Privacy Policy

Privacy Policy and Personal Information Collection Statement

Introduction

TZCJ Company Limited (trading as NOSH Direct), from time to time, (collectively “we”, “us”, “our”, the “Company”) respects your privacy and is committed to maintain your personal data in accordance with the requirements of the Personal Data (Privacy) Ordinance (the "Ordinance") and to the extent applicable. We take all practicable steps to ensure the collection, transmission, storage and usage of your personal data complies with the Ordinance. In relation to personal data supplied to us through our website, social media or otherwise, any use of our website and web applications or your continued relationship with us shall be deemed to be your acceptance and consent to this Privacy Policy as amended from time to time.

1. Important Information

i. PURPOSE OF THIS PRIVACY POLICY

This privacy policy aims to summarize how we collect, use, and disclose personal information from you when you use our website, web applications and services.

It is important that you read this Privacy Policy in conjunction with other notices we provide so that you are fully aware of how and why we are collecting and using your personal data.

ii. CONTACT DETAILS

If you have any questions about this Privacy Policy or complaints on the collection and use of your personal information or wish to access or correct your personal information, please contact us at:

Company name: NOSH Direct

iii. CHANGES TO PRIVACY POLICY

The Policy may be amended from time to time to the extent permitted by any laws and regulations applicable in Hong Kong. Any changes made will be posted in this page. Where any changes to this Privacy Policy are material, we will notify you using the contact details you have provided us with and, where required by the Ordinance, give you the opportunity to opt out of these changes by means notified to you at that time.

iv. THIRD-PARTY LINKS

Our web applications and our services may include links to third‐party websites, plug‐ins, and applications not controlled by us. We assume no responsibility for the act or practice relating to personal data of these third-party websites that a user is able to access through ours. When you link to third-party websites, our privacy policy or practices no longer apply. We encourage you to read the privacy policy of such third-party and if needed make appropriate enquiry before disclosing any personal data to such third-party.

2. The data we collect

i. PURPOSE OF COLLECTION AND USE OF PERSONAL DATA

From time to time we may collect your personal data including but not limited to your name, address, telephone number, email address, date of birth and login name for the following purposes:

to process your applications, subscriptions and registration for our products or services;
to provide you with our products and services and administer your account in relation to such products and services;
to conduct identity verification;
to conduct research, statistical, marketing and technical analysis;
to handle your complaints and enquiries;
to comply with applicable laws, rules and regulations;
to enforce our legal rights;
to carry out daily operation and administration;
for marketing purposes;
other purposes directly relating to any of the above.

ii. COLLECTION OF DATA

When you use our websites, web applications and services, we may collect or obtain different types of personal data via different channels. Data collected may include personal and contact information (such as salutation, name, gender, marital status, month of birth, age range, company name, telephone number, email address, address, account profile, membership number, identification proof, document or numbers, social media account details, relevant log-in information which you use to access our services), payment information, technical data (such as MAC addresses and IP addresses), usage data, tracking data, marketing and communication data, in connection with our provision of products or services.

We may collect your data in various forms, such as, by way of websites, web applications, forms, surveys, post, phone, email or otherwise. We may also collect technical data, browsing patterns and action via automated technologies. We may also receive data from third parties such as analytics providers, search engines, payment gateway providers.

iii. IF YOU FAIL TO PROVIDE YOUR PERSONAL DATA

The provision of personal data or any information is voluntary. In the event that you decline to provide the necessary personal data or information requested by us or provide inaccurate personal data or information to us, we may be unable to provide you with products or services, or unable to process your requests or applications or cancel your orders or requests. We will notify you if this is the case.

iv. ACCURACY OF PERSONAL DATA

Application or subscription for our products or services may be subject to assessment and verification of your personal data. If we regard the results of such checking as unsatisfactory, we will not enter into an agreement with you for provision of our products or services.

v. USE OF PERSONAL DATA

We will keep your personal data confidential at all times. We may use and retain the personal data or information provided by you for the following purposes and for other purposes as shall be agreed between you and us or required by law from time to time:

to process your applications, subscriptions and registration for our services;
to provide you with our products and services and administer your account in relation to such products and services;
to conduct identity verification;
to conduct research, statistical, marketing and technical analysis;
to handle your complaints and enquiries;
to comply with applicable laws, rules and regulations;
to enforce our legal rights;
to carry out daily operation and administration;
for marketing purposes (subject to your consent, contacting you for direct marketing activities);
other purposes directly relating to any of the above.

If express consent for collection, use, disclosure and processing of personal data for certain purposes is required by applicable laws and regulations, we will collect, use, disclose and process personal data upon obtaining express consent. However, to the extent permitted by applicable laws and regulations, you will be deemed to have consented to our collection, use, disclosure and processing of your personal data for certain purposes when you provide your personal data to us in accordance with this Privacy Policy.

vi. DATA HANDLER

In carrying out our operations, providing services or products to you or for the purposes outlined in this Privacy Policy or otherwise agreed between you and us, we may engage third parties (including any business partner, any affiliated companies, any agent, contractor or third party, which provides administrative, audit, data-processing, document management, technology, telecommunication, storage, payment or other services (including direct marketing services), any actual or potential assignee, transferee, participant or sub-participant of our rights or business, or any of our professional advisers), which may be based in Hong Kong or elsewhere, and may disclose or transfer your personal data to them under a duty of confidentiality to the same.

