China Happy Life Privacy Policy

Personal Information Collection Statement (PICS)

1. Purpose of collection: The Platform collects your data for membership registration, account login, SMS/email verification, identity verification, the member centre, announcements, customer service, security and risk control, and legal compliance. See section 3 below.

2. Mandatory information: Your mobile number or email address and password are mandatory for membership registration. If you do not provide them, the Platform cannot complete your registration, and you cannot log in or use the member centre; you may still browse the Platform's public pages.

3. Voluntary information: Your name, identity document type, identity document number, place of issue, expiry date, delivery address, nickname, language and regional preferences are voluntary. Not providing voluntary information will not affect registration or access to public pages, but may prevent you from using functions that require identity verification or a delivery address.

4. Transfer of data: To provide the services, the Platform may engage service providers located in Hong Kong, Singapore, mainland China, the United States or other regions to process necessary data. The Platform will require them to protect the data through contracts or other reasonable measures. See sections 5 and 6.

5. Access and correction: You have the right under the Ordinance to access and correct personal data held by the Platform. See section 10.

6. Contact: If you have any questions about this Statement, please contact the Privacy Officer, Li Xuegang, at [email protected], correspondence address: Block B2, 19/F, Hang Wai Industrial Centre, 6 Kin Tai Street, Tuen Mun, New Territories, Hong Kong (see section 15).

1. Scope

1.1 This Policy explains how the China Happy Life cross-border mall website, member centre and related services (collectively, the "Platform") collect, use, store, share, transfer across borders and protect your personal data.

1.2 The Platform currently provides membership registration, brand and product information browsing, announcements and customer service. It does not currently provide online ordering or online payment services.

1.3 This Policy applies to all members and visitors who use the Platform.

1.4 This Policy is made under the Ordinance. If there is any inconsistency between this Policy and the Ordinance, the Ordinance prevails.

2. Personal Data We Collect

2.1 Membership Registration Data

2.2 Identity Information (Entirely Voluntary)

• Name
• Identity document type
• Identity document number
• Place of issue
• Expiry date

The Platform does not collect or store photographs of identity cards or passports, facial images or other biometric data. Identity document numbers are treated as sensitive personal data and are protected by the measures described in section 7.

2.3 Other Voluntary and Technical Data

• Delivery address (voluntary): recipient, region, address, postal code, contact number
• Technical logs: IP address, device and browser type, operating system, access time, request path, error and security records
• Cookies and browser local storage: login credentials, referral attribution, language and display preferences

3. Purposes of Use

The Platform uses your data only for the following purposes directly related to the services, and will not use it for unrelated purposes without your explicit consent:

3.1 Membership registration, account login, account maintenance and member management;

3.2 Sending SMS or email verification codes, and performing account security verification, access rate limiting, anti-fraud and risk control;

3.3 Identity verification based on information you voluntarily submit;

3.4 Providing the member centre, invitation programme, announcements, customer enquiries and complaint handling;

3.5 Complying with the laws and regulatory requirements of Hong Kong or other applicable jurisdictions and lawful requests of law enforcement authorities;

3.6 Performing de-identified statistical analysis that cannot be linked back to a specific individual, to improve the Platform's services.

The Platform does not currently use your data for direct marketing. If direct marketing is introduced in future, it will be handled in accordance with section 11 and Part 6A of the Ordinance.

4. Legal Bases for Processing

The Platform's legal bases for processing your personal data include:

4.1 your explicit consent;

4.2 performance of the membership service contract between you and the Platform;

4.3 the Platform's legitimate business interests, provided they do not override your privacy rights; and

4.4 compliance with the Platform's legal obligations.

You may withdraw your consent at any time. Withdrawal does not affect processing that was lawfully carried out before withdrawal.

5. Sharing and Processing by Service Providers

5.1 The Platform does not sell your personal data.

5.2 To achieve the purposes in section 3, the Platform may engage third-party service providers (data processors) to process necessary data, and will provide only the minimum data required for the relevant service.

5.3 The Platform enters into contracts with data processors requiring them to:

(1) process data only on the Platform's documented instructions and not for other purposes;

(2) implement appropriate technical and organisational security measures and maintain staff confidentiality;

(3) not further sub-contract the data without the Platform's prior consent (which may be given in writing or through mutually accepted electronic service terms); where sub-contracting is permitted, notify the Platform in advance, disclose the sub-processor and impose data protection obligations no less protective than this Policy;

(4) assist the Platform in responding to your access, correction and deletion requests;

(5) delete or return the data at the end of the service or contract as instructed by the Platform, except where retention is required by law or a backup cycle has not yet expired, in which case confidentiality must continue; and

(6) cooperate with the Platform's reasonable audits and data breach investigations.

5.4 Some cloud, SMS and email providers use standard service terms or online data processing addenda. The Platform will retain the relevant terms, sub-processor lists and acceptance records as part of its contract management and due diligence.

