Website policy · CIRQUVIA

Privacy Policy

How HONG KONG XIN ZONG SHAN LIMITED, which operates the CIRQUVIA brand, handles website access information, business enquiries and consented Google Analytics and Ads measurement.

Last updated 26 October 2026English version

1. Who we are

CIRQUVIA is a brand operated by HONG KONG XIN ZONG SHAN LIMITED, a Hong Kong limited company. Our registered office is Room 701, Unit 108, 7/F, Tower B, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui, Kowloon, Hong Kong.

For the personal data covered by this policy, HONG KONG XIN ZONG SHAN LIMITED is responsible for deciding why and how that data is used, unless a third-party service acts independently under its own policy.

2. Scope of this policy

This policy covers visits to cirquvia.com, technical access and security records generated in connection with the website, information submitted through the website enquiry form, emails sent to CIRQUVIA, messages sent to our published WhatsApp contact, consent preferences and consented Google Analytics and Ads measurement.

It does not cover third-party websites or applications when they process data for their own purposes. The current website does not provide customer accounts, online checkout, payment collection or a customer portal.

3. Personal data we may handle

Business enquiry data

When you contact us through the website form, by email or through WhatsApp, we may receive your name, job title, company, business email address, telephone or WhatsApp number, country or region, requested products, quantity, grade, delivery requirements, message, attachments and the history of our communications. Fields marked with an asterisk in the website form are required to process that form; other fields are optional.

For website-form submissions, we also record the landing page and language used, available campaign-source parameters, the requested delivery country and whether optional advertising measurement was accepted or rejected. These details support enquiry routing, source attribution, consent records and follow-up; rejecting advertising measurement still allows submission.

Technical and security data

The website is published through Cloudflare Workers and delivered and protected using Cloudflare infrastructure. Cloudflare may automatically process IP address, request time, requested URL, referring page, browser, device or operating-system information, network identifiers and security-event details to deliver and secure the website.

After you accept optional Google measurement, the Google Analytics tag may process traffic source, pages viewed, scrolls, outbound links, engagement time, approximate location and device information. We do not send form fields, contact details or Lead IDs as analytics events. The Google Ads destination may process page URL, referring page, browser or device information, IP address, consent signals, advertising-cookie identifiers and ad-click identifiers to report a successful enquiry-form submission or a click on a published sales email or WhatsApp link as a conversion. The form fields and message are not included in those conversion events. The Ads destination is not configured without Ads consent or after its withdrawal.

Providing enquiry information is voluntary. If you do not provide a working contact method and enough information about your request, we may be unable to reply or prepare a quotation.

Please do not send passports, complete bank-card details, health information or other unnecessary sensitive information by ordinary email or WhatsApp.

4. Why we use personal data

To respond to B2B enquiries and prepare requested quotations.
To communicate about product requirements, availability, quality, logistics, contracts and after-sales matters.
To protect the website, company systems and communications against misuse, fraud and security incidents.
To route form submissions to authorised staff, notify the relevant internal mailbox and manage enquiry follow-up using Google Apps Script and Google Sheets.
With your consent, to report a successful form submission or a click on a published sales email or WhatsApp link as a Google Ads conversion and measure campaign effectiveness.
With your consent, to use Google Analytics 4 to understand website sources, pages and engagement, and count saved enquiries without sending form contents or contact details in analytics events.
To maintain business, accounting, tax and dispute records where required or reasonably necessary.
To establish, exercise or defend legal claims.

Under Hong Kong law, we aim to collect data lawfully, fairly and only to the extent necessary for directly related purposes. Where EU or UK data-protection law applies, the relevant basis may include steps requested before a contract, our legitimate interests in responding to business enquiries and operating a secure B2B service, or a legal obligation. Consent will be used where the law requires it.

6. International processing and transfers

HONG KONG XIN ZONG SHAN LIMITED operates from Hong Kong. If you contact us from another country, your enquiry is transferred to and handled in Hong Kong. Cloudflare, Google Workspace services including Google Sheets and Google Apps Script, WhatsApp and, after consent, Google Analytics and Ads may also process data in jurisdictions where their infrastructure, group companies or authorised personnel operate.

We use the contractual protections offered by these providers, encrypted transmission and access controls. Where applicable law requires a specific international-transfer mechanism, the relevant provider arrangement and transfer are subject to that requirement.

Google Analytics and Ads may process consented measurement data in the jurisdictions where Google and its authorised subprocessors operate, subject to Google's applicable data-protection terms.

7. How long we keep data

Retention depends on the purpose, relationship and legal requirement. The following retention periods apply to information controlled by us:

Unsuccessful or inactive B2B enquiries: up to 24 months after the last substantive interaction, unless a shorter period is requested or a dispute requires preservation.
Website-form submissions, internal notification copies and enquiry records held in Google Workspace normally follow the same 24-month inactive-enquiry period and are reviewed for deletion when no longer needed. A resulting transaction, legal obligation, fraud or dispute may require a longer period.
Company-controlled copies of routine website or security logs, if any: normally no more than 90 days, unless longer preservation is reasonably necessary for a security incident, legal claim or legal obligation. Hosting and security providers retain their own logs under their service settings and legal obligations.
Contract, invoice, payment and qualifying business records: for the applicable legal period; Hong Kong business records may need to be retained for at least seven years.
Minimal opt-out or objection records: as needed to continue respecting the request.
The website's consent preference: 180 days on the visitor's device. Google retains analytics and advertising measurement data and cookies according to the relevant account settings and Google's published retention terms.

