Privacy Policy

1. Who we are

CIRQUVIA is a brand operated by HONG KONG XIN ZONG SHAN LIMITED, a Hong Kong limited company. Our registered office is Room 701, Unit 108, 7/F, Tower B, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui, Kowloon, Hong Kong.

For the personal data covered by this policy, HONG KONG XIN ZONG SHAN LIMITED is responsible for deciding why and how that data is used, unless a third-party service acts independently under its own policy.

2. Scope of this policy

This policy covers visits to cirquvia.com, technical access and security records generated in connection with the website, emails sent to CIRQUVIA and messages sent to our published WhatsApp contact.

It does not cover third-party websites or applications when they process data for their own purposes. The current website does not provide customer accounts, online checkout, payment collection or a customer portal.

3. Personal data we may handle

Business enquiry data

When you contact us, we may receive your name, job title, company, business email address, telephone or WhatsApp number, country or region, requested products, quantity, grade, delivery requirements, attachments and the history of our communications.

Technical and security data

The website is published through OpenAI Sites and delivered and protected using Cloudflare infrastructure. These providers may automatically process IP address, request time, requested URL, referring page, browser, device or operating-system information, network identifiers and security-event details to deliver and secure the website.

Providing enquiry information is voluntary. If you do not provide a working contact method and enough information about your request, we may be unable to reply or prepare a quotation.

Please do not send passports, complete bank-card details, health information or other unnecessary sensitive information by ordinary email or WhatsApp.

4. Why we use personal data

• To respond to B2B enquiries and prepare requested quotations.
• To communicate about product requirements, availability, quality, logistics, contracts and after-sales matters.
• To protect the website, company systems and communications against misuse, fraud and security incidents.
• To maintain business, accounting, tax and dispute records where required or reasonably necessary.
• To establish, exercise or defend legal claims.

Under Hong Kong law, we aim to collect data lawfully, fairly and only to the extent necessary for directly related purposes. Where EU or UK data-protection law applies, the relevant basis may include steps requested before a contract, our legitimate interests in responding to business enquiries and operating a secure B2B service, or a legal obligation. Consent will be used where the law requires it.

5. Who may receive the data

We may share data only as reasonably needed with OpenAI Sites and Cloudflare for website publishing, delivery and security; Google Workspace for email; WhatsApp when you choose that channel; and providers of IT support, backup, logistics, payment, accounting, legal or other professional services relevant to your enquiry or a resulting transaction. We may also disclose data when legally required or in connection with a genuine corporate reorganisation.

We do not sell or rent personal data and do not provide it to third parties for their independent marketing.

6. International processing and transfers

HONG KONG XIN ZONG SHAN LIMITED operates from Hong Kong. If you contact us from another country, your enquiry is transferred to and handled in Hong Kong. OpenAI Sites, Cloudflare, Google Workspace and WhatsApp may also process data in jurisdictions where their infrastructure, group companies or authorised personnel operate.

We use the contractual protections offered by these providers, encrypted transmission and access controls. Where applicable law requires a specific international-transfer mechanism, the relevant provider arrangement and transfer are subject to that requirement.

7. How long we keep data

Retention depends on the purpose, relationship and legal requirement. The following retention periods apply to information controlled by us:

• Unsuccessful or inactive B2B enquiries: up to 24 months after the last substantive interaction, unless a shorter period is requested or a dispute requires preservation.
• Company-controlled copies of routine website or security logs, if any: normally no more than 90 days, unless longer preservation is reasonably necessary for a security incident, legal claim or legal obligation. Hosting and security providers retain their own logs under their service settings and legal obligations.
• Contract, invoice, payment and qualifying business records: for the applicable legal period; Hong Kong business records may need to be retained for at least seven years.
• Minimal opt-out or objection records: as needed to continue respecting the request.

8. Security

We use proportionate safeguards including encrypted transmission, restricted administrative access, service-provider controls, backups and security logging where available, and incident handling. No internet transmission or storage system can be guaranteed to be completely secure.

9. Your choices and rights

Under Hong Kong's Personal Data (Privacy) Ordinance, you may request access to and correction of personal data held about you, subject to applicable conditions and exceptions.

Where the GDPR or UK GDPR applies, you may also have rights to erasure, restriction, objection, portability, withdrawal of consent and complaint to a supervisory authority. These rights depend on the circumstances and are not absolute. We may reasonably verify identity before responding.

You may object at any time to the use of your personal data for direct marketing. The current website does not collect newsletter subscriptions and does not use automated decision-making that has legal or similarly significant effects.

To exercise an applicable right, email sales@cirquvia.com with the subject line “Privacy Request” or write to our registered office. Tell us the right you wish to exercise and provide enough information to identify the relevant records. We may request proportionate proof of identity and will respond within the period required by applicable law.

10. Email, WhatsApp and external links

An email link opens your chosen email service, and a WhatsApp link takes you into a third-party environment. Those services process data under their own terms and privacy policies. After CIRQUVIA receives your message, our use of the received business enquiry is covered by this policy.

11. Children

This is a B2B website intended for professional buyers and is not directed to children. We do not knowingly request children's personal data through this website.

12. Changes to this policy

We may update this policy when the website, service providers, legal requirements or business processes change. The date and version will be updated, and material changes will be communicated where required.