Privacy Policy私隱政策

This policy explains what personal data www.beautech.com.hk collects, why we collect it, who else sees it, how long we keep it and what you can ask us to do about it. It is written to meet the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (the “PDPO”), and — because many of the brands we manufacture for are in Europe — the EU General Data Protection Regulation and the UK GDPR.本政策說明 www.beautech.com.hk 收集哪些個人資料、收集原因、有哪些第三方會接觸到這些資料、保留多久，以及你可以要求我們作出甚麼處理。本政策依據香港《個人資料（私隱）條例》（第486章）（下稱「私隱條例」）撰寫；由於我們不少客戶品牌位於歐洲，亦一併涵蓋歐盟《一般資料保護規例》（GDPR）及英國 GDPR。

This policy is also our Personal Information Collection Statement for the purposes of Data Protection Principle 1(3) of the PDPO.就私隱條例保障資料第1(3)原則而言，本政策亦即我們的《收集個人資料聲明》。

1. Who we are1. 我們是誰

Beautech Industries Ltd (美科護膚品實業有限公司) is a contract manufacturer of skincare and cosmetics, operating in Hong Kong since 2000. Our registered address is Unit H, 3/F, Wang Kwong Industrial Building, 45 Hung To Road, Kwun Tong, Kowloon, Hong Kong.美科護膚品實業有限公司（Beautech Industries Ltd）自2000年起於香港從事護膚品及化妝品代工製造，地址為香港九龍觀塘鴻圖道45號宏光工業大廈3樓H室。

We are the data user of the personal data described here for the purposes of the PDPO, and the data controller for the purposes of the GDPR and UK GDPR. Privacy questions and requests go to info@beautech.com.hk.就私隱條例而言，我們是本政策所述個人資料的資料使用者；就 GDPR 及英國 GDPR 而言，我們是資料控制者。有關私隱的查詢及要求，請電郵 info@beautech.com.hk。

2. What this policy covers2. 適用範圍

This policy covers the website www.beautech.com.hk and the enquiries, project briefs, chat conversations, emails, phone calls and WhatsApp messages that reach us through it. It is a business-to-business site: the people whose data we handle are, in almost every case, brand owners, buyers, distributors and their staff.本政策適用於 www.beautech.com.hk 網站，以及透過網站到達我們的查詢、項目簡報、即時對話、電郵、電話及 WhatsApp 訊息。本網站為企業對企業（B2B）性質，我們處理的個人資料絕大部分屬於品牌持有人、採購人員、分銷商及其員工。

It does not cover products we manufacture for other brands once those products leave our factory, and it does not cover our customers' own websites, apps or customer databases — those are their responsibility.本政策不適用於我們為其他品牌代工的產品在離開廠房之後的情況，亦不適用於客戶自身的網站、應用程式或客戶資料庫 — 該等事宜由客戶自行負責。

3. What we collect3. 我們收集的資料

3.1 Information you give us3.1 你主動提供的資料

• The enquiry form on the Contact page — your name, company, email address, phone or WhatsApp number, the type of work you need (OEM, ODM, private label, filling, samples, factory visit), product category, estimated quantity, and the free-text message you write.「聯絡」頁的查詢表格 — 姓名、公司、電郵地址、電話或 WhatsApp 號碼、所需服務類型（OEM、ODM、私人品牌、灌裝、樣品、參觀廠房）、產品品類、預計數量，以及你填寫的自由文字內容。
• The Start a Project questionnaire — the same contact details plus the answers you give about your product concept, target market, actives and claims, texture, packaging, volumes, budget and timeline.「開始合作」項目簡報問卷 — 同樣的聯絡資料，加上你就產品概念、目標市場、活性成分及功效訴求、質感、包裝、產量、預算及時間表所填寫的答案。
• The live chat window — whatever you type into it, including any contact details you give the operator.即時對話視窗 — 你輸入的所有內容，包括你向客服提供的任何聯絡資料。
• Direct contact — the content of emails, phone calls and WhatsApp messages you send us, and the address details you give us for samples, quotations and shipping.直接聯絡 — 你發送的電郵、電話通話及 WhatsApp 訊息內容，以及你為樣品、報價及付運提供的地址資料。

