This Privacy Policy describes how HoTo Trading Co., Limited collects, uses, shares, retains and protects personal data when you visit our website at hongtumaoy.com or use the HoTo Trading mobile management app distributed through Google Play and the Apple App Store. We apply the same standards across both channels. Our business scope is: Import and export of general merchandise, wholesale, retail, supply chain support, business information consultation and marketing services, excluding financial, securities and insurance business. Because we serve customers in multiple jurisdictions, this policy also sets out the legal bases we rely on, the rights available to you, and the controls we provide.
- 1. Introduction and Scope
- 2. Information We Collect
- 3. How We Use Information
- 4. Legal Bases for Processing
- 5. Sharing and Processors
- 6. International Transfers
- 7. Retention
- 8. Security
- 9. Advertising and Monetisation
- 10. Advertising Formats and User Controls
- 11. Cookies and Similar Technologies
- 12. Regional Rights
- 13. Children's Privacy and Age Policy
- 14. App Store Compliance
- 15. Do Not Track and Global Privacy Control
- 16. Changes to This Policy
- 17. Contact Us
- 18. Effective Date
1. Introduction and Scope
HoTo Trading Co., Limited is a company incorporated and operating in the Hong Kong Special Administrative Region. Our registered office is at NO. 2-309, 2/F, CHUNGKING EXPRESS, NOS. 36 NATHAN ROAD, TSIM SHA TSUI, HONG KONG, and our website is published at hongtumaoy.com. Our business activity covers: Import and export of general merchandise, wholesale, retail, supply chain support, business information consultation and marketing services, excluding financial, securities and insurance business. The same activities are supported by the HoTo Trading mobile management app, which is our operational system of record for orders, inventory, supply chain coordination and consulting delivery.
This Privacy Policy applies to two channels. The first is the website hongtumaoy.com, including every page linked from it, our contact and enquiry forms, and any account or tracking functionality that we operate there. The second is the HoTo Trading mobile management app, which we distribute through Google Play and the Apple App Store and which we operate as the developer and data controller. Where the app relies on third-party advertising SDKs, we describe those integrations in detail in Section 9. Personal data processed through either channel is handled under this single policy, regardless of where you install the app or from which country you access the site.
This policy does not govern the processing carried out independently by Google Play or the Apple App Store as platform operators, by other websites or services that we merely link to, or by advertisers whose campaigns we deliver on the basis of their own instructions. Those parties operate under their own privacy notices. Where you contact us as a business prospect, a supplier, a carrier or a partner rather than as an app user, we still handle your business contact data under this policy, and we apply the principles of Section 3 to that data.
2. Information We Collect
We collect data in three ways: you give it to us directly, we observe it from your device when you use the site or the app, and we receive it from third parties such as advertising networks and app store operators. The table below summarises the categories we process. We do not collect sensitive categories of personal data, such as health, biometric, precise-geolocation or government-identifier data, and we do not knowingly collect data from children, as set out in Section 13.
| Category of Information | Examples | How We Collect It |
|---|---|---|
| Account data | Name, business email address, company name, job title, phone number, hashed password, account identifier, in-app messages, support tickets | Directly from you when you register in the app, create an account on hongtumaoy.com, or contact us |
| Device and technical data | Device model, operating system and version, app version and build, screen resolution, language, time zone, network type, IP address, crash logs, error traces, SDK and browser identifiers | Automatically collected when the app runs or a page loads |
| Usage data | Screens and features viewed, search and filter terms, order and inventory actions, session start and end times, dwell time, feature interactions, diagnostic events, in-app purchase and download records | Automatically collected through app telemetry and website analytics |
| Optional location data | Approximate area derived from IP address, and precise coordinates only where you deliberately grant the operating system permission | Only with your express permission or where you opt in; we treat location data as optional and the service functions without it |
| Advertising identifiers and similar identifiers | AAID (formerly Ad ID) on Android, IDFA on Apple platforms, vendor identifiers from advertising SDKs, device fingerprint components used for fraud prevention, and web cookie identifiers | Collected by integrated advertising SDKs in the app and by advertising and analytics tags on the website, subject to the consent and opt-out controls described in Sections 9, 10 and 15 |
| Business enquiry and correspondence data | Company registration details, trading history references, quotation requests, negotiation records, invoices and payment remittance details, logistics documentation | Directly from you and from our suppliers, carriers and platform partners in the course of import, export, wholesale, retail and supply chain support activity |
We retain only the fields that are necessary for the purpose for which they were provided. Where a field is marked optional in the app, the related function continues to operate if you decline to provide it, and declining never affects your access to the free tier of the app.
3. How We Use Information
We process personal data for the following specific purposes, and for no other purpose that is incompatible with them:
- Account administration and authentication, including creating and verifying your app account and website account, managing credentials, and providing access to the free tier of the app.