5.5 If a service provider refuses to accept these obligations, the Platform will assess the risk, limit the scope of data, adopt alternative measures and, where necessary, replace the provider.

5.6 The Platform will not provide your data to third parties for their own marketing purposes unless you have consented under section 11.

6. Cross-Border Transfer

6.1 The Platform's application and databases are primarily located in Hong Kong or Singapore; SMS and identity verification may be processed by service providers in mainland China; email providers may be located in the United States or other regions.

6.2 You understand that data may be transferred outside Hong Kong and may be subject to local laws or regulatory requirements. The Platform will require recipients to provide a level of protection no less than that set out in this Policy through contracts or other reasonable measures.

6.3 If you do not agree to the relevant cross-border processing, please do not submit identity information; membership registration does not require identity verification.

6.4 You may contact the Privacy Officer to enquire about the safeguards adopted for cross-border transfers.

7. Sensitive Personal Data

7.1 Identity document numbers are treated as sensitive personal data. The Platform processes them only to the extent necessary for identity verification and does not use them for direct marketing.

7.2 The Platform adopts encryption at rest, back-office access controls, default masking and audit logs for sensitive operations. Only authorised personnel may access such data when necessary.

7.3 The Platform does not collect identity document photographs, facial images or other biometric data.

8. Retention

Data that is expired or no longer needed will be deleted or de-identified.

9. Security

9.1 The Platform adopts measures including HTTPS encryption in transit, encryption of identity document numbers at rest, password hashing, role-based back-office access, audit logs for sensitive operations, rate limiting and verification codes.

9.2 The Platform reviews access rights periodically and requires staff and service providers to observe confidentiality obligations.

9.3 No internet transmission or storage can be guaranteed to be absolutely secure. If a data breach occurs, the Platform will promptly assess and contain the impact and notify affected individuals and relevant authorities in accordance with applicable law and regulatory guidance.

10. Your Rights

10.1 You have the right under the Ordinance to ascertain whether the Platform holds your personal data and to request a copy.

10.2 You have the right to request correction of inaccurate personal data.

10.3 You have the right to withdraw consent, opt out of direct marketing, or request deletion of data that is no longer needed (except where retention is required by law).

10.4 The Platform will generally respond within 40 days after receiving a complete request. If an extension is permitted by law, the Platform will notify you. A reasonable fee may be charged for an access request.

10.5 You have the right to complain to the Office of the Privacy Commissioner for Personal Data (PCPD) about the Platform's handling of your data.

10.6 To exercise these rights, please contact the Privacy Officer (section 15). The Platform may require identity verification.

11. Direct Marketing

11.1 The Platform does not currently use your personal data for direct marketing and does not provide your data to others for their marketing purposes.

11.2 If direct marketing is introduced in future, the Platform will:

(1) obtain your explicit, voluntary and separate consent in advance, confirmed in writing or in a retainable electronic record;

(2) not rely on pre-ticked boxes, silence, bundled services or refusal of service as a condition of consent;

(3) inform you of the categories of products to be marketed, the categories of data to be used and, where applicable, the categories of third parties to whom the data may be provided; and

(4) provide a free opt-out method in every marketing message.

11.3 You may opt out of direct marketing free of charge at any time. The Platform will stop within a reasonable period (internal target: 10 business days) and retain opt-out records.

11.4 The Platform will not conduct direct marketing to persons under 18.

12. Cookies and Browser Storage

12.1 The Platform uses essential cookies and browser local storage to maintain login, referral attribution, language and display preferences.

12.2 The referral attribution cookie is retained for a maximum of 30 days; login credentials are retained until expiry or logout.

12.3 The Platform does not use advertising or tracking cookies. You may clear or reject cookies through your browser settings, but this may affect login or preference functions.

13. Minors

The membership service is intended for persons aged 18 or above. Persons under 18 should obtain the consent of their legal guardian. The Platform will not knowingly collect personal data of minors without consent.

14. Changes to This Policy

14.1 The Platform may update this Policy due to legal, regulatory or service changes and will publish the updated version on the website.

14.2 Material changes (for example, new categories of data, cross-border transfers, direct marketing or sensitive data processing) will be notified prominently, and consent will be obtained again where necessary.

14.3 The Traditional Chinese version of this Policy prevails. This English version is a translation provided for convenience only.

15. Contact and Complaints

Data Controller: China Happy Life Daily Necessities Co., Limited

Privacy Officer: Li Xuegang

Email: [email protected]

Correspondence Address: Block B2, 19/F, Hang Wai Industrial Centre, 6 Kin Tai Street, Tuen Mun, New Territories, Hong Kong

The Privacy Officer is responsible for implementing this Policy, handling access and correction requests, data breach response, processor contract management and staff training.

If you are dissatisfied with the Platform's response, you may complain to the Office of the Privacy Commissioner for Personal Data of Hong Kong.