Giving us this information is voluntary. But if you do not give us at least a name and an email address, we cannot reply to your enquiry, quote for your project or send you samples.提供上述資料純屬自願。但如果你不提供最少姓名及電郵地址，我們將無法回覆查詢、就你的項目報價或寄出樣品。

3.2 Information collected automatically as you browse3.2 你瀏覽時自動收集的資料

Two third-party scripts run on every page of this site.本網站每一頁均載入兩個第三方指令碼。

• Hotjar (site ID 2043981) — behavioural analytics. It records the pages you view, your clicks and taps, how far you scroll, mouse movement, your approximate location derived from your IP address, and your device, screen size, browser, operating system and referring page. It can replay that activity as a session recording and combine it with other visitors' activity into heatmaps and reports. We use the default Hotjar configuration, which suppresses the characters you type into form fields from recordings; it does still record that you interacted with a field, and any text already visible on the page. Hotjar states that it anonymises IP addresses.Hotjar（網站編號 2043981）— 行為分析工具。它記錄你瀏覽的頁面、點擊及輕觸、捲動幅度、滑鼠移動軌跡、由 IP 位址推算的大致位置，以及裝置、螢幕尺寸、瀏覽器、作業系統及來源頁面。它可將上述活動重播為操作錄影，並與其他訪客的活動合併製作熱圖及報告。我們採用 Hotjar 預設設定，該設定不會在錄影中收錄你在表格欄位輸入的文字；但仍會記錄你曾與該欄位互動，以及頁面上原已顯示的文字。Hotjar 表示會將 IP 位址匿名化。
• Tidio — the live chat bubble. The script loads with the page, before you open the chat. If you do start a conversation, Tidio processes the transcript together with the pages you were on, your approximate location from IP, and your device and browser. Transcripts are stored in Tidio's system and are readable by our team.Tidio — 即時對話視窗。該指令碼在頁面載入時已經啟動，即使你未開啟對話。若你開始對話，Tidio 會處理對話紀錄，連同你瀏覽過的頁面、由 IP 推算的大致位置，以及裝置及瀏覽器資料。對話紀錄儲存於 Tidio 系統，我們的團隊可以查閱。
• Hosting logs — our hosting provider records the standard information every web server sees: IP address, timestamp, the URL requested, response status, browser user-agent and referring page. These logs exist so the site can be delivered, kept available and defended against abuse.寄存記錄 — 我們的寄存服務供應商會記錄任何網頁伺服器都會產生的標準資料：IP 位址、時間、所要求的網址、回應狀態、瀏覽器識別字串及來源頁面。這些記錄用於傳送網頁、維持網站可用性及防範濫用。

3.3 Information stored on your own device3.3 儲存在你裝置上的資料

• Language preference — we store your choice of English or 繁體中文 in your browser's local storage under the key btc_lang, so the site opens in the language you picked.語言偏好 — 我們將你選擇的英文或繁體中文儲存於瀏覽器的本機儲存空間，鍵名為 btc_lang，讓網站以你選定的語言開啟。
• Project brief draft — the Start a Project questionnaire autosaves your answers on your device under the key btc_brief_v1, so you can close the tab and come back to a part-finished brief.項目簡報草稿 — 「開始合作」問卷會將你的答案自動儲存於你的裝置，鍵名為 btc_brief_v1，方便你關閉分頁後回來繼續填寫。
• Third-party cookies — Hotjar and Tidio set their own cookies and storage entries on your device to recognise your browser across pages and visits.第三方 Cookie — Hotjar 及 Tidio 會在你的裝置設置其自身的 Cookie 及儲存項目，以在不同頁面及不同造訪之間辨識你的瀏覽器。

The two btc_ entries stay on your device until you clear your browser storage. They are not sent to us, and a saved draft is not transmitted anywhere until you actually submit the brief.上述兩個 btc_ 項目會一直留在你的裝置，直至你清除瀏覽器儲存空間為止。它們不會傳送給我們；已儲存的草稿在你真正提交簡報之前，不會傳送到任何地方。