- Order fulfilment and delivery, including accepting quotations, processing purchases, arranging shipment and customs documentation, and confirming delivery.
- Inventory management and stock forecasting, including warehouse stock records, replenishment planning, and allocation of goods across wholesale and retail channels.
- Supply chain support, including coordinating manufacturers, suppliers, carriers, freight forwarders and customs brokers, and tracking the status of consignments.
- Delivery of business information consultation and marketing services, including preparing consultations, reports, campaigns and proposals, and monitoring the performance of marketing activity.
- Operation and improvement of the website and the app, including analytics, crash and performance diagnostics, feature testing, capacity planning, and the resolution of reported defects.
- Security and fraud prevention, including detecting automated abuse, validating accounts, preventing fraudulent order placement, and enforcing our acceptable use terms.
- Personalised advertising and marketing, including serving app-open, rewarded video, interstitial and banner advertising through third-party advertising SDKs, and measuring campaign performance, as further described in Sections 9 and 10.
- Legal and regulatory compliance, including record keeping, responding to lawful requests from competent authorities, enforcing contracts, and establishing or defending legal claims.
- Communications with you, including transactional notices about orders, shipments and accounts, service announcements, and responses to enquiries sent to support@hongtumaoy.com or linaba@hongtumaoy.com.
We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on you. We do not infer characteristics such as health status, religious belief or political opinion. We do not use personal data for purposes of financial or securities business, consistent with the exclusion in our stated business scope.
4. Legal Bases for Processing
We rely on the legal bases set out below for the processing described in Section 3. Where a regime applies to you because of your location, your device settings or your place of residence, we apply the corresponding basis in addition to the bases that apply universally. We maintain a processing record mapping each purpose in Section 3 to the bases in this table, and we review that record at least annually.
| Jurisdiction / Regime | Legal Basis / Framework | Notes |
|---|---|---|
| European Union / European Economic Area | GDPR, Regulation (EU) 2016/679, Articles 6(1)(a), (b), (c) and (f) | Consent for advertising and optional analytics; contract for account, order and app services; legal obligation for invoices and trade records; legitimate interests for security and service improvement, subject to balancing test |
| United Kingdom | UK GDPR and the Data Protection Act 2018 | Mirrors the GDPR basis set out above; the ICO is the supervisory authority for our processing conducted in relation to UK users |
| United States, California | CCPA as amended by the CPRA (Cal. Civ. Code section 1798.100 et seq.) and the CCPA regulations | Notice at collection, right to know, right to delete, right to correct, right to opt out of sale or sharing for cross-context behavioural advertising, right to limit use of sensitive personal information, and non-discrimination |
| United States, other states | Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA and Oregon OCPA | We apply a single opt-out and rights framework across all states to avoid fragmented compliance, and we extend the opt-out mechanism to all users regardless of state residency |
| Brazil | LGPD, Lei No. 13.709/2018, Articles 7 and 11 | Legal bases mirrored to the GDPR model; data subject rights requests are answered within the statutory period, with the ANPD as supervisory authority |
| Canada | PIPEDA, including the OPC accountability and transparency principles | Meaningful consent for collection and use, appropriate purposes, safeguards, and access and correction rights |
| Australia | Privacy Act 1988 (Cth) and the Australian Privacy Principles | APP 1 to 13 apply, including APP 3 collection, APP 6 use and disclosure, APP 7 security, and APP 11 access and correction; the OAIC is the supervisory authority |
| Singapore | Personal Data Protection Act 2012 | Consent, contract, and legitimate interest purposes in the PDPA model; data breach notification to the PDPC where the statutory threshold is met |
| India | Digital Personal Data Protection Act 2023 and the DPDP Rules | Notice and consent for specified digital personal data, data fiduciary obligations, and grievance redressal; we treat the Grievance Officer contact route described in Section 17 as our redressal channel |
| Japan | APPI, Act on the Protection of Personal Information | Properly acquired personal data, disclosure of the purpose of use, security management, and supervision of entrusted processors |
| South Korea | PIPA, Personal Information Protection Act | Consent or other statutory basis, purpose limitation, overseas transfer disclosure and consent where required, and designation of an overseas transfer recipient |
| Hong Kong Special Administrative Region | Personal Data (Privacy) Ordinance, Cap. 486 | The ordinance applies to our operations in the Hong Kong Special Administrative Region; we follow the six data protection principles and the direct marketing and data breach provisions of the ordinance |
| Other major regions | Applicable national legislation of the user's location, including the ePrivacy rules and cookie consent regimes of the EEA and the UK, and the local advertising and consumer protection rules of the markets in which we distribute the app | Where no specific statutory basis exists, we rely on consent or on the performance of a contract, and we apply a single global control set that satisfies the highest applicable standard, so that users in any market receive at least the protection described in this policy |
Where we rely on legitimate interests, we have carried out and documented a balancing test that considers your reasonable expectations, the impact on you, and the existence of less intrusive alternatives. Where we rely on consent, you may withdraw it at any time through the settings described in Section 10, in your device or browser settings, or by contacting support@hongtumaoy.com, and withdrawal does not affect processing carried out before withdrawal.
