隱私政策

• 帳戶資料：用戶名稱、電郵地址、密碼（只以加密雜湊方式儲存）、姓名及電話號碼（如你提供）、頭像，以及語言和顯示主題偏好。
• 交易資料：訂單、商品、金額、你於結帳時提供的交收或送貨地址及聯絡資料、優惠券使用紀錄及退款申請。
• 付款資料：信用卡付款由 Stripe 處理，我們不會接收或儲存完整的信用卡號碼，只保存付款狀態及交易參考編號。
• 錢包資料：充值、扣款（例如上架費及推廣費）、收入及提現紀錄，以及你為提現提供的銀行帳戶或 PayPal 資料。
• 刊登及用戶內容：商品資料及相片、評價、評分及願望清單。
• 通訊資料：你透過本平台與其他用戶的對話及出價，以及你向我們查詢時提供的資料（包括經 WhatsApp 或電話）。
• 技術及保安資料：登入時的 IP 地址及瀏覽器／裝置資料、登入工作階段資料，以及（如你啟用）推送通知的訂閱資料。

我們會將你的個人資料用於以下目的：

• 開立及管理帳戶、驗證身份，以及保障帳戶安全（包括偵測可疑的登入）；
• 提供平台功能，包括刊登商品、瀏覽、對話、下單、安排面交或送貨；
• 處理付款、退款、錢包交易及提現；
• 發送服務通知，例如電郵驗證、重設密碼、訂單更新、對話通知，以及你已收藏商品的減價通知；
• 按第三節公開顯示賣家資料；
• 提供客戶服務及處理爭議；
• 以統計方式改善平台（例如商品瀏覽次數）；
• 遵守法律責任，以及回應執法或監管機構的合法要求。

在未得到你同意前，我們不會將你的個人資料用於直接促銷。你可隨時要求停止接收促銷訊息。

為建立買賣雙方的信任，以下資料會在你的公開賣家頁面及商品頁面顯示：用戶名稱、姓名（如你提供）、頭像、加入日期、最後活躍日期、你刊登的商品、你撰寫及收到的評價，以及賣家標章（官方商店、已驗證電郵、成交宗數及回覆率）。

你的電郵地址、電話號碼及地址不會公開顯示。你在對話中向其他用戶提供任何個人資料，須自行決定及承擔風險。

我們只會在以下情況披露你的個人資料：

• 向交易的另一方提供完成交易所需的資料（例如安排面交）；
• 向代表我們提供服務的服務供應商提供，包括 Stripe（付款）、Amazon Web Services（網站寄存及資料庫）、Cloudflare（圖片儲存及傳送）、Brevo（電郵發送）及瀏覽器推送通知服務；
• 向我們的專業顧問及核數師提供；
• 按法律、法院命令或執法、監管機構的合法要求，或為保障 Thai Soul、用戶或公眾的權利及安全而需要時；
• 在業務轉讓、合併或重組時，向承讓人提供。

我們不會出售你的個人資料。

我們的服務供應商可能在香港以外的地方儲存或處理你的個人資料，包括澳洲、美國及其他供應商營運所在的地區。我們會採取合理步驟（包括合約安排），確保有關資料獲得與本政策相若的保障。

我們使用必要的 Cookie 以維持登入狀態及保障安全，並使用瀏覽器的本機儲存（local storage 及 IndexedDB）記錄訪客購物車、分類資料快取、顯示主題偏好、未完成的商品刊登草稿，以及同一工作階段內已瀏覽的商品。

我們目前沒有使用第三方廣告或分析 Cookie。如你封鎖必要的 Cookie，你將無法登入本平台。

我們只會在達到收集目的所需的期間內保留你的個人資料：帳戶資料會在帳戶有效期間保留；交易及錢包紀錄會按會計及稅務法例要求保留（一般為最少七年）；登入保安紀錄只會保留有限時間。商品刊登草稿只儲存在你的裝置上，直至你清除為止。

我們採取合理的技術及管理措施保護你的個人資料，包括以 HTTPS 加密傳輸、以雜湊方式儲存密碼及限制資料存取權限。然而，任何經互聯網的傳輸均無法保證絕對安全，請妥善保管你的密碼。

根據《個人資料（私隱）條例》，你有權要求查閱及改正我們持有的你的個人資料。我們可就處理查閱資料要求收取合理費用，並會在收到要求後 40 日內回覆。

你亦可隨時在帳戶設定中更新個人資料、要求刪除帳戶（受第七節所述的法定保留要求限制），或撤回接收促銷訊息的同意。

本平台並非為未滿 18 歲人士而設。未滿 18 歲人士須在父母或監護人同意下使用。如我們得悉在未獲同意的情況下收集了兒童的個人資料，會盡快刪除。

我們可能不時更新本隱私政策，並會在本頁公佈經修訂的版本及新的生效日期。如有重大修訂，我們會透過本平台或電郵通知你。

如你希望查閱或改正個人資料，或對本政策有任何查詢，請以書面方式聯絡我們的私隱事務負責人：香港中環永吉街6-12號誠利商場地下2A舖，或透過「聯絡我們」頁面或 WhatsApp（+852 6438 1398）與我們聯絡。