4. How we use it, and our legal basis4. 用途及法律依據

We use the personal data described above to:我們使用上述個人資料的目的如下：

• reply to your enquiry, answer questions and recommend a formulation route;回覆查詢、解答問題及建議配方方向；
• prepare quotations, arrange samples and set out lead times;準備報價、安排樣品及訂定交期；
• manage a manufacturing project and the commercial relationship that follows it, including production, QC documentation, shipping and invoicing;管理生產項目及其後的商業關係，包括生產、品檢文件、付運及發票；
• keep proper business records and meet accounting, tax and product-safety record-keeping obligations;保存妥善的業務記錄，並符合會計、稅務及產品安全的存檔要求；
• understand how the website is used and make it clearer and faster (this is what the analytics are for — we look at patterns, not at individuals);了解網站的使用情況以改善其清晰度及速度（分析工具的用途在此 — 我們觀察的是整體趨勢，而非個別人士）；
• keep the site and our systems secure, and investigate abuse or fraud.維持網站及系統的保安，並調查濫用或欺詐行為。

Under the PDPO, we collect personal data only for a lawful purpose directly related to our function as a contract manufacturer, we collect no more than is necessary for that purpose, and we use it only for that purpose or a directly related one — unless you agree otherwise or the law requires it (Data Protection Principles 1 and 3).根據私隱條例，我們只為與代工製造業務直接相關的合法目的收集個人資料，收集範圍不超乎所需，並只用於該目的或與其直接有關的目的 — 除非取得你同意或法律另有規定（保障資料第1及第3原則）。

Under the GDPR / UK GDPR, our legal bases are: Article 6(1)(b) — taking steps at your request before entering into a contract, and performing a contract once we have one; Article 6(1)(f) — our legitimate interests in running, securing and improving this website, offering chat support and keeping records of our business dealings, balanced against your interests; and Article 6(1)(c) — compliance with legal obligations that require us to retain records.根據 GDPR／英國 GDPR，我們的法律依據為：第6(1)(b)條 — 應你要求在訂立合約前採取步驟，以及在訂立合約後履行合約；第6(1)(f)條 — 我們在營運、保安及改善本網站、提供即時對話支援及保存業務往來記錄方面的正當利益，並已與你的權益作出平衡；第6(1)(c)條 — 遵守要求我們保存記錄的法律責任。

We do not make decisions about you by automated means that produce legal or similarly significant effects, and we do not profile you for advertising.我們不會以自動化方式對你作出具法律效力或同等重大影響的決定，亦不會為廣告目的對你進行分析歸類。

5. Cookies, analytics and chat — and how to switch them off5. Cookie、分析工具及對話 — 如何關閉

• Opt out of Hotjar — Hotjar runs a permanent opt-out page that stops it collecting data about you across every site that uses it: hotjar.com/policies/do-not-track. Hotjar also honours a browser's Do Not Track setting.退出 Hotjar — Hotjar 設有長期退出頁面，可阻止它在所有使用 Hotjar 的網站收集你的資料：hotjar.com/policies/do-not-track。Hotjar 亦會遵從瀏覽器的「Do Not Track」設定。
• Block cookies in your browser — every major browser lets you block or delete cookies and site data, either generally, for third parties only, or per site. Chrome, Safari, Firefox and Edge all have this under Settings → Privacy.在瀏覽器封鎖 Cookie — 各主流瀏覽器均可整體、只針對第三方或按網站封鎖及刪除 Cookie 及網站資料。Chrome、Safari、Firefox 及 Edge 均可於「設定 → 私隱」中設定。
• Block the scripts — a tracker-blocking extension, or your browser's built-in tracking protection, will stop static.hotjar.com, script.hotjar.com, code.tidio.co and the Tidio widget domains from loading at all. The site works normally without them; you just lose the chat window.封鎖指令碼 — 使用追蹤封鎖擴充功能或瀏覽器內建的追蹤保護，可完全阻止 static.hotjar.com、script.hotjar.com、code.tidio.co 及 Tidio 視窗網域載入。網站在沒有它們的情況下運作正常，只是不會顯示對話視窗。
• Clear what is stored on your device — clearing site data for beautech.com.hk removes the Hotjar and Tidio entries along with our btc_lang preference and any saved project-brief draft.清除裝置上的儲存資料 — 清除 beautech.com.hk 的網站資料，會一併移除 Hotjar 及 Tidio 的項目，以及我們的 btc_lang 語言偏好和任何已儲存的項目簡報草稿。

