Legal
Privacy Policy
Last updated: 7 October 2026
This Privacy Policy explains what personal data PRISMELLEA collects, why, who we share it with and the choices you have. It is written to meet the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong and, for customers in the EU, the EEA and the UK, the General Data Protection Regulation (EU GDPR and UK GDPR).
Who is responsible
The data user (controller) is AsianBeautyWholesale (Hong Kong) Limited, operating the PRISMELLEA brand, 5/F, KC100, 100 Kwai Cheong Road, Kwai Chung, New Territories, Hong Kong. Email support@prismellea.shop for any privacy question or request.
What we collect
- Order data: name, billing and delivery address, email, phone number, items ordered, order value and currency, order notes.
- Payment data: payments are handled by our payment service providers. We receive confirmation of payment, the payment method type and limited details such as the last four digits of a card. We never receive or store full card numbers.
- Account data (only if you create an account): login email and a securely hashed password, saved addresses and order history.
- Messages: what you send us by email or through our contact and cancellation forms.
- Technical data: IP address, browser type and the cookies described in our Cookie Policy, needed to run the cart, checkout, security, language and currency.
We do not collect sensitive personal data, and our shop is not directed at children under 16.
Why we use it and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Processing, delivering and supporting your order, refunds and returns | Performance of a contract |
| Taking payment and preventing fraud | Performance of a contract; legitimate interests |
| Answering your messages | Legitimate interests; contract where it concerns an order |
| Keeping accounting and tax records | Legal obligation |
| Running and securing the website, remembering your language and currency | Legitimate interests |
| Optional analytics or marketing cookies, if we introduce them | Consent, which you can withdraw at any time |
We do not use your data for new purposes unrelated to these without your express and voluntary consent. We do not send marketing emails unless you have opted in, and we do not sell your personal data or share it for cross-context behavioural advertising.
Who we share it with
- Payment service providers, to take payment and prevent fraud.
- Postal and courier companies, to deliver your order and, where required, to clear customs.
- Our website hosting and email providers, which process data on our behalf under contract.
- Professional advisers and authorities where the law requires it.
International transfers
We are based in Hong Kong and our service providers may process data in other countries. We follow the PCPD’s Guidance on Cross-border Data Transfer, including its recommended model contractual clauses, as a matter of practice. Where the GDPR applies to your data, transfers outside the EEA or UK are protected by adequacy decisions or by the European Commission’s Standard Contractual Clauses (and the UK addendum) with our providers.
How long we keep it
- Order and payment records: 7 years after the order, to meet Hong Kong record-keeping requirements.
- Messages and cancellation notices: 2 years after the matter is closed.
- Accounts: until you ask us to close your account, after which order records are kept as above.
We do not keep personal data longer than necessary for the purpose it was collected for.
Security
Our site uses HTTPS throughout. Access to order data is limited to people who need it, accounts are password-protected, and card data never touches our servers. Hong Kong does not currently require breach notification. We will notify the PCPD and affected people anyway where a breach creates a real risk of harm, and where the GDPR applies we will notify the competent authority as that law requires.
Your rights
Everyone: under the PDPO you may ask for a copy of the personal data we hold about you and ask us to correct it. We may charge a fee for a data access request that is not excessive, as the PDPO permits, and we respond within 40 days.
EU, EEA and UK customers also have the right to erasure, restriction, data portability, to object to processing based on legitimate interests, and to withdraw consent at any time. We respond within one month.
US customers: depending on your state, you may have rights to know, access, correct and delete your personal data, and to opt out of the sale or sharing of personal data. We do not sell or share personal data as those laws define it. We will not discriminate against you for using your rights.
To make a request, email support@prismellea.shop. We may ask you to verify your identity.
Complaints
Please contact us first. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD). If you are in the EU or EEA, you may complain to the data protection authority where you live or work (for example the Datatilsynet in Denmark or your Land data protection authority in Germany). In the UK, you may complain to the Information Commissioner’s Office (ICO).
Changes
Hong Kong’s data protection law is under review. We will update this policy if the requirements change, and we will update the date at the top of this page whenever we change it.