5. Sharing and Processors
We share personal data only with the categories of recipients described below, and only for the purposes set out in Section 3. We do not sell personal data for money. We do, however, disclose advertising identifiers and related usage data to advertising SDK vendors in order to deliver advertising, and that disclosure may constitute a sale, a sharing, or a targeted advertising disclosure under the CCPA and CPRA and the equivalent laws of other states. That disclosure is subject to the opt-out rights described in Sections 9, 10 and 15.
- Fulfilment, logistics and supply chain partners, including warehouse operators, freight forwarders, carriers, customs brokers and last-mile delivery providers, to the extent required to ship, deliver, clear and document consignments.
- Payment providers and banking partners, to process payments, refunds and payouts and to perform transaction screening.
- Advertising SDK vendors, listed individually in Section 9, to deliver app-open, rewarded video, interstitial and banner advertising, to perform frequency capping, to attribute conversions, and to report advertising performance.
- Analytics and measurement providers, to understand aggregate usage, diagnose faults and evaluate the effectiveness of campaigns.
- App store operators, namely Google and Apple, which act as the distributors of the app, process account, download, subscription and payment related data under their own privacy notices, and may provide us with aggregated download, install and crash reporting.
- Professional advisers, including legal counsel, accountants, auditors and insurers, subject to professional confidentiality duties.
- Competent authorities, courts, regulators and law enforcement, where disclosure is required by applicable law, a binding court order, or to protect the rights and safety of any person.
- Corporate transaction counterparties, such as investors, acquirers or professional advisers, in connection with a reorganisation, merger or sale of assets, subject to appropriate confidentiality safeguards and to notice to you where the law requires it.
Each recipient acting on our instructions is bound by a written processing agreement that imposes confidentiality, security and purpose-limitation obligations, and that provides for the deletion or return of personal data when the engagement ends. Our current list of processors and advertising SDK vendors, together with the categories of data each of them receives, is available on request by writing to support@hongtumaoy.com. We do not disclose personal data to advertisers for direct marketing or for the purpose of creating behavioural profiles for unrelated third parties.
6. International Transfers
HoTo Trading Co., Limited is established in the Hong Kong Special Administrative Region, and our servers, vendors and app distribution channels are located in other countries. As a result, personal data collected through hongtumaoy.com or the app may be processed outside the Hong Kong Special Administrative Region and outside your own country, including in the United States, the European Economic Area, the United Kingdom, Singapore and India. Section 4 identifies the regime applicable in each of those locations.
Where a transfer of personal data is subject to a restriction on transfer, we rely on one of the following mechanisms: an adequacy decision issued by the competent authority, including the decisions applicable to the United Kingdom and the European Economic Area; the Standard Contractual Clauses issued by the European Commission, together with the International Data Transfer Addendum where the exporter is subject to UK GDPR; a data transfer agreement with an equivalent set of safeguards approved by the relevant supervisory authority; or another derogation recognised by applicable law, used only where the circumstances justify it. We perform a transfer impact assessment before relying on any transfer mechanism, we reassess it where there is a material change in the legal or factual circumstances, and we apply supplementary measures where the assessment identifies a residual risk.
Where the law of the destination country restricts further onward transfer or government access, we enforce our contractual safeguards, we limit access to the minimum data necessary for the transfer purpose, and we rely on local law remedies available to you, including the remedies described in Section 12 and any competent authority complaint that you are entitled to lodge. We also inform you of the identity of the relevant recipient and the applicable safeguards on request.
7. Retention
We retain personal data only for as long as it is necessary for the purpose for which it was collected, for the period required by law, or for the period needed to establish or defend legal claims. The default periods below apply unless a longer period is required by a specific obligation, in which case the longer period prevails and the reason is recorded in our processing record.
