Legal

Privacy Policy

Last updated 13 October 2026

This policy explains what personal data we collect when you visit sparkavie.shop or buy from us, why, who we share it with and what rights you have. It is written for Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486, “PDPO”) and, for customers in the EU, EEA and UK, the General Data Protection Regulation (“GDPR”) and UK GDPR.

1. Who is responsible

HERE WE SEOUL LIMITED, which operates SPARKAVIE, 30/F., Gravity, No. 29 Hung Yip Street, Kwun Tong, Kowloon, Hong Kong. Email: support@sparkavie.shop. We are the data user under the PDPO and the controller under the GDPR.

2. What we collect and why

Data	Why	Legal basis (GDPR)
Name, email, billing and delivery address, phone (optional), order contents, payment status	To take, deliver and support your order, handle returns and refunds	Contract (Art. 6(1)(b))
Order and payment records	Accounting and tax record-keeping	Legal obligation (Art. 6(1)(c))
Account details (if you create an account)	To let you sign in and see your orders	Contract (Art. 6(1)(b))
Messages from the contact or withdrawal form	To answer you and process withdrawals	Contract or steps before a contract; legal obligation for withdrawals
Technical data: IP address, browser, pages requested	To run the site securely, prevent fraud and show prices for your country	Legitimate interests (Art. 6(1)(f))

We do not use analytics, advertising or tracking cookies, we do not sell your data, and we do not use your data for marketing unless you have given us your explicit consent. We do not make automated decisions about you.

3. Payment data

Card and wallet payments are processed directly by our payment providers. They receive the data needed to process the payment and prevent fraud. We never see or store your full card number.

4. Who we share data with

Only with service providers who need it to do their job, under contracts that require them to protect it:

payment service providers (to take payment and prevent fraud);
delivery carriers and customs agents (to deliver your parcel and clear customs);
our web hosting and email providers (to run the site and send emails);
professional advisers and authorities where the law requires it.

5. International transfers

We are based in Hong Kong and our service providers may process data in other countries. If you are in the EU, EEA or UK, your order data is transferred to Hong Kong because this is necessary to perform our contract with you (GDPR Art. 49(1)(b)); where our providers process data outside the EEA or UK, we rely on the safeguards they offer, such as standard contractual clauses. As a matter of practice we also follow the Hong Kong Privacy Commissioner’s guidance on cross-border data transfer, including its recommended model contractual clauses.

6. How long we keep data

Order, payment and withdrawal records: 7 years after the order, for accounting and tax purposes.
Customer accounts: until you ask us to delete the account, or after 3 years without any activity.
Contact messages: up to 2 years after the conversation ends.
Technical server logs: up to 30 days.

7. Security

The site uses HTTPS encryption. Access to customer data is limited to people who need it to handle your order. Hong Kong does not currently require notification of data breaches; we will nevertheless notify the Privacy Commissioner for Personal Data and the people affected where a breach creates a real risk of harm, and, for EU, EEA and UK customers, the competent supervisory authority as the GDPR requires.

8. Your rights

Under the PDPO you may ask whether we hold personal data about you, request a copy of it and ask us to correct it. We may charge a fee that is not excessive for a copy. You can complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).

Under the GDPR and UK GDPR you also have the right to erasure, restriction of processing, data portability and to object to processing based on legitimate interests. You can complain to the data protection authority where you live (for example Datatilsynet in Denmark, the data protection authority of your German federal state, the CNIL in France, IMY in Sweden or the ICO in the UK).

To use any of these rights, email support@sparkavie.shop. We answer within 40 days under the PDPO and within one month under the GDPR.

9. Children

Our shop is not directed at children under 16, and we do not knowingly collect their data.

10. Cookies

We only use cookies that the shop needs to work. See our Cookie Policy.

11. Changes

Hong Kong’s data protection law is under review. We will update this policy if the requirements change, and we show the date of the last update at the top of this page.