Your personal data may be disclosed to third parties without consent to the extent permitted by applicable laws in certain situations, including the following (which are not exhaustive):

cases in which the disclosure is required based on the applicable laws and/or regulations;
cases in which the purpose of such disclosure is clearly in your interests, and if consent cannot be obtained in a timely way provided that we will, as soon as may be practicable, notify you of the disclosure and the purposes of the disclosure;
cases in which there are reasonable grounds to believe that the health or safety of yourself or another individual will be seriously affected and consent for the disclosure of the data cannot be obtained in a timely way, provided that we will, as soon as may be practicable, notify you of the disclosure and the purposes of the disclosure;
cases in which the disclosure is necessary for any investigation or proceedings.

In all other instances of disclosure of personal data to third parties with your express consent, we will endeavour to provide adequate supervision over the handling and administration of your personal data by such third parties, and to provide for adequate forms of protection over such personal data.

Where personal data is transferred by us to any third parties outside Hong Kong, we will ensure that such transfers are compliant with the requirements under the Ordinance or the applicable laws, as the case may be. In this regard, we will take such necessary measures to ensure that such overseas recipients are bound by legally enforceable obligations to ensure that these overseas recipients provide a standard of protection to the personal data so transferred that is comparable to the protection under the Ordinance, if required by law.

3. Marketing

We will endeavour to provide you with the best personalised experience, therefore, subject to your consent and where permitted by the applicable laws, we may use or provide to third parties (whether in Hong Kong or otherwise) your personal data for direct marketing purposes or for gain. You may withdraw your consent any time by writing to our personal data officer at hello@noshdirect.com

Subject to your consent, you may receive marketing communications or materials from us if you have used our website or web applications or purchased products or services from us, and in each case, you have not opted out of receiving that marketing material.

4. Cookies

We may use cookies and other tools on our website. By using our website, you are agreeing to us storing cookies on your computer, mobile phones or other devices for providing a personalised browsing experience to you and enhancing IT security measures. You can set your browser to refuse all or some cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, some parts of our website may become inaccessible or may not function properly.

5. Data security

The physical records and electronic records of your personal data will be stored in secured places (whether within or outside Hong Kong) with restricted access by us or those who we share your personal data with in accordance with this Privacy Policy or in our servers or servers of our agents or contractors as our data processors (whether within or outside Hong Kong) located in secured places and protected by appropriate IT security measures against loss, unauthorised access, use, modification or disclosure. We will limit the granting of access to your personal data to persons on a "need-to-know" and "need-to-use" basis. In any event, those who have been granted access to your personal data are subject to the same duty of confidentiality.

6. Data retention period

We will only retain your personal data or information for as long as necessary to fulfil the purposes stated in this Privacy Policy, for the purposes of satisfying any legal, statutory, regulatory or accounting requirements, or as otherwise specified at the time of collection. If you are a subscriber or a customer of our services, your personal data will be retained for a reasonable period after termination of your subscription for verification and audit purposes. In some circumstances after you cease being a customer or subscriber, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

7. Data transfer

Our affiliated companies – we may share your personal information with our affiliated companies for the above-mentioned purposes of collection.
We may hold your data on servers in Hong Kong and any other territories as we see fit from time to time. We may also transfer your data to our overseas offices or employees who may be located in or outside of the Hong Kong Special Administrative Region.

8. Your rights

You may request to access and/or correct the personal data currently in our possession at any time by submitting your request to the person stated in section 1(ii) above.

For a request to access personal data, we will seek to provide you with the relevant personal data within 40 days upon receipt of such request. Where we are unable to respond to you within the said period, we will notify you of the reason why we are not able to do so, subject to the exemptions provided under the Ordinance or the applicable laws.

For a request to correct personal data, we will seek to correct your personal data (if any) within 40 days upon receipt of the request. Where we are unable to do so within the said period, we will notify you of the reason why we are not able to do so, subject to the exemptions provided under the Ordinance or the applicable laws. We will send the corrected personal data to such third parties to which the personal data was disclosed by us within a year before the date the correction was made, unless that we have reason to believe that the third party has ceased using the data for the purpose (including any directly related purpose) for which the data was disclosed to the third party. Notwithstanding the aforesaid, we may, if you so consent, send the corrected personal data only to specific third parties to which the personal data was disclosed by us within a year before the date the correction was made.

Depending on the nature of the work required to process your access request or correction request, we may charge you a reasonable fee for the handling and processing of your requests to access your personal data or to correct your personal data to recover administrative costs. Where such a fee is to be imposed, we will provide you with a written estimate of the fee for your consideration. We will only begin processing your access request or correction request upon receiving your agreement to the payment of the fee.

You may withdraw your consent for the collection, use, process and/or disclosure of your personal data in our possession or under our control at any time by submitting your request to our personal data officer at hello@noshdirect.com. Please note that we may require 10 business days to process your request and to give effect to the withdrawal, and will thereafter refrain from collecting, using, processing and/or disclosing your personal data in the manner stated in your request. However, if you choose to withdraw your consent, we may not be able to fulfil the purposes for which we require the personal data, including for us to contact you or to provide some or all of the products or services which you may need from us.