| Category of Data | Default Retention Period | Rationale |
|---|---|---|
| Account data | For the duration of the account, and for 12 months after the last activity or closure request | Provision of the app and account services, and a reasonable period to reinstate or resolve queries |
| Order records | 7 years from the date of the transaction | Performance of the sales contract, warranty and returns administration, and the statutory retention period applied to trading records |
| Invoices and accounting records | 7 years from the end of the financial year in which they were issued | Statutory record keeping and tax obligations |
| Support correspondence | 24 months from the date of the last substantive exchange | Resolution of enquiries and the management of any subsequent claim |
| Usage logs and crash diagnostics | 13 months, aggregated thereafter into non-identifying statistics | Capacity planning, security monitoring and product improvement |
| Advertising identifiers | Until you reset or delete the identifier, withdraw consent, or opt out, and in any event not more than 13 months after collection | Delivery and measurement of advertising, limited to the period in which the identifier remains valid on the device |
| Legal records, including claims, complaints and regulatory correspondence | 7 years from the closure of the matter | Establishment and defence of legal claims and regulatory defence obligations |
When a retention period expires, we delete or de-identify the data. Where deletion is technically impractical in the short term, we restrict further processing and complete the deletion at the next scheduled deletion cycle. Backups are overwritten on a rolling cycle, and data in backups is not restored to production except in the course of disaster recovery, in which case the original retention period continues to run.
8. Security
We apply a layered set of technical and organisational measures to protect personal data. On the technical side, data in transit is protected with TLS encryption on the website and on all app service endpoints, data at rest is encrypted using industry-standard AES-256 encryption for databases, object storage and backups, access to production systems is restricted by role-based access control with least-privilege permissions and multi-factor authentication for administrative access, secrets and credentials are stored in a dedicated secrets manager and rotated on a defined schedule, and every production environment is protected by network segmentation and monitored by an intrusion detection layer. On the organisational side, we apply a documented information security policy, screen all personnel who have access to personal data, run an annual security awareness programme, maintain an incident response plan with defined escalation paths and a named incident owner, and require our processors to maintain equivalent safeguards under written contractual terms.
We review access rights on a quarterly basis and remove them promptly when they are no longer required. We run vulnerability scanning and dependency patching on a regular cycle, and we commission independent security testing of the app and the website at least annually. Personal data breach notification is made to the relevant supervisory authority, including the PCPD under the Personal Data (Privacy) Ordinance, within the statutory period where the applicable threshold is met, and where required we notify affected individuals and describe the likely consequences and the measures we have taken.
No system is perfectly secure. Data transmission over the internet, storage on mobile devices and the operation of third-party SDKs all carry inherent risk, and a breach of our controls cannot be excluded entirely. We therefore maintain an incident response procedure designed to detect, contain and remedy breaches promptly, and we will notify you and the competent authority where we are legally required to do so.
9. Advertising and Monetisation
The HoTo Trading mobile management app is distributed free of charge and is monetised through advertising. The app integrates third-party advertising SDKs that may serve app-open (splash), rewarded video, interstitial and banner advertisements. Your business enquiry data is never shared with advertisers. The SDKs below receive only the identifiers and signals needed to serve and measure advertising, and they operate as our processors on our instructions and under their own published data protection commitments.
Advertising platforms integrated in the app
| Advertising Platform | Purpose | Opt-out / Data Subject Rights Link |
|---|---|---|
| Google AdMob | Primary mediation and ad delivery for app-open, interstitial, banner and rewarded video formats; reward verification and mediation reporting | Opt out and reset the advertising ID via google.com/admob and Google Settings, Ads, Reset advertising ID |
| Google Ad Manager | Publisher-side ad management, demand routing, frequency capping and yield optimisation across formats | Privacy and opt-out details at google.com/admanager and Google Ads Settings |
| Meta Audience Network | Delivery of banner and interstitial ads from Meta demand sources, with audience matching based on advertising identifiers | Opt out via facebook.com/audience-network and the Audience Network settings in the app |
| Unity Ads | Rewarded video and interstitial demand, and SDK-level mediation through the Unity Ads platform | Data and opt-out details at unity.com and Unity Ads data privacy controls |
| AppLovin | Mediation, rewarded video and interstitial demand, campaign measurement and app discovery advertising | Privacy and consent controls at applovin.com and the AppLovin consent opt-out setting |
| ironSource (LevelPlay) | Mediation and bid management across formats, including app-open and rewarded video, with revenue reporting | Data processing and opt-out details at ironsource.com and LevelPlay mediation settings |
| Vungle/Liftoff | Rewarded video and app-open ad demand, creative attribution and campaign measurement | Privacy, consent and opt-out details at vungle.com and Liftoff privacy controls |
| Pangle (TikTok for Business) | Rewarded video and interstitial demand from TikTok for Business inventory, with campaign performance reporting | Privacy policy and opt-out at pangle.io and the TikTok for Business data controls |
