notices as applicable.

Information We Collect

We collect personal information that you provide directly, that is generated through your interactions with our store, and that is received from third‑party partners where necessary to provide our services.

• Identity and contact details: name, email, phone number, billing and shipping addresses.
• Account and transaction data: login identifiers (hashed or tokenized), order history, returns, invoices, receipts.
• Payment information: processed securely by payment providers (we do not store full card numbers); transaction identifiers and status.
• Device and usage data: IP address, browser and device information, session data, pages viewed, referrers, cookie identifiers.
• Marketing and communications: newsletter subscriptions, preferences, campaign interactions, survey responses.
• User‑generated content: reviews, ratings, messages, uploaded media where applicable.

Providing certain information is optional, but some features (checkout, delivery, account access) may not function without the necessary data.

How We Use Personal Information

• Provide core services: process orders and payments, arrange delivery, handle returns and customer support.
• Operate and secure the store: authentication, fraud prevention, risk management, diagnostics, and compliance.
• Improve experience: analytics, performance monitoring, personalization, and service development.
• Marketing communications: with consent or where permitted by law, send updates, offers, and news; provide opt‑out options.
• Legal obligations: maintain records, respond to lawful requests, manage disputes and claims.

Where required by law (e.g., GDPR), our lawful bases include performance of a contract, consent, legitimate interests (such as securing our services and improving them), and compliance with legal obligations.

Cookies and Similar Technologies

Cookies are small files stored on your device to recognize your browser, maintain sessions, enhance security, remember preferences, and improve performance. We may also use pixels and local storage for similar purposes.

On Shopify, cookies are commonly grouped as: strictly necessary (checkout and security), functional (preferences), performance/analytics (usage statistics), and advertising/social (measuring campaigns and enabling embedded content). The specific cookies used may depend on your configuration and installed apps.

Examples of Shopify Cookies (illustrative)

• cart, cart_sig: maintain cart state and integrity.
• secure_customer_sig: support customer login security.
• _orig_referrer, _landing_page: attribution and landing page analytics.
• _shopify_y, _shopify_s: store analytics and performance statistics.
• _tracking_consent: record consent preferences.

Managing Cookies

You can manage or delete cookies via your browser settings. Where provided, you may also use our cookie banner to set preferences for non‑essential cookies. Blocking certain cookies may affect store functionality (e.g., checkout, login).

Sharing and Disclosure

• Platform and processors: We share information with Shopify and its sub‑processors as necessary to host the store, enable checkout, provide security, and operate core features.
• Service providers: Payment gateways, logistics/shipping carriers, customer support tools, analytics and marketing partners process data under contracts and only as needed to deliver their services.
• Legal and compliance: We may disclose information in response to lawful requests, to protect rights, safety, and property, and to comply with applicable laws.
• Business transfers: In the event of a merger, acquisition, reorganization, or sale of assets, information may be transferred subject to appropriate safeguards.

International Transfers

Because Shopify and some service providers operate globally, your information may be transferred to and processed in jurisdictions that may have different data protection laws. Where required, appropriate safeguards (such as standard contractual clauses) are used.

Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, including legal, accounting, or reporting requirements. After the applicable period, we will delete or de‑identify the information.

Security

We implement reasonable technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children’s Privacy

Our store is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). If you are a parent or guardian and believe a child has provided personal information, please contact us so we can take appropriate steps to delete it.

Your Rights and Choices

• Access and correction: Request a copy of your personal information and ask us to correct inaccuracies.
• Deletion and restriction: Request deletion or restriction of processing where applicable.
• Portability: Receive certain information in a portable format, where required by law.
• Object and withdraw consent: Object to processing based on legitimate interests and withdraw consent at any time for activities based on consent.
• Marketing opt‑out: Use “unsubscribe” links in emails or contact us to stop receiving marketing communications.
• Cookie preferences: Adjust your browser settings and use our cookie banner (where available) to manage non‑essential cookies.

These rights may vary by jurisdiction and are subject to legal limitations. We may request information to verify your identity before fulfilling a request.

Third‑Party Links and Apps

Our store may include links to third‑party websites, apps, or embedded services. Those parties are responsible for their own privacy practices. Please review their privacy policies before using their services.

Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated version on this page and indicate the effective date at the top.

Contact Us

If you have questions, requests, or complaints about this Policy or our data practices, please contact: enquiry@hkteahouse.com.hk or cs@hkteahouse.com.hk. We will respond within a reasonable period.