Privacy Policy

1. Personal Data We Collect

We may collect the following categories of personal data:

2. How We Collect Your Data

We collect personal data through the following means:

• when you voluntarily provide it by registering an account, completing forms, purchasing Templates or contacting us;
• automatically when you browse or use the Website, through cookies, server logs and analytics tools; and
• from payment service providers (such as AsiaPay PayDollar) in the form of transaction confirmation and necessary order-related information.

3. How We Use Your Data

We will only use your personal data in a lawful, fair and necessary manner. The main purposes include:

• Providing services: processing your orders, providing Template downloads, managing your account and performing our contract with you;
• Customer communications: sending order confirmations, download links, account notices, responding to enquiries and providing customer support;
• Payment processing: collaborating with payment service providers to complete transactions and prevent fraud;
• Improving our services: analysing Website usage, optimising user experience and developing new features;
• Security and compliance: protecting the security of the Website and users, preventing fraud, abuse and illegal activities, and complying with legal obligations; and
• Direct marketing (where applicable): with your consent, sending you information about new Templates, promotions or related services. You may opt out at any time.

4. Data Sharing and Third Parties

We do not sell your personal data. In order to operate the Website and provide our services, we may share data with the following categories of service providers on a need-to-know basis:

• Payment processors: AsiaPay (PayDollar) and other designated payment service providers, for the purpose of processing payments and preventing fraud;
• Cloud and technology service providers: such as Supabase or other hosting/database providers, for the storage of account and transaction data;
• Email and communication service providers: for sending transactional notices and customer support messages; and
• Professional advisers and legal requirements: we may disclose data to lawyers, accountants, law enforcement or regulatory authorities where required by law, court order, or to protect our legitimate interests.

5. Cross-Border Data Transfer

Your personal data is primarily processed and stored in Hong Kong. Some of our service providers (for example, cloud hosting or payment services) may have servers located outside Hong Kong.

When we transfer data outside Hong Kong, we will take all reasonably practicable steps to ensure that the recipient provides a level of protection for the data comparable to that required under the PDPO, or we will obtain your consent where permitted by law.

6. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, as follows:

• Account data: retained while your account remains active. After the account is closed or you request deletion, we will delete or anonymise the data within a reasonable time (except where retention is required by law);
• Transaction and order records: generally retained for up to 7 years to comply with accounting, tax and legal requirements;
• Customer communication records: generally retained for 2 to 3 years, or until the relevant matter has been resolved; and
• Website usage logs: usually retained for a shorter period (e.g. several months) for security and analytical purposes.

7. Data Security

We implement reasonably practicable technical and organisational measures to protect your personal data against unauthorised or accidental access, processing, erasure, loss or use, including:

• using encryption (HTTPS) for the transmission of sensitive data;
• restricting access by staff and service providers on a "need-to-know" basis;
• regularly reviewing our security measures and systems; and
• requiring third-party service providers to comply with appropriate data protection obligations.

8. Cookies and Similar Technologies

We use necessary cookies and similar technologies to ensure the proper functioning of the Website, including:

• Necessary cookies: used for authentication, session management, shopping cart functionality and Website security; and
• Functional cookies: used to remember your preferences (such as language settings).

9. Your Rights (Data Subject Rights)

Under the PDPO, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you;
• Right of correction: to request the correction of inaccurate personal data;
• Right to request erasure: to request the erasure of your personal data in circumstances where the data is no longer necessary for the purpose for which it was collected, or where you have withdrawn your consent (subject to any legal retention requirements);
• Right to object: to object to our use of your data for direct marketing; and
• Right to withdraw consent: where we rely on your consent to process data, you may withdraw that consent at any time (this will not affect the lawfulness of processing based on consent before its withdrawal).

10. Direct Marketing

We will only use your name and email address to send you direct marketing information about new EasyBooth Templates, promotions, events or related services after obtaining your explicit consent.

You may opt out at any time by using the "unsubscribe" link in marketing emails or by emailing privacy@easybooth.com. We will process your request within a reasonable time.

11. Children's Privacy

The services of this Website are not directed at persons under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have inadvertently collected such data, we will delete it as soon as practicable. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us.

12. Updates to this Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology or our business practices. The updated Policy will be published on this Website with a revised "Last Updated" date. For material changes, we may notify you via the Website or by email (where applicable). You are advised to review this Policy periodically. Continued use of the Website constitutes your acceptance of the updated Policy.