| Mintegral | Rewarded video, interstitial and banner demand, with device and app signal matching | Privacy policy and opt-out at mintegral.com and the Mintegral SDK consent configuration |
| Chartboost | Rewarded video and interstitial delivery, campaign analytics and audience segments for bidding | Privacy and data rights at chartboost.com and the Chartboost privacy controls |
| AdColony | Video and rewarded ad demand in key markets, with viewability and engagement measurement | Privacy policy and opt-out at adcolony.com and the AdColony consent settings |
| InMobi | Banner and interstitial demand, SDK-level audience segments and conversion tracking | Privacy policy, consent and opt-out at inmobi.com and the InMobi data controls |
| Amazon Ads | Campaign delivery and measurement for merchants advertising against app inventory, with attribution reporting | Privacy, consent and data subject request details at advertising.amazon.com |
| Digital Turbine | App discovery, cross-promotion and incentivised offer demand, including app-open format delivery | Privacy policy and data subject requests at digitalturbine.com |
| Smaato | Header and interstitial banner demand, mediation and publisher-side yield optimisation | Privacy policy, consent and opt-out at smaato.com |
| Fyber | Rewarded video and interstitial demand, mediation adapters and campaign performance measurement | Privacy and consent details at fyber.com and the Fyber SDK data controls |
| Ogury | Banner and interstitial demand with consent-based audience building, and visibility measurement | Privacy policy, consent and opt-out at ogury.com |
| Criteo | Retargeting and app-install campaign delivery, remarketing audiences and conversion attribution | Privacy and data subject requests at criteo.com and the Criteo privacy controls |
| Teads | Rewarded video, app-open and banner demand, with campaign measurement and supply-side reporting | Privacy policy, consent and opt-out at teads.com |
| Moloco | Machine-learning based bidding for ad impressions and app-install campaigns, using device and app signals | Privacy policy, consent and data subject requests at moloco.com |
| PubMatic | Publisher-side ad serving for banner and interstitial inventory, with first-party data segments and header bidding | Privacy policy, consent and opt-out at pubmatic.com |
| Magnite | Programmatic exchange mediation for banner, interstitial and video inventory, including seller-side reporting | Privacy policy and consent management at magnite.com |
Personalised and non-personalised advertising
Personalised advertising means that ads are selected using data about you, such as your advertising identifier, the apps you have installed, your in-app activity, your approximate location and your inferred interests. We use personalised advertising to measure campaigns and to fund the continued operation of the free tier of the app. Non-personalised, or contextual, advertising is selected using limited information about the current app context, the content of the page you are viewing and the approximate country or region of your device, without building a profile of your interests. Where you have not consented to personalised advertising, or where you have opted out, we serve contextual advertising only and pass contextual signals to the SDKs instead of advertising identifiers.
Consent requirements
Where the GDPR, the UK GDPR or the ePrivacy rules apply, we request your consent before storing or accessing information on your device, before personalised advertising is served, and before any non-essential SDK is initialised. Consent is collected through an in-app consent platform and, on the website, through a consent banner, and it is recorded so that we can evidence your choice. Where the CCPA and CPRA or an equivalent state law applies, we rely on the opt-out model for sale and sharing, and we honour the opt-out preference signals described in Section 15. In territories where the law requires consent for data sharing with third parties, including Brazil under the LGPD and South Korea under the PIPA, the consent state is enforced per identifier so that consent refused on one device is not overridden on another.
Apple App Tracking Transparency and advertising identifiers
On Apple platforms, the app requests the App Tracking Transparency authorisation before any data is shared with an SDK for tracking. If you decline, we do not pass the IDFA, we do not request it, and we serve contextual advertising only. On Android, we use the AAID, which you may reset from Google Settings, Ads, Reset advertising ID, or delete from Google Play, My apps, AdMob, Delete. Resetting the identifier does not delete your app data or our account, but it breaks the link between the identifier and previous activity. We do not fingerprint devices to recreate a deleted identifier. Where you withdraw consent, we call the SDK reset and delete interfaces and we suppress further requests from the affected SDKs.
10. Advertising Formats and User Controls
Advertising formats
The app serves four advertising formats. App-open advertisements appear on the splash screen when you launch the app and are limited to a single impression per session. Rewarded video advertisements are full-screen video advertisements that you opt to watch in exchange for an in-app reward. Interstitial advertisements are full-screen advertisements shown at defined natural break points, and they are never shown while an order is being submitted or a form is being completed. Banner advertisements are a small fixed strip displayed within a screen, generally at the bottom of the view, and they do not interrupt a task.
How rewarded ads work
A rewarded advertisement is offered only when you initiate it, usually by tapping a clearly labelled button. We show the advertisement and the advertised reward before playback begins, and the reward is credited when the video is watched to completion. If you dismiss the advertisement before it finishes, no reward is credited and no penalty is applied. Rewarded advertisements are not served to users who have enabled reduced motion, are using a screen reader, or have opted out of personalised advertising, and they are not served to users under the applicable minimum age.
