Privacy Policy

1. Who we are

CIRQUVIA is a brand operated by HONG KONG XIN ZONG SHAN LIMITED, a Hong Kong limited company. Our registered office is Room 701, Unit 108, 7/F, Tower B, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui, Kowloon, Hong Kong.

For the personal data covered by this policy, HONG KONG XIN ZONG SHAN LIMITED is responsible for deciding why and how that data is used, unless a third-party service acts independently under its own policy.

2. Scope of this policy

This policy covers visits to cirquvia.com, technical access and security records generated in connection with the website, information submitted through the website enquiry form, emails sent to CIRQUVIA, messages sent to our published WhatsApp contact, consent preferences and consented Google Ads conversion measurement.

It does not cover third-party websites or applications when they process data for their own purposes. The current website does not provide customer accounts, online checkout, payment collection or a customer portal.

3. Personal data we may handle

Business enquiry data

When you contact us through the website form, by email or through WhatsApp, we may receive your name, job title, company, business email address, telephone or WhatsApp number, country or region, requested products, quantity, grade, delivery requirements, message, attachments and the history of our communications. Fields marked with an asterisk in the website form are required to process that form; other fields are optional.

For website-form submissions, we also record the landing page and language used, available campaign-source parameters, the requested delivery country and whether optional advertising measurement was accepted or rejected. These details support enquiry routing, source attribution, consent records and follow-up; rejecting advertising measurement still allows submission.

Technical and security data

The website is published through OpenAI Sites and delivered and protected using Cloudflare infrastructure. These providers may automatically process IP address, request time, requested URL, referring page, browser, device or operating-system information, network identifiers and security-event details to deliver and secure the website.

After you accept advertising measurement, the Google Ads Google tag may process page URL, referring page, browser or device information, IP address, consent signals, advertising-cookie identifiers and ad-click identifiers to report a successful enquiry-form submission or a click on a published sales email or WhatsApp link as a conversion. The form fields and message are not included in those conversion events. The tag is blocked before initial acceptance and on page loads after rejection or withdrawal.

Providing enquiry information is voluntary. If you do not provide a working contact method and enough information about your request, we may be unable to reply or prepare a quotation.

Please do not send passports, complete bank-card details, health information or other unnecessary sensitive information by ordinary email or WhatsApp.

4. Why we use personal data

• To respond to B2B enquiries and prepare requested quotations.
• To communicate about product requirements, availability, quality, logistics, contracts and after-sales matters.
• To protect the website, company systems and communications against misuse, fraud and security incidents.
• To route form submissions to authorised staff, notify the relevant internal mailbox and manage enquiry follow-up using Google Apps Script and Google Sheets.
• With your consent, to report a successful form submission or a click on a published sales email or WhatsApp link as a Google Ads conversion and measure campaign effectiveness.
• To maintain business, accounting, tax and dispute records where required or reasonably necessary.
• To establish, exercise or defend legal claims.

Under Hong Kong law, we aim to collect data lawfully, fairly and only to the extent necessary for directly related purposes. Where EU or UK data-protection law applies, the relevant basis may include steps requested before a contract, our legitimate interests in responding to business enquiries and operating a secure B2B service, or a legal obligation. Consent will be used where the law requires it.

5. Who may receive the data

We may share data only as reasonably needed with OpenAI Sites and Cloudflare for website publishing, form delivery and security; Google Workspace, including Gmail, Google Sheets and Google Apps Script, for internal notification, enquiry records and follow-up; WhatsApp when you choose that channel; and providers of IT support, backup, logistics, payment, accounting, legal or other professional services relevant to your enquiry or a resulting transaction. We may also disclose data when legally required or in connection with a genuine corporate reorganisation.

After consent, Google may receive advertising measurement data through the Google Ads Google tag. The conversion event does not include the information entered in the enquiry form. Google handles conversion data under its applicable terms and privacy documentation.

We do not sell or rent personal data and do not provide it to third parties for their independent marketing.

6. International processing and transfers

HONG KONG XIN ZONG SHAN LIMITED operates from Hong Kong. If you contact us from another country, your enquiry is transferred to and handled in Hong Kong. OpenAI Sites, Cloudflare, Google Workspace services including Google Sheets and Google Apps Script, WhatsApp and, after consent, Google Ads may also process data in jurisdictions where their infrastructure, group companies or authorised personnel operate.

We use the contractual protections offered by these providers, encrypted transmission and access controls. Where applicable law requires a specific international-transfer mechanism, the relevant provider arrangement and transfer are subject to that requirement.

Google Ads may process consented advertising measurement data in the jurisdictions where Google and its authorised subprocessors operate, subject to Google's applicable data-protection terms.

7. How long we keep data

Retention depends on the purpose, relationship and legal requirement. The following retention periods apply to information controlled by us:

• Unsuccessful or inactive B2B enquiries: up to 24 months after the last substantive interaction, unless a shorter period is requested or a dispute requires preservation.
• Website-form submissions, internal notification copies and enquiry records held in Google Workspace normally follow the same 24-month inactive-enquiry period and are reviewed for deletion when no longer needed. A resulting transaction, legal obligation, fraud or dispute may require a longer period.
• Company-controlled copies of routine website or security logs, if any: normally no more than 90 days, unless longer preservation is reasonably necessary for a security incident, legal claim or legal obligation. Hosting and security providers retain their own logs under their service settings and legal obligations.
• Contract, invoice, payment and qualifying business records: for the applicable legal period; Hong Kong business records may need to be retained for at least seven years.
• Minimal opt-out or objection records: as needed to continue respecting the request.
• The website's consent preference: 180 days on the visitor's device. Google retains advertising measurement data and cookies according to Google Ads settings and Google's published retention terms.

8. Security

We use proportionate safeguards including encrypted transmission, restricted administrative access, service-provider controls, backups and security logging where available, and incident handling. No internet transmission or storage system can be guaranteed to be completely secure.

9. Your choices and rights

Under Hong Kong's Personal Data (Privacy) Ordinance, you may request access to and correction of personal data held about you, subject to applicable conditions and exceptions.

Where the GDPR or UK GDPR applies, you may also have rights to erasure, restriction, objection, portability, withdrawal of consent and complaint to a supervisory authority. These rights depend on the circumstances and are not absolute. We may reasonably verify identity before responding.

You may object at any time to the use of your personal data for direct marketing. The current website does not collect newsletter subscriptions and does not use automated decision-making that has legal or similarly significant effects.

To exercise an applicable right, email sales@cirquvia.com with the subject line “Privacy Request” or write to our registered office. Tell us the right you wish to exercise and provide enough information to identify the relevant records. We may request proportionate proof of identity and will respond within the period required by applicable law.

10. Website forms, email, WhatsApp and external services

The website enquiry form sends the information you choose to provide through the site's hosting path to Google Apps Script and Google Sheets so authorised CIRQUVIA staff can receive an internal notification and follow up. An email link opens your chosen email service, and a WhatsApp link takes you into a third-party environment. Those services process data under their own terms and privacy policies. After CIRQUVIA receives your enquiry, our use of it is covered by this policy.

Rejecting optional advertising measurement does not prevent you from submitting the enquiry form or receiving a response.

11. Children

This is a B2B website intended for professional buyers and is not directed to children. We do not knowingly request children's personal data through this website.

12. Changes to this policy

We may update this policy when the website, service providers, legal requirements or business processes change. The date and version will be updated, and material changes will be communicated where required.