Privacy Policy

Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Yecom Limited (“we”, “us”, “our”), a company registered in Hong Kong, collects, uses, shares and protects your personal information when you visit our online shop Teatide at myteatide.com (the “Site”) or buy from us. We sell to customers in Australia, the United States and the United Kingdom, so this policy is written to meet the privacy laws that apply in those places and in Hong Kong.

The main laws this policy responds to are:

  • Hong Kong: the Personal Data (Privacy) Ordinance (Cap. 486).
  • Australia: the Privacy Act 1988 (Cth) and the Australian Privacy Principles, plus the Spam Act 2003.
  • United Kingdom: the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
  • United States: the California Consumer Privacy Act as amended by the CPRA (CCPA), the California Online Privacy Protection Act (CalOPPA), and other US state privacy laws that apply to us.

Where these laws differ, we apply the rights described in Section 9 to the people the relevant law protects.


2. Information we collect

We collect the following categories of personal information. The list also serves as our CCPA notice of categories collected in the past 12 months. You do not need an account to buy from us, and we do not create customer accounts.

  • Identifiers and contact details: name, email, phone number, billing and shipping address. This comes from you.
  • Order and transaction details: items bought, delivery instructions, returns and refunds. This comes from you, and from us.
  • Payment details: payment method, card brand and last four digits, billing postcode, payment status, and the result of any buy-now-pay-later eligibility check. Full card and account details are handled only by our payment providers: PayPal, Stripe, Airwallex, Klarna and Afterpay. This comes from you, via our payment providers.
  • Device and usage data: IP address, approximate location from IP, browser and device type, pages viewed, products added to the basket, purchases, referring site, cookie and advertising identifiers. This is collected automatically, including through pixels from Meta, TikTok and Google.
  • Communications: support emails and any messages you send us. This comes from you.

We do not intentionally collect sensitive personal information such as health data, biometric data, government ID numbers or precise geolocation. Please do not send us this kind of information.

 

3. How we collect and use your information

We collect information directly from you (for example at checkout or when you email us), automatically through cookies and similar technologies when you use the Site, and from third parties such as payment providers, our fulfilment partner and advertising platforms.

We use it only for the purposes below. For UK customers, the lawful basis under the UK GDPR is shown after each purpose.

  • Take and deliver orders, process payments, arrange fulfilment and shipping, handle returns and refunds. Lawful basis: contract.
  • Send order confirmations and delivery updates (through Shopify). Lawful basis: contract.
  • Answer questions and provide customer support. Lawful basis: contract, or legitimate interests in helping customers.
  • Prevent fraud and keep the Site secure. Lawful basis: legitimate interests in protecting our business and customers.
  • Keep accounting, tax and other records. Lawful basis: legal obligation.
  • Measure and improve the Site. Lawful basis: consent for non-essential cookies; otherwise legitimate interests.
  • Measure our advertising and show you personalised ads on Meta, TikTok and Google. Lawful basis: consent.

Providing your name, delivery address, email and phone number is necessary to deliver your order. If you do not provide them, we cannot complete the purchase.

We will not use your information for a new purpose that is incompatible with the original one without telling you and, where the law requires it, getting your consent.


4. Who we share your information with

We share personal information only with the recipients below, and only as far as needed for the purposes in Section 3. Service providers may use it only to work for us, except where stated.

  • Shopify: runs the Site, stores orders and sends our order emails. It receives all order and contact details.
  • PayPal, Stripe, Airwallex, Klarna, Afterpay: take and secure payments. They receive contact, order and payment details.
  • Our fulfilment partner in China: picks, packs and ships your order. It receives your name, delivery address, phone number and order contents.
  • Delivery carriers: deliver your order and handle customs. They receive your name, delivery address, phone number and parcel details.
  • Meta, TikTok, Google: measure and show our ads and provide analytics. They receive device, usage and purchase data collected by their pixels.
  • Professional advisers and authorities: provide legal, tax and accounting advice and handle legal requests. They receive only what is required.

Klarna and Afterpay (buy now, pay later) decide for themselves how they use your information for identity, credit and fraud checks. Their own privacy policies apply to that use.

If we sell or restructure the business, personal information may be transferred to the new owner, who must honour this policy.

US residents: sale and sharing. We do not sell personal information for money. Our use of advertising pixels from Meta, TikTok and Google may count as “selling” or “sharing” identifiers, device data and browsing activity for cross-context behavioural advertising under US state laws. You can opt out at any time through the “Do Not Sell or Share My Personal Information” link in the Site footer or with a Global Privacy Control signal. We do not knowingly sell or share personal information of anyone under 16.

 

5. Overseas disclosure and international transfers

We are based in Hong Kong. Your personal information is likely to be disclosed to, stored or processed in: Hong Kong, mainland China (our fulfilment partner), the United States, Canada (Shopify), Singapore and Australia (Airwallex), Sweden and other European countries (Klarna), the United Kingdom, and other countries where PayPal, Afterpay, Meta, TikTok, Google and our delivery carriers operate.