Frequency capping and ad quality
Frequency capping limits the number of impressions of a given format in a defined period, and the caps we apply are enforced through the mediation layer so that they apply across every advertising platform listed in Section 9. We also exclude sensitive contexts from ad serving, including payment steps, identity verification, support conversations and any screen in which personal data is entered. We require each SDK vendor to maintain industry standards on ad content, and we remove any vendor whose creative or conduct does not meet our acceptable use requirements.
Your controls
You can disable ad personalisation within the app through Settings, Privacy, Ad personalisation, which switches the app to contextual advertising and signals the change to every integrated SDK. You can withdraw consent through the same setting, which resets and deletes the advertising identifiers held by the SDKs on your device. You can reset or delete the advertising identifier in your device settings: on Android through Google Settings, Ads, Reset advertising ID, or Google Play, My apps, AdMob, Delete; on Apple platforms through Settings, Privacy & Security, Tracking, where you can turn off Allow Apps to Request to Track, and by resetting or deleting the IDFA through the same control. You can also reset the advertising identifier on the website through your browser settings, and you can send a Global Privacy Control signal as described in Section 15. Your choice applies to the device on which you make it.
11. Cookies and Similar Technologies
The website uses cookies and similar technologies, and the app uses local storage and SDK identifiers. These technologies perform essential functions such as maintaining a session, remembering preferences, securing forms against automated submission, measuring the effectiveness of our campaigns and delivering advertising. On the website, we use strictly necessary cookies for session management and security, preference cookies that remember settings such as language and consent choices, and analytics cookies that aggregate page performance. In the app, the equivalent technologies are the local and session storage used for offline drafts and preferences, and the identifiers set by advertising SDKs described in Section 9.
Where the ePrivacy rules or equivalent legislation require consent for non-essential cookies, we present a consent banner on the website before any non-essential cookie is set, and the app presents its consent platform before non-essential SDKs are initialised. You can withdraw or change consent at any time through the cookie banner or the in-app consent platform, and we record the timestamp and state of each change.
You can control cookies and similar technologies through your browser settings, by blocking or deleting cookies for hongtumaoy.com, by clearing site data for the app in your device settings, and by using the in-app privacy controls described in Section 10. Blocking strictly necessary cookies may prevent the website from functioning correctly, for example by preventing you from submitting an enquiry form or remaining signed in. We do not use cookies for cross-context behavioural advertising on the website unless you have consented, and we do not use advertising cookies on the website for users who send a Global Privacy Control signal.
12. Regional Rights
Depending on where you live and the law that applies to you, you may have the right to request access to, correction of, deletion of, restriction of, portability of and objection to the processing of your personal data, and to withdraw consent at any time. The table below summarises the principal rights by region. Where several regimes could apply to the same request, we apply the standard that provides the highest protection to you.
| Region | Key Rights | How to Exercise |
|---|---|---|
| European Union / European Economic Area | Access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, objection to direct marketing, withdrawal of consent, and the right to complain to a supervisory authority in the country of residence | Email support@hongtumaoy.com with the subject line "Data subject request"; the identity of the requester is verified before disclosure |
| United Kingdom | Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to complain to the Information Commissioner's Office | Email support@hongtumaoy.com; requests are answered within one month, extendable by two further months for complex requests |
| United States (California) | Right to know and access, right to delete, right to correct inaccurate personal information, right to opt out of sale or sharing for cross-context behavioural advertising, right to limit use and disclosure of sensitive personal information, right to non-discrimination for exercising rights | Email support@hongtumaoy.com, or exercise the opt-out through the app privacy settings, Google Ads Settings or your browser; we confirm the request within 10 business days as required by the CCPA regulations |
| United States (other states) | Access, correction, deletion, portability, opt out of targeted advertising, and the right to appeal a denied request | Email support@hongtumaoy.com; we apply a single national workflow and do not require residency in the state concerned |
| Brazil | Confirmation of processing, access, correction, deletion, portability, information on sharing with third parties, revocation of consent, and review of certain automated decisions, with the right to petition the ANPD | Email support@hongtumaoy.com with a request describing the data and the right relied upon |
| Canada | Access to personal information held by us, correction of inaccurate information, and withdrawal of consent for collection, use or disclosure | Email support@hongtumaoy.com; a written response is provided and, where appropriate, the record is corrected |
| Australia | Access to and correction of personal information, the right to request correction of inaccurate data, and the right to complain to the OAIC | Email support@hongtumaoy.com; APP 15 and APP 16 of the Privacy Act 1988 govern the manner of our response |
