Your details, handled with care

Being established in Hong Kong puts us under that jurisdiction’s own data protection law. But we also sell to households across the European Union, and Article 3(2) of the EU General Data Protection Regulation reaches a seller who does exactly that, wherever the seller happens to sit. So the GDPR governs how we treat the data of those customers too, and wherever the two regimes pull in different directions, the EU customer keeps the stronger of the two.

In practice this means every right described in the chapter “Your rights” is yours, wherever you live among the countries we deliver to, and you may take a complaint to the data protection authority of your own country.

When you place an order

Your first and last name; a phone number; the street, town, postcode and country the parcel is going to; an email address, if you decide to give one; whatever note you leave for the driver; which item, how many, and the total; when you ordered; the internet address the order was sent from; and a short label recording which advertisement or page you arrived by.

• So that the order can be confirmed on the telephone, carried to you, paid for at the door, and put right afterwards if a return or a guarantee claim follows. Legal basis: steps taken at your request before a contract, and then the performance of that contract (Article 6(1)(b)).
• To keep invoices and accounting records. Legal basis: legal obligations that apply to us as a company (Article 6(1)(c)).
• To spot and stop abuse, such as floods of fake orders from one connection or repeat orders that are never collected. Legal basis: our legitimate interest in keeping the shop working and couriers paid for real deliveries only (Article 6(1)(f)).

When you order on one of our country pages

The form there asks for three things: your name, a phone number and the delivery address on one line. Along with them go the item and the page it was ordered from; the internet address and the browser identification (user agent) the order was sent with, read by our own server; and the campaign labels carried by the link you arrived on — the utm and subid values, and the Google click identifier (gclid) when the link has no subid. All of it comes to us, and we ring you to confirm the order before it is sent. As with every order, our server log also notes the internet address it came from.

• Name, phone number and address, so the order can be confirmed, carried to you and paid for at the door. Legal basis: steps taken at your request before a contract, and then the contract itself (Article 6(1)(b)).
• The internet address and browser identification, so that invented orders and orders fired off by software can be told apart from real ones. Legal basis: our legitimate interest in not sending couriers after orders that nobody placed (Article 6(1)(f)).
• The campaign labels, so the order is credited to the advertisement that brought it. Legal basis: our legitimate interest in knowing which of our advertising works (Article 6(1)(f)).

During and after the confirmation call

We note the outcome of the call (confirmed, changed, cancelled, not reached) and any correction you give us. If a call is going to be recorded, you are told at the start and may decline. Legal basis: performing the contract.

When you write to us

The topic you chose from the list, the name and email address you typed, an order reference if one was to hand, the message itself, the moment it was sent and the IP address it came from. All of it serves one purpose, answering you; where the message concerns an order, it is filed alongside that order. Legal basis: your consent, given with the tick box on the form (Article 6(1)(a)); for messages about an order, also the contract. You can withdraw consent at any time by writing to us; this does not affect what was done before.

When we pay a refund

Two things, the name on the account and its IBAN, used a single time to push the money across. Legal basis: the contract, and the obligations the law puts on us. Card numbers, PINs and passwords are never asked for, at any stage, by anyone here.

When you browse

The company that hosts this site writes brief technical entries as pages are served — which address asked, at what moment, for what page, using which browser — and keeps them only long enough to hold the site together and keep it secure. Legal basis: legitimate interest. Your cookie choice and the few other items this site writes into local storage — every one of them named on the cookies page, those written only by the country pages included — are kept in your own browser, and nowhere else, and all of them are read only by this site. No script from any other company runs on the order form of the country pages. An advertising tag runs only with your consent (Article 6(1)(a)), and the ones in use are named on the cookies page, along with every key by name, purpose and lifetime.

Nothing here is compulsory: no law requires you to hand us anything. The practical limit is simply this — a parcel cannot be confirmed or carried without a name, a telephone number that someone answers, and somewhere to take it.

Children

This shop is not aimed at children. We do not direct any of our pages or advertisements at anyone under 16, and we do not knowingly collect data about them. Orders are meant to be placed by adults, since a contract is being made and cash has to be handed over at the door. If you believe a child has given us their details, write to privacy@bonnybuy.com and we will delete what we hold without asking for a reason.

The advertising accounts behind BonnyBuy, the Google Ads account among them, are in the name of WHATECH MOBILE CO., LIMITED, which pays for them and answers for every advertisement they carry; the same company runs the advertising and the Google Ads campaigns. Google is never handed your name, your address, your telephone number or your email.

What decides it

Your answer to the cookie question, and nothing else. Say no and the Google Ads tag stays in its restricted state: no advertising cookie has any way of being written, and Google is told nothing that could identify your visit. Say yes and what it may do is described below, and item by item on the cookies page.

Google (Google Ireland Limited, Ireland)

When the Google Ads tag is switched on it runs under Google Consent Mode v2. Until you agree to advertising cookies it is held in a restricted state: it writes no cookies, reads none, and passes Google only cookieless signals such as the fact that a page was loaded, with advertising identifiers redacted. Agree, and it may then set Google’s own cookies to remember that an advertisement brought you here, and the confirmation screen reports a completed sale with its euro value and the order reference attached. Who you are does not travel with it: not your name, not your address, not a phone number or an email. We also use no feature that uploads customer details to Google.

Google acts as our processor for the measurement it does on our behalf, and as a controller in its own right for what it does with the same data for its own purposes, under its own privacy policy. It may process the data outside the European Economic Area, including in the United States.

Legal basis for everything in this section: your consent, given through the cookie card and withdrawable at any moment from “Cookie settings” at the foot of every page. Withdrawing it stops the tags using cookies from that moment on; it cannot undo what was reported while it was in place.

