§
Privacy Policy
Last updated 7 October 2026
This policy explains what personal data GEMAVELLE collects, why, who we share it with and what rights you have. It follows the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong and, for customers in the EU, the UK and the EEA, the General Data Protection Regulation (GDPR and UK GDPR).
1. Who is responsible
Hong Kong TV Shopping Network Company Limited, 1 Chun Cheong Street, Tseung Kwan O Industrial Estate, New Territories, Hong Kong (Company No. 2037066), is the data user under the Ordinance and the controller under the GDPR. Contact for all privacy matters: support@gemavelle.shop, +852 5012 9621.
2. What we collect
- Order data: name, delivery and billing address, email, phone (optional), items ordered, amount, currency and order history.
- Payment data: processed by our payment service provider. We receive only the payment status, the payment method type and, for cards, the brand and last four digits — never the full card number.
- Account data (if you create an account): email and password (stored encrypted).
- Messages: what you send us through the contact or withdrawal form or by email.
- Technical data: IP address (used to suggest your country and currency and to protect against fraud), browser type and the cookies described in our Cookie Policy.
We do not use advertising or tracking cookies, and we do not sell personal data.
3. Why we use it (purposes and legal bases)
| Purpose | Legal basis (GDPR) |
|---|---|
| Process, pay for, ship and support your order; handle returns and refunds | Performance of a contract (Art. 6(1)(b)) |
| Keep accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Prevent fraud and keep the site secure | Legitimate interests (Art. 6(1)(f)) |
| Answer your messages | Legitimate interests / steps before a contract |
| Show prices in your currency | Legitimate interests |
Under the Ordinance (Data Protection Principles 1 and 3), we collect only what is necessary for these purposes and do not use your data for a new purpose without your express and voluntary consent. We do not send marketing emails.
4. Who we share it with
- Payment service providers, to take payments, refunds and prevent fraud.
- Carriers and postal services, to deliver your parcel (name, address, phone, email for tracking).
- Our website hosting and email providers, who store data on our behalf under contract.
- Authorities, where the law requires it (for example, customs declarations).
5. International transfers
We are based in Hong Kong and our service providers may process data in other countries. We follow the PCPD’s Guidance on Cross-border Data Transfer, including its recommended model contractual clauses, as a matter of practice. For customers in the EU, the UK and the EEA, data transferred outside those areas is protected by an adequacy decision or by standard contractual clauses approved by the European Commission (or the UK equivalent).
6. How long we keep it
- Order and invoice records: 7 years, as required for accounting and tax purposes.
- Customer account: until you ask us to close it, or after 3 years without activity.
- Messages: 2 years after the matter is closed.
7. Security
We take practicable steps to protect your data against unauthorised or accidental access, processing, erasure, loss or use: HTTPS on the whole site, restricted administrator access, and payment details handled only by the PCI DSS certified provider. Hong Kong does not currently require breach notification. We will notify the PCPD and affected people anyway where a breach creates a real risk of harm, and we will notify EU/UK supervisory authorities where the GDPR requires it.
8. Your rights
Under the Ordinance you may ask to access and correct your personal data (Data Protection Principle 6). We reply within 40 days and may charge a fee that is not excessive for an access request.
If you are in the EU, the UK or the EEA you also have the right to access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interests. We do not make decisions based solely on automated processing that produce legal effects for you.
Write to support@gemavelle.shop. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD), or — if you are in the EU, the UK or the EEA — to the data protection authority in your country (for example the Datatilsynet in Denmark, IMY in Sweden, CNIL in France or the authority of your German federal state).
9. Children
Our shop is not directed at children under 16 and we do not knowingly collect their data.
10. Changes
Hong Kong’s data protection law is under review. We will update this policy if the requirements change, and we show the date of the latest version at the top of this page.