| Singapore | Access, correction, withdrawal of consent, and protection against the disclosure of personal data without consent, with the right to complain to the PDPC | Email support@hongtumaoy.com; we respond within the period required by the PDPA |
| Japan | Disclosure of the purpose of use, disclosure of the content of personal data, correction, suspension of use, and deletion, with the right to lodge a complaint with the PPC | Email support@hongtumaoy.com; a request is handled in line with the APPI request procedure |
| South Korea | Access, correction, deletion, suspension of processing, and withdrawal of consent, with the right to request the outcome of a request | Email support@hongtumaoy.com; the request is recorded and answered within the period prescribed by PIPA |
| India | Access to information, correction and erasure, nomination, grievance redressal, and withdrawal of consent, with the right to approach the Data Protection Board | Email support@hongtumaoy.com; we maintain a grievance redressal process and acknowledge the complaint promptly |
| Hong Kong Special Administrative Region | Access to and correction of personal data held by us, and the right to make a data access request and a correction request under the Personal Data (Privacy) Ordinance | Email support@hongtumaoy.com or linaba@hongtumaoy.com; we comply with the statutory handling timeframes for data access requests |
| Other regions | Access, correction, deletion, portability, restriction, objection and withdrawal of consent, as provided by the law of your country of residence, together with the right to complain to a local supervisory authority | Email support@hongtumaoy.com; we accept requests from any location and apply the highest applicable standard |
How we handle a rights request
We acknowledge each request promptly, verify that the requester is the person entitled to make it, and respond within the timeframe set by the applicable law, which is generally one month and no more than three months in aggregate. We do not charge a fee unless the request is manifestly unfounded or excessive, and we will explain any charge before it is applied. If we are unable to comply with a request, we state the reasons and the complaint route available to you. Where we deny a request in a jurisdiction that provides a right of appeal, we explain the appeal procedure in the response.
To exercise any right described in this Section 12, contact support@hongtumaoy.com and include the right you wish to exercise, the product or service concerned and sufficient detail for us to locate the relevant data. Requests relating to a business account or key account arrangement may also be directed to linaba@hongtumaoy.com.
13. Children's Privacy and Age Policy
Minimum age
Our website and the HoTo Trading mobile management app are not directed to children and are not intended for use by children. We do not knowingly collect personal data from any child under the age of 13, nor from any child under the age of 16 where local law requires a higher threshold, including the rules applicable to consent based on information society services offered directly to children in the European Union and in the United Kingdom. The app is rated for a general audience and is distributed subject to the age ratings and parental controls described in Section 14. The free tier of the app is a business tool and is intended for users who are at or above the applicable minimum age and who have the legal capacity to enter into a commercial arrangement.
COPPA and GDPR-K
The Children's Online Privacy Protection Act of 1998, as amended by the COPPA Rule, and the EU representative obligations under GDPR-K and Article 8 of the GDPR restrict the collection of personal data from children. We do not knowingly collect personal data from children under 13 in the United States, we do not knowingly collect personal data from children under 16 in the European Economic Area or the United Kingdom, and we do not knowingly collect personal data from children under the age of majority in any jurisdiction in which a higher threshold applies. We do not use the app or the website to collect child-directed behavioural advertising, and we do not build advertising audiences from data supplied by children.
App store age ratings and parental controls
The app is listed with an age rating that reflects a general audience. The age ratings, parental control tools and content labelling applied by Google Play and by the App Store apply to the app as well, and they are enforced by the platform operators on the device. The advertising SDKs we integrate are configured in line with the Google Play Families policy and the Apple App Store requirements for child-directed audiences, so that where the app is later distributed to a child audience, the advertising configuration will be changed before that release and this policy will be updated accordingly.
What we do if we discover that we have collected a minor's data
If we discover that we have collected personal data from a child below the applicable minimum age, we take steps to delete that data as soon as practicable, we stop processing it, and we do not use it for advertising or for any profiling purpose. Where the law requires notification, we notify the parent or guardian and the relevant supervisory authority. A parent or guardian who believes that a child has provided us with personal data may contact us at support@hongtumaoy.com, and we will verify the request and delete the data accordingly.
14. App Store Compliance
Apple App Store Review Guidelines
The app is submitted and reviewed under the Apple App Store Review Guidelines. Guideline 5.1.1 requires that we disclose the categories of data the app collects, that we do not collect data beyond what is described, and that the privacy policy be accessible from the App Store listing. Guideline 5.1.2 requires that we obtain explicit permission before tracking users across other companies' websites or apps, which is implemented through the App Tracking Transparency prompt described in Section 9. We publish a privacy policy link in the App Store Connect metadata, and the app does not use SDKs that collect data contrary to the declarations in that listing.