本文件以中文及英文發佈。如中文版本與英文版本之間有任何歧義或不一致之處，概以英文版本為準。

• Account data: username, email address, password (stored only as a cryptographic hash), name and phone number (if you provide them), profile picture, and language and display-theme preferences.
• Transaction data: orders, items, amounts, the handover or delivery address and contact details you provide at checkout, coupon use and refund requests.
• Payment data: card payments are processed by Stripe. We do not receive or store full card numbers; we keep only the payment status and transaction reference.
• Wallet data: top-ups, deductions (such as listing and promotion fees), earnings and withdrawals, and the bank account or PayPal details you provide for withdrawals.
• Listings and user content: item details and photos, reviews, ratings and wishlists.
• Communications: your conversations and offers with other users on the Platform, and information you provide when you contact us (including by WhatsApp or phone).
• Technical and security data: IP address and browser/device information at sign-in, sign-in session data and, if you enable them, push-notification subscription details.

We use your personal data to:

• create and manage your account, verify your identity and keep your account secure (including detecting suspicious sign-ins);
• provide Platform features, including listing, browsing, messaging, ordering and arranging handovers or delivery;
• process payments, refunds, wallet transactions and withdrawals;
• send service notifications such as email verification, password resets, order updates, message alerts and price-drop alerts for items you have saved;
• display seller information publicly as described in section 3;
• provide customer support and handle disputes;
• improve the Platform using statistics (such as item view counts); and
• comply with legal obligations and respond to lawful requests from law-enforcement or regulatory authorities.

We will not use your personal data in direct marketing without your consent. You may ask us to stop sending marketing messages at any time.

To build trust between buyers and sellers, the following is shown on your public seller page and item pages: username, name (if provided), profile picture, join date, last active date, your listings, reviews you write and receive, and seller badges (official store, verified email, number of completed sales and response rate).

Your email address, phone number and addresses are not shown publicly. Any personal data you share with other users in messages is shared at your own discretion and risk.

We disclose your personal data only:

• to the other party to a transaction, as needed to complete it (for example, to arrange a handover);
• to service providers acting on our behalf, including Stripe (payments), Amazon Web Services (hosting and database), Cloudflare (image storage and delivery), Brevo (email delivery) and browser push-notification services;
• to our professional advisers and auditors;
• where required by law, court order or a lawful request from law-enforcement or regulatory authorities, or where needed to protect the rights and safety of Thai Soul, our users or the public; and
• to a transferee in a business transfer, merger or reorganisation.

We do not sell your personal data.

Our service providers may store or process your personal data outside Hong Kong, including in Australia, the United States and other regions where they operate. We take reasonable steps, including contractual arrangements, to ensure that such data receives protection comparable to this Policy.

We use essential cookies to keep you signed in and to protect security, and your browser's local storage (local storage and IndexedDB) to remember guest shopping carts, cached category data, your display-theme preference, unfinished listing drafts and items already viewed in the same session.

We do not currently use third-party advertising or analytics cookies. If you block essential cookies, you will not be able to sign in to the Platform.

We keep personal data only for as long as necessary for the purposes for which it was collected: account data while your account is active; transaction and wallet records as required by accounting and tax laws (generally at least seven years); and sign-in security records for a limited period. Listing drafts are stored only on your device until you clear them.

We take reasonable technical and organisational measures to protect your personal data, including HTTPS encryption in transit, hashed password storage and restricted access to data. However, no transmission over the internet can be guaranteed to be completely secure, so please keep your password confidential.

Under the Personal Data (Privacy) Ordinance, you have the right to request access to, and correction of, the personal data we hold about you. We may charge a reasonable fee for processing a data access request and will respond within 40 days of receiving it.

You may also update your details in your account settings at any time, ask us to delete your account (subject to the statutory retention requirements described in section 7), or withdraw your consent to receiving marketing messages.

The Platform is not intended for persons under 18. Persons under 18 may use it only with the consent of a parent or guardian. If we learn that we have collected personal data from a child without such consent, we will delete it as soon as practicable.

We may update this Privacy Policy from time to time and will publish the revised version on this page with a new effective date. If the changes are significant, we will notify you through the Platform or by email.

To request access to or correction of your personal data, or for any questions about this Policy, please write to our Privacy Officer at Shop 2A, G/F, Shing Lee Commercial Building, 6-12 Wing Kut Street, Central, Hong Kong, or contact us through the "Contact us" page or by WhatsApp (+852 6438 1398).

This document is published in Chinese and English. In the event of any ambiguity or inconsistency between the Chinese version and the English version, the English version shall prevail.