Privacy Policy for Broccoli Prince & Friends

The website www.broccoliprince.com is operated by NUTRIALLEY COMPANY LIMITED for the Broccoli Prince & Friends brand. For the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the “PDPO”), NUTRIALLEY COMPANY LIMITED is the data user that controls the collection, holding, processing, and use of personal data described in this Privacy Policy.

This Privacy Policy explains the policies and practices of NUTRIALLEY COMPANY LIMITED concerning personal data collected through www.broccoliprince.com, including the kinds of personal data we hold, the purposes for which we use it, the parties to whom it may be disclosed or transferred, and the measures we take to protect it. Please read this Privacy Policy before using the website or providing personal data to us.

We take care of your personal data and undertake to guarantee its confidentiality and security.

Personal Information Collection Statements: Where we collect personal data directly through an order page, registration form, newsletter form, contact form, promotion, or other collection channel, we will provide an appropriate collection notice at or before collection. The notice will explain whether providing the data is voluntary or obligatory, the consequences of not providing obligatory data, the purposes of use, the classes of possible transferees, any applicable direct-marketing information, and how to request access to and correction of personal data.

Personal information we collect:

When you visit www.broccoliprince.com, we may automatically collect technical and usage information about your device and interaction with the website, including your browser type, IP address, time zone, cookies stored on your device, pages or products viewed, referring websites or search terms, and website interactions (“Device Information”). We may also collect personal data that you choose to provide when you register, place an order, subscribe to communications, submit a form, or contact us, including your name, contact details, delivery address, account information, and payment-related information. Please do not provide personal data that is not reasonably necessary for the relevant service or transaction.

Cookies and similar technologies: The website may use cookies and similar technologies to operate essential features, remember preferences, assess website performance, and understand how visitors use the website. Where these technologies collect or generate personal data, that data will be handled in accordance with this Privacy Policy. You may manage cookies through your browser or the website’s available consent controls, although disabling essential cookies may affect website functionality.

Why do we process your data?

We use personal data only for purposes that are directly related to our functions and activities, including operating and securing the website; detecting and preventing misuse, fraud, and technical problems; processing registrations, enquiries, orders, payments, deliveries, returns, and customer service requests; maintaining business and transaction records; complying with legal and regulatory obligations; and producing aggregated or de-identified statistics to understand and improve website performance. We will not use personal data for a new purpose unless that purpose is directly related to the original purpose or we have obtained any consent required by law.

You may browse the website without creating an account or directly identifying yourself, although technical and usage information may still be collected as described above. When you use particular features, such as placing an order, subscribing to a newsletter, submitting a form, or contacting us, we may ask for personal data including your email address, first and last name, delivery or residential address, organisation, and telephone number. Unless a collection notice states otherwise, providing personal data is voluntary. However, if particular information is necessary to process a transaction, provide a requested service, or respond to an enquiry, we may be unable to do so if you do not provide it. Questions about whether a particular item is required may be sent to hello@nutrialley.com.

Your rights:

Under the PDPO, you have the right to request access to personal data that we hold about you and to request correction of personal data that is inaccurate. We may require reasonable information to verify your identity and locate the relevant records, and we will handle requests within the time and in the manner required by applicable Hong Kong law. A reasonable fee may be charged for processing a data access request where permitted by law.

• The right to be informed.

• The right of access.

• The right to rectification.

• The right to erasure.

• The right to restrict processing.

• The right to data portability.

• The right to object.

• Rights in relation to automated decision-making and profiling.

To request access to or correction of your personal data, please contact the person responsible for handling privacy requests at NUTRIALLEY COMPANY LIMITED by email at hello@nutrialley.com. Please identify the personal data concerned and provide sufficient information for us to verify your identity and locate the relevant records.

If personal data is transferred or made accessible outside Hong Kong in connection with our website, service providers, payment processing, order fulfilment, or other business operations, we will take reasonably practicable steps to ensure that the recipient handles the personal data consistently with this Privacy Policy and applicable legal requirements. The locations and recipient categories applicable to a particular service should be disclosed at or before collection where required.

Direct marketing: We will not use your personal data to send marketing communications unless we have informed you of the intended use and obtained any consent required by the PDPO. Marketing communications will identify a method for opting out. You may ask us at any time, without charge, to stop using your personal data for direct marketing by contacting hello@nutrialley.com.

Disclosure and transfers: We may disclose or transfer personal data to service providers that support our website and business operations, such as hosting, information technology, analytics, payment, fraud-prevention, customer-service, logistics, delivery, professional-advisory, and records-management providers. We may also disclose personal data to regulators, law-enforcement bodies, courts, or other persons where required or permitted by law. These recipients may use personal data only for the relevant service, legal, or regulatory purpose and must protect it appropriately.

Links to other websites:

Our website may contain links to other websites that are not owned or controlled by us. Please be aware that we are not responsible for such other websites or third parties' privacy practices. We encourage you to be aware when you leave our website and read the privacy statements of each website that may collect personal information.

Retention: We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, meet legal, accounting, tax, dispute-resolution, and record-keeping requirements, and protect our legitimate interests. When personal data is no longer required, we will take reasonably practicable steps to erase it or make it anonymous, subject to any lawful retention requirement.

Information security:

We take reasonably practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss, or use. These measures may include administrative, technical, and physical safeguards appropriate to the nature of the data and the risks involved, as well as contractual confidentiality and security obligations for service providers that process personal data on our behalf. No method of transmission over the Internet or method of electronic storage is completely secure, and we therefore cannot guarantee absolute security.

Legal disclosure:

We may disclose personal data where the disclosure is required or permitted by applicable law, a court order, or a lawful request from a regulator or public authority. Where permitted, we may also disclose personal data when reasonably necessary to establish, exercise, or defend legal rights; prevent or investigate suspected fraud or unlawful activity; or protect the safety and rights of individuals. We will limit any disclosure to information reasonably necessary for the relevant purpose.

Contact information:

Effective date and updates: This Privacy Policy takes effect on the date shown with the published version. We may revise it from time to time to reflect changes to our practices, services, or legal requirements. The updated version will be posted on this page with a revised effective date. Where a change materially affects how we use personal data already collected, we will provide any additional notice or obtain any consent required by law.

For questions about this Privacy Policy, our handling of personal data, or a request concerning your personal data, please contact NUTRIALLEY COMPANY LIMITED at hello@nutrialley.com. Data access and correction requests should be directed to the person responsible for handling privacy requests and should include sufficient information to identify the requester and the relevant records. The published version of this policy should also state that person’s name or job title and the company’s current business address.