8. Security

We use proportionate safeguards including encrypted transmission, restricted administrative access, service-provider controls, backups and security logging where available, and incident handling. No internet transmission or storage system can be guaranteed to be completely secure.

9. Your choices and rights

Under Hong Kong's Personal Data (Privacy) Ordinance, you may request access to and correction of personal data held about you, subject to applicable conditions and exceptions.

Where the GDPR or UK GDPR applies, you may also have rights to erasure, restriction, objection, portability, withdrawal of consent and complaint to a supervisory authority. These rights depend on the circumstances and are not absolute. We may reasonably verify identity before responding.

You may object at any time to the use of your personal data for direct marketing. The current website does not collect newsletter subscriptions and does not use automated decision-making that has legal or similarly significant effects.

To exercise an applicable right, email sales@cirquvia.com with the subject line “Privacy Request” or write to our registered office. Tell us the right you wish to exercise and provide enough information to identify the relevant records. We may request proportionate proof of identity and will respond within the period required by applicable law.

10. Website forms, email, WhatsApp and external services

The website enquiry form sends the information you choose to provide through the site's hosting path to Google Apps Script and Google Sheets so authorised CIRQUVIA staff can receive an internal notification and follow up. An email link opens your chosen email service, and a WhatsApp link takes you into a third-party environment. Those services process data under their own terms and privacy policies. After CIRQUVIA receives your enquiry, our use of it is covered by this policy.

Rejecting optional Google measurement does not prevent you from submitting the enquiry form or receiving a response.

11. Children

This is a B2B website intended for professional buyers and is not directed to children. We do not knowingly request children's personal data through this website.

12. Changes to this policy

We may update this policy when the website, service providers, legal requirements or business processes change. The date and version will be updated, and material changes will be communicated where required.

13. Price list email verification

When you request access to indicative prices, we use your name, business email and optional company name to send a one-time verification link and maintain access for up to seven days. The link expires after 15 minutes. We store a hashed email and IP address for abuse prevention; these request records are removed after 24 hours during subsequent access requests. Your browser receives an essential, HttpOnly access cookie. For requests made after the updated disclosure, successful verification also creates a retained customer record with your name, normalized email, optional company, language, first and latest verification dates, verification count and latest successful price access time. It remains after the access cookie expires for quote access management and business contact, subject to the retention and deletion provisions of this policy. Repeated verification of the same email updates one record. This does not subscribe you to marketing emails, and the record is not used for advertising measurement.

14. Consented website visitor grouping

After you accept analytics measurement, our server uses the public IP supplied by Cloudflare to derive a pseudonymous network identifier with a server-held key (HMAC). The website analytics database stores this identifier, not the plain IP. Consented visits from the same public IP are grouped across browsers and sessions, with page views, engagement and contact actions retained. People sharing an address may be grouped together; a changed address may create a separate record. Records without a network identifier remain separate and are excluded from network visitor counts. This identifier is not an email identity or proof of a customer relationship. Rejecting analytics prevents this collection; company and admin traffic exclusions still apply. If the server key changes, future identifiers change. Retention and deletion follow this policy.

15. Website statistics by Cloudflare Web Analytics

We use Cloudflare Web Analytics. Cloudflare adds its script to website pages as they are delivered. With our current setting, Cloudflare does not collect these statistics from visitors who connect through its data centres in the EU or EEA, Switzerland or the United Kingdom. The data centre used depends on network routing, so a visitor located in one of those places may sometimes connect through a data centre elsewhere. Where it does run, it runs whether or not you accept optional Google measurement, and neither your consent choice nor our company-traffic exclusion applies to it. According to Cloudflare, the script does not set cookies or use browser storage such as localStorage, and Cloudflare does not use it to track individual visitors across websites. The script reads page-loading performance measurements from your browser and sends them with the address of the page viewed and the referring page; Cloudflare may also derive the approximate country and the browser, device and operating-system type from the request. Cloudflare states that Web Analytics does not log URL query strings and does not currently report campaign (UTM) parameters, and that for this service it discards the IP address at its nearest data centre. Cloudflare’s processing of requests to deliver and protect the website is described in section 3.

We use the resulting aggregated statistics to understand overall visits and site performance; they are kept separate from Google Analytics and our own website analytics, and we do not combine them with enquiry records. Where EU or UK data-protection law applies to personal data processed through this service, we rely on our legitimate interest in understanding overall website traffic and performance. Rules on accessing information on your device apply separately from that legal basis, and a legitimate interest does not replace consent where consent is required. We are reviewing how these rules apply to this service and will update this notice and our setup if needed.

Cloudflare, Inc. is based in the United States. According to Cloudflare, these data are generally processed at the data centre that receives the request, which may be in a different country or region from where you are, and its customer data processing addendum describes the international-transfer safeguards it offers, such as standard contractual clauses. Cloudflare states that it keeps detailed Web Analytics data for 7 days and then reduces them to a sample of about 10% for longer-term storage; our dashboard shows the previous six months. This describes the service; it is not a deletion date for all underlying data. Where personal data are involved, sections 6 and 9 also apply, including your rights under Hong Kong’s Personal Data (Privacy) Ordinance. You can block the script with browser or extension settings without affecting your use of the website.