Privacy Policy

• Request details: your name, email address, company name if you give one, and the text of your message. We receive these when you use the request form or email us. The form also sends the language of the page and the time the page was opened.
• Technical data: your IP address, the date and time, the address of the page requested and your browser's user-agent string. These are processed in order to deliver each page to you.
• Security-check data: the request form is protected by Turnstile, a service of Cloudflare, Inc. that tells people from automated programs. When you begin filling in the form, your browser loads the check from Cloudflare, and Cloudflare receives your IP address, the technical characteristics of your connection and browser (such as the TLS fingerprint and the user-agent header) and the address of this website. Cloudflare states that Turnstile does not read what you type into the form.
• Your answer to the cookie notice: kept in your own browser and not sent to us. See the Cookie Policy.

Giving us your details is voluntary, but without a name and an email address we cannot reply to a request. We do not ask for identity documents or payment details through this website; please do not send them.

Personal data serves these purposes and purposes directly related to them; any other use needs your agreement. Your details will not be used in direct marketing and will not be sold, and no decision about you is left to a machine.

When you press “Ask for a quotation”, our server checks the fields and sends your request as an email to contact@flextradeltd.com. The server itself keeps no copy: there is no database, and the content of a request is not written to any log. A copy of the email does stay with the mail service that sends it; see “Who else handles it” below. If the email cannot be sent, the page tells you so.

Before the email is sent, the form must pass the Turnstile security check. The check gives the form a one-time code. Our server sends that code and your IP address to Cloudflare, and Cloudflare answers whether the check was passed. If it was not, the request is not sent and the page says so. We do not keep the code or the answer.

The server also counts form requests per IP address. It keeps an address for no more than 30 minutes after a request and then discards it.

Personal data is handled by Flextrade Limited and by the service providers we use to run the website and our email:

• Cloudflare, Inc.: its network delivers this website and filters attacks. Every request to the website, including a submitted form, passes through it. Cloudflare also runs the Turnstile security check on the request form. It handles the security-check data on our behalf in order to protect the form and, as it states in its Turnstile Privacy Addendum, also uses that data on its own account to improve its detection of automated programs.
• The provider of the server on which the website runs.
• Google LLC: the email that carries a form request is sent through its Gmail service, and a copy of that email stays in the sent folder of the sending account until we delete it.
• The provider of our email mailboxes, where correspondence is kept.

These providers may process data outside Hong Kong.

If an order follows, we pass the details needed for it to the carrier that delivers the goods and to our accountants and auditors, who see order records in the course of their work. Beyond that, personal data goes to no one else unless the law of Hong Kong requires us to disclose it, for example to a court or a government department.

• A request that does not lead to an order: the correspondence is deleted 6 months after the last message.
• A request that leads to an order: the correspondence is kept with the records of the order for 7 years after the order is completed. The Inland Revenue Ordinance (Cap. 112) requires business records to be kept for at least that long.
• The copy of a form email in the sending Gmail account: deleted within 6 months of being sent.
• IP address used to count form requests: no more than 30 minutes.
• Visits: our web server is set up without an access log, so it keeps no list of visits. If a request fails, the server software may write an error entry that can include the IP address and the address requested. Such entries are used only to find the fault.
• Cloudflare keeps its own records of the traffic it carries and of the security checks it runs, for the periods set out in its privacy policy.
• Your answer to the cookie notice: in your browser for up to 6 months. See the Cookie Policy.

The Personal Data (Privacy) Ordinance lets you ask us whether we hold personal data about you, receive a copy of it, and have it put right where it is wrong.

Write to the director of Flextrade Limited at the registered office:

or send an email to info@flextradeltd.com. You will have our answer within 40 days of the day your request reaches us; we may need to confirm who you are first.

If something about the way we handled your data or your request seems wrong, tell us first so that we can look into it. Complaints are also taken by the Privacy Commissioner for Personal Data (www.pcpd.org.hk).

The website is served over an encrypted connection (HTTPS), and its pages load scripts only from its own address, with one exception: the Turnstile security check on the request form, which comes from Cloudflare. The email that carries a form request is handed to the mail service over an encrypted connection. Request correspondence is kept in mailboxes with restricted access.

When the website or our handling of data changes, the new policy is posted on this page under a new date.