A vague list is no use to anybody, so here is who actually handles your data, what each one does and where it sits. If we ever add another, this list is where you will find it.

• Vercel Inc. (United States), our hosting provider and the registrar of our domain. Vercel hosts this website, serves every page you see and keeps technical logs of the requests, for up to 12 months, as the chapter “How long we keep it” sets out. Because this site has no customer database, an order or a contact message is first written into that server log, where our staff read it in order to act on it. Vercel is our processor, under a data processing agreement, and does not use any of it for its own purposes.
• Your data comes to us. Where a service provider works for us — for the telephone confirmation of your order, or for technical operations — it acts on our instructions, sees only what that task needs and may not use it for anything of its own.
• The courier or postal operator in the country the parcel is going to. It receives your name, delivery address, phone number, any note you left for the driver and the amount to collect at the door. It is a controller in its own right for the carriage of the parcel, which is why it can contact you directly about the delivery. The courier is chosen per country; we tell you which one on the confirmation call, or whenever you ask.
• Customs authorities, where a parcel crosses a border, to the extent the law requires.
• Accountants, auditors and tax authorities, to the extent the law requires, and our own bank when a refund is transferred to you.
• Courts, police or regulators, where we are legally obliged to hand something over.

That is the complete list as at the date at the top of this page. We do not sell data, we do not pass it to data brokers, and we do not share it with any other online shop. Google is dealt with separately in the section above: its tag runs only as described there, and advertising cookies only after your yes. The advertising accounts that tag reports to are in the name of WHATECH MOBILE CO., LIMITED, which pays for them and answers for them.

Every provider that handles data on our behalf does so under a written contract limiting it to our instructions, requiring confidentiality and appropriate security, and ending in the deletion or return of the data.

Two of the arrangements described above cross a border, and you are entitled to know on what footing.

To us, in Hong Kong. That is where the company is established, and no adequacy decision from the European Commission covers it. What reaches us there is what taking, confirming and delivering your order actually requires, and it may go on that footing because Article 49(1)(b) of the GDPR permits a transfer needed to carry out the very contract you have asked for. Nothing else travels that way. For the records we keep longer than the order itself — the accounting ones — the basis is instead the European Commission’s standard contractual clauses, which oblige us by contract to protect the data to the standard you would enjoy inside the Union.

To our hosting provider, in the United States. Vercel Inc. is incorporated there. The European Commission’s standard contractual clauses, concluded as part of the contract we hold with it, are what makes that transfer lawful, backed by the safeguards you would expect alongside them: an encrypted connection to this site throughout, and log entries carrying order or message details that only our own staff are able to open.

Ask us at privacy@bonnybuy.com and we will tell you which safeguard applies to a given provider, and send you a copy of it with any commercially confidential terms removed.

Periods, not adjectives. Each one is counted from the event named beside it.

• Delivered orders, invoices and refund records: 7 years, counted from the close of the financial year the order sits in. Hong Kong’s Inland Revenue Ordinance fixes that figure for business records, and it is the longest anything on this page survives.
• Orders cancelled, never confirmed on the call, or sent back to us uncollected: 90 days from the date of the order, after which they are erased or reduced to a row with no person attached.
• Anything you write to us, by form or by email: 24 months after we last replied. Where the correspondence concerns an order it is filed with that order and inherits the period above.
• Bank details given for a refund: deleted within 30 days of the transfer clearing. The payment itself stays in the accounting records, without the account number.
• Technical logs from the web server (IP address, time, page requested, browser): 12 months, for security and to spot abuse.
• The record of your cookie choice: 12 months, held in your own browser and nowhere else, after which the choice is put to you again.

When a period runs out the data is deleted, or reduced to figures that can no longer be traced to a person. The one exception: if a complaint, a guarantee claim or a legal dispute is open when the clock stops, we keep what is relevant to it until it is finished and any appeal period has passed.

You may, at any time and free of charge:

• ask whether we hold data about you and receive a copy of it (access);
• have wrong or incomplete data corrected;
• require deletion once we have no further need of it, once a consent you gave is withdrawn, or on an objection we cannot outweigh with a stronger reason;
• freeze what we may do with it while some question about it is settled;
• take back what you gave us as an ordinary electronic file, or have us send it straight to another company (portability);
• object to processing based on our legitimate interests, for reasons relating to your situation;
• withdraw a consent you gave, including your cookie choice, with effect for the future;
• ask for a person to review any decision made by automated means.

Write to privacy@bonnybuy.com, or to our postal address. To protect you, we may ask for your order reference and the phone number used for the order before we act; we ask for an identity document only where there is no other way to be sure it is you. We answer within 30 days. If a request is genuinely complex we may need up to two further months, and we will say so, with the reason, inside the first thirty days.

Give us the first go at fixing it: write to privacy@bonnybuy.com. That is a request, not a condition. A supervisory authority will hear you whenever you like, without our being asked first, and going to one costs you none of your other remedies. The authority for the place we are established is the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).

Living in the European Union, you may skip us entirely and go to the supervisory authority where you live, where you work, or wherever you believe the problem arose. It has to accept the complaint and has to tell you what became of it. The courts of your own country are open to you as well.

The site is served over an encrypted connection. Both forms carry a one-time token, so an order or a message can only be submitted from a page of this site, and the contact form silently drops the automated submissions that make up most of what arrives. Order and message details are readable only by the staff who act on them, through the hosting account, which is protected by individual logins and a second factor. No system is perfectly safe; if a breach ever puts you at risk we will tell you, and the authority, as the law requires.

Every revision of this notice moves the date printed at its head. Where a revision alters what becomes of data we already hold in some way you would not have anticipated, we write to you about it directly, provided we have a way of reaching you.