Google Play Data Safety form
We complete the Google Play Data Safety form for the app and declare the categories of data that we and our SDKs collect, which include personal information such as name, email address and user IDs, device or other IDs, app activity, app info and performance data, location data where you grant permission, and advertising data. We declare the purposes of collection, whether the data is shared with third parties, whether collection is optional, and the security measures in place. The disclosures in this Privacy Policy correspond to those in the Data Safety form, and we update the form before or at the same time as we change the practices described here.
Google Play Families policy
If the app is included in the Google Play Families programme or directed to children in any market, we comply with the Families policy, including the requirement that apps within the programme use only self-certified SDKs that are approved for use with children, and we do not serve interest-based advertising or personalised advertising to that audience. Where a change to our advertising configuration is required to meet the Families policy, we apply the change before the relevant release is published.
Consistency of our disclosures
We treat our app store disclosures as a single regulatory record with this policy. Where a platform declaration and this policy differ, we rely on the more protective description and we correct the declaration. We review our app store disclosures at least annually and whenever we add or remove an advertising SDK, and we maintain an internal register of the SDKs we integrate, the data each SDK collects and the consent configuration applied to it.
15. Do Not Track and Global Privacy Control
Do Not Track is an opt-out signal that a browser may send to indicate that a user does not wish to be tracked. The Do Not Track header is not standardised, and there is not yet a consistent market or regulatory requirement to honour it. We therefore do not treat a Do Not Track signal as a binding instruction to disable personalisation, and we note this limitation in the consent interface rather than presenting the signal as effective.
Global Privacy Control is a legally recognised opt-out signal in several jurisdictions, including California under the CCPA and CPRA and the legislation of other states that requires recognised opt-out preference signals to be honoured. We honour a valid Global Privacy Control signal by applying the opt-out of sale and sharing for cross-context behavioural advertising, which means that we do not sell or share your personal data for that purpose and we do not serve personalised advertising based on it. We propagate the signal through our consent management platform to the advertising SDKs integrated in the app, so that the opt-out applies consistently across the website and the app. Where you use a Global Privacy Control signal and wish to exercise a right that cannot be handled automatically, including a request for access or deletion, please contact support@hongtumaoy.com as described in Section 12.
16. Changes to This Policy
We maintain a revision history for this policy. Each revision is identified by a version number and a revision date, and we record a summary of the substantive changes made. The current version and the summary of the most recent revision are shown at the top of this page, and previous versions are available on request through support@hongtumaoy.com. We review this policy at least annually and whenever we change the categories of data we collect, the purposes we use it for, the vendors we share it with, or the law that applies to our processing.
We give notice of changes by publishing the revised policy on hongtumaoy.com, by displaying a notice in the app on the next launch, and, where the change is significant, by email to the registered address on your account. If you do not accept a revised policy, you must stop using the app and the website and notify us so that we can close the account and delete the associated data. Continued use of the website or the app after the date on which the revised policy takes effect constitutes acceptance of the revised policy.
Where a change is a material change in the way we process personal data, for example a new purpose of use, a new category of vendor receiving data, or a change to the legal basis relied upon, we do not rely on your continued use alone. We request fresh consent before the new processing begins, we display a consent prompt in the app, we may require you to re-accept the App Tracking Transparency prompt, and we may require you to reinstall the app where an SDK change cannot be applied in place.
17. Contact Us
HoTo Trading Co., Limited is the controller responsible for the personal data described in this policy. If you have any question about this policy, about the way we handle your personal data, or about a request under Section 12, please contact us using any of the channels below. Please include enough detail for us to locate the data or the request concerned, so that we can respond as quickly as possible.
- Business support and all privacy enquiries: support@hongtumaoy.com
- Key accounts: linaba@hongtumaoy.com
- Office: NO. 2-309, 2/F, CHUNGKING EXPRESS, NOS. 36 NATHAN ROAD, TSIM SHA TSUI, HONG KONG
- Website: hongtumaoy.com
- Contact page: https://hongtumaoy.com/contact.html
- Company: HoTo Trading Co., Limited
Requests for access, correction, deletion, restriction, portability or objection should be sent to support@hongtumaoy.com. We acknowledge receipt of each request and provide a response within the period required by the applicable law. If you are not satisfied with our response, you may raise the matter with the data protection authority in your country of residence or with the Office of the Privacy Commissioner for the Hong Kong Special Administrative Region.
18. Effective Date
This Privacy Policy takes effect on the effective date shown above and applies to all personal data collected through hongtumaoy.com and the HoTo Trading mobile management app distributed via Google Play and the Apple App Store from that date. Personal data collected before that date is handled in accordance with the version of the policy that was in force at the time of collection, except where the law requires a different approach. The version number and revision date for this document are recorded in the revision history maintained by HoTo Trading Co., Limited, and the responsible contact point for any question about this version is support@hongtumaoy.com.