Mainland China. Our fulfilment partner is in mainland China. It receives your name, delivery address, phone number and order contents only to pick, pack and ship your order, and must keep them confidential and secure.

Hong Kong and all customers. Where we send personal data outside Hong Kong, we use contracts and other practical steps to make sure the recipient protects it to a comparable standard.

Australian customers. Before we disclose your personal information overseas, we take reasonable steps to make sure the recipient handles it in line with the Australian Privacy Principles, for example through our contracts with providers.

UK customers. When we transfer personal data outside the UK, we use a safeguard recognised by UK law: a country or scheme covered by UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the safeguard that applies by emailing support@myteatide.com.


6. Cookies and tracking

We use cookies and similar technologies (pixels, local storage) in three groups:

  • Essential: keep your basket and checkout working. These are always on.
  • Analytics: show us how the Site is used, so we can improve it. Used only with your consent where the law requires it.
  • Advertising: pixels from Meta, TikTok and Google measure our ads and show you relevant ones on those platforms. Used only with your consent where the law requires it.

You can change your choices at any time through the cookie settings link in the Site footer, or in your browser settings. Blocking essential cookies may stop parts of the Site from working.

Do Not Track and Global Privacy Control. Our Site does not respond to browser "Do Not Track" signals because there is no common standard for them. We treat a Global Privacy Control signal from your browser as a request to opt out of the sale and sharing of your personal information.

Third-party tracking. Third parties, such as our analytics and advertising providers listed in Section 4, may collect information about your online activities over time and across different websites when you use our Site.


7. Retention, security and data breaches

Retention. We keep personal information only as long as we need it for the purposes in Section 3 or to meet legal duties. Our usual retention periods are:

  • Order and invoice records: 7 years, to meet Hong Kong tax and accounting record rules.
  • Support messages: 2 years after the matter is closed.
  • Copies held by our fulfilment partner: 12 months after delivery.
  • Analytics data: up to 14 months.
  • Advertising pixel data: as set by Meta, TikTok and Google. See their privacy policies.

When we no longer need information, we delete it or de-identify it.

Security. We protect personal information with encryption in transit (HTTPS/TLS), access controls, and payment handling by our payment providers, so we never see or store your full card number. No online system is completely secure.

Data breaches. If a breach is likely to cause you serious harm, we will notify you and the relevant regulator as the law requires. This includes the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, the UK Information Commissioner’s Office, the Hong Kong Privacy Commissioner for Personal Data, and US state authorities.


8. Your privacy rights

United Kingdom

Under the UK GDPR you can ask us to:

  • give you a copy of your personal data (access)
  • correct inaccurate data (rectification)
  • delete your data (erasure)
  • restrict how we use it
  • send it to you or another company in a portable format

You can also object to processing based on legitimate interests or direct marketing, and withdraw consent at any time. Withdrawing consent does not affect processing done before you withdrew it.

Australia

Under the Australian Privacy Principles you can ask for access to the personal information we hold about you and ask us to correct it if it is inaccurate, out of date or incomplete. You can opt out of direct marketing at any time. Where practicable, you can deal with us anonymously or under a pseudonym, although we cannot deliver an order that way.

Hong Kong

Under the Personal Data (Privacy) Ordinance you can ask whether we hold personal data about you, request a copy (a data access request) and ask us to correct it if it is inaccurate. We respond within 40 days and may charge a reasonable fee to cover the cost of providing the copy.

United States

If you live in California or another state with a comprehensive privacy law, you may have the right to:

  • know and access the personal information we collect, use and disclose
  • delete it, and correct inaccurate information
  • opt out of the sale or sharing of your personal information, and of targeted advertising
  • limit the use of sensitive personal information (we do not use it in ways that trigger this right)
  • appeal our decision if we refuse your request (in states that provide an appeal)
  • not be treated unfairly for using these rights

How to make a request

Email support@myteatide.com. We may ask you to confirm your identity before acting, usually by matching details you already gave us. A US resident can use an authorised agent, who must give us written proof of authority. We respond within one month (UK), 30 days (Australia), 40 days (Hong Kong) and 45 days (US), and tell you if we need more time where the law allows. Requests are free unless they are clearly excessive, except that a Hong Kong data access request may carry a reasonable copying fee.


9. Children and automated decisions

Children. Our Site is for a general audience and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has given us information, email support@myteatide.com and we will delete it.

Automated decisions. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Our payment providers, such as Klarna and Afterpay, run their own automated eligibility and fraud checks. Those checks are governed by their privacy policies, not this one.


10. Complaints, changes and contact

Complaints. Please contact us first at support@myteatide.com so we can try to put things right. If you are not satisfied, you can complain to:

  • Hong Kong: the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk)
  • Australia: the Office of the Australian Information Commissioner (oaic.gov.au)
  • United Kingdom: the Information Commissioner's Office (ico.org.uk)
  • United States: your state Attorney General, or in California the California Privacy Protection Agency (cppa.ca.gov)

Changes. We review this policy at least once a year and whenever our practices change. We post the updated version on this page with a new effective date.

Contact. Yecom Limited, Hong Kong. Email: support@myteatide.com.