We value your privacy. This Privacy Policy explains how GrowMind ("we", "us", or "our"), a company registered in Hong Kong with registration number [HK Business Registration Number — TBD] and registered office at [Hong Kong registered office — TBD], collects, uses, and protects your personal data when you visit and purchase from our website.
To ensure global compliance, this policy is designed to meet the requirements of both the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and the European Union General Data Protection Regulation ("GDPR").
Legal Basis and Purpose of Data Collection
We act as the "Data User" (under PDPO) and "Data Controller" (under GDPR). We collect and process your personal data for the following purposes:
To Process and Deliver Orders: We collect your name, shipping address, billing address, email address, and phone number to fulfill your purchase contracts.
Legal Basis (GDPR Art. 6(1)(b)): Performance of a contract.
To Process Payments: Your payment details are processed securely through our third-party payment gateways (e.g., Stripe, PayPal).
We do not store your full credit card information on our servers.
Legal Basis (GDPR Art. 6(1)(b)): Performance of a contract.
Marketing Communications: If you actively opt-in, we use your email address to send you newsletters and promotional offers.
Legal Basis (GDPR Art. 6(1)(a) / PDPO Part 6A): Explicit Consent.
Website Optimization (Cookies): We use analytical and tracking cookies to improve our website experience, subject to your prior consent.
Legal Basis (GDPR Art. 6(1)(a)): Consent.
2. Data Retention
We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements (typically up to 7 years for financial records under Hong Kong company law).
3. International Data Transfers
Your data is collected globally, processed by our company in Hong Kong, and may be stored on secure servers located outside the European Economic Area (EEA).
To EU/EEA Residents: Because Hong Kong is located outside the EEA, we safeguard your data and ensure a similar degree of protection by implementing appropriate safeguards, including the use of Standard Contractual Clauses (SCCs) approved by the European Commission, and following the Recommended Model Contractual Clauses (RMCs) provided by the Hong Kong PCPD
4. Third-Party Data Processors
We share your data with trusted third parties only to run our shop and deliver your goods:
Logistics/Shipping Partners: (e.g., DHL, FedEx, local postal services) to deliver your orders.
IT/Platform Providers: (e.g., Shopify, WooCommerce, hosting providers).
Payment Processors: To safely process transactions.
5. Your Legal Rights
Depending on your location, you have specific rights regarding your personal data.
For All Users (including Hong Kong Residents under PDPO):
Right to Access: You have the right to request a copy of the personal data we hold about you.
Right to Correction: You have the right to request that we correct any inaccurate or incomplete personal data.
Additional Rights for European Union (EEA) Residents (under GDPR):
Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal data under certain conditions.
Right to Restrict or Object to Processing: You can object to us processing your data (e.g., for direct marketing).
Right to Data Portability: You can request the transfer of your data to another organization.
Right to Withdraw Consent: Where processing is based on consent (like cookies or newsletters), you can withdraw it at any time.
To exercise any of these rights, please contact our Data Privacy Coordinator at privacy@getgrowmind.com.
6. Cookies and Tracking Technologies
Our website uses cookies. Essential cookies are loaded automatically to make the shop function. Analytical, marketing, or tracking cookies (such as Google Analytics or tracking pixels) will only be deployed if you explicitly consent via our Cookie Banner. You can opt-out or change your preferences at any time through the banner settings.
7. Data Breaches
In the unlikely event of a data breach that risks your personal rights and freedoms, we will notify the relevant European Supervisory Authorities within 72 hours in accordance with GDPR, and notify affected users without undue delay.
We will also report relevant breaches to the Hong Kong Privacy Commissioner for Personal Data (PCPD) where appropriate.
8. Contact Details
For any privacy-related questions, data access requests, or complaints, please contact us:
GrowMind
Email: privacy@getgrowmind.com
Postal Address: [Hong Kong registered office — TBD]
Company registration number and Hong Kong registered office address will be inserted when the operating entity details are confirmed. Contact: privacy@getgrowmind.com · support@getgrowmind.com