Blocking cookies does not stop us receiving an enquiry you deliberately send us — that is you choosing to contact us, and it is covered by the rest of this policy.封鎖 Cookie 並不會阻止我們收到你主動發送的查詢 — 那是你選擇聯絡我們，相關處理受本政策其他條文規管。

6. Who we share it with6. 我們與誰分享

We do not sell personal data, we do not rent mailing lists, and we do not pass your enquiry to other manufacturers. Personal data reaches the following classes of transferee:我們不會出售個人資料、不會出租郵寄名單，亦不會將你的查詢轉交其他製造商。個人資料只會轉移予下列類別的承轉人：

In addition: enquiry correspondence sits in our business email system, which is run for us by an email and office-software provider; couriers receive the name and address needed to deliver samples; and our accountants, auditors, insurers and lawyers may see relevant records where they need to. We will also disclose personal data if we are required to by law, by a court, or by a regulator, or where it is necessary to establish or defend a legal claim.此外：查詢往來電郵存放於我們的商用電郵系統，該系統由電郵及辦公軟件供應商為我們營運；速遞公司會取得寄送樣品所需的姓名及地址；我們的會計師、核數師、保險公司及律師在有需要時可查閱相關記錄。若法律、法院或監管機構有所要求，或為確立或抗辯法律申索所必需，我們亦會披露個人資料。

Form submissions reach us as email at info@beautech.com.hk. Depending on how the enquiry is sent from your device, your own email provider may handle the message on the way to us.表格提交的內容會以電郵形式送達 info@beautech.com.hk。視乎你的裝置如何傳送查詢，你自己的電郵服務供應商亦可能在傳送過程中處理該訊息。

7. Data sent outside Hong Kong7. 傳送至香港境外

We are based in Hong Kong, but as the table above shows, the analytics, chat, hosting and font services we use process data in the European Union and the United States. Personal data collected through this site therefore leaves Hong Kong.我們的基地在香港，但如上表所示，我們使用的分析、對話、寄存及字型服務會於歐盟及美國處理資料。因此，透過本網站收集的個人資料會離開香港。

Section 33 of the PDPO, which would restrict transfers of personal data outside Hong Kong, has not yet been brought into operation. We nevertheless only use providers that publish their own data-protection terms and that commit to processing data on our instructions.私隱條例第33條（限制將個人資料轉移至香港境外）至今尚未生效。儘管如此，我們只採用已公布自身資料保障條款、並承諾按我們指示處理資料的服務供應商。

Where the personal data of visitors in the EEA or the UK is transferred to a country without an adequacy decision, we rely on the transfer mechanisms our providers put in place — normally the European Commission's standard contractual clauses and the UK international data transfer addendum, together with their own supplementary safeguards. You can ask us for details.若歐洲經濟區或英國訪客的個人資料被轉移至沒有適當性認定的國家，我們會依賴服務供應商所採用的轉移機制 — 一般為歐盟委員會的標準合約條款及英國國際資料轉移附錄，連同其自身的補充保障措施。你可向我們索取詳情。

8. How long we keep it8. 保留期限

Data Protection Principle 2(2) of the PDPO says personal data must not be kept longer than is necessary for the purpose it was collected for, and section 26 requires us to erase data that is no longer required. In practice:私隱條例保障資料第2(2)原則規定，個人資料的保留時間不得超過收集目的所需；第26條亦要求我們刪除不再需要的資料。實際安排如下：

• Enquiries that go nowhere — kept for up to 24 months after the last contact, in case you come back to the same project, then deleted.沒有後續的查詢 — 由最後聯絡日起保留最多24個月，以便你日後就同一項目再次聯絡，其後刪除。
• Project briefs, quotations and manufacturing records — kept for the life of the project and normally for up to 7 years afterwards, to cover contractual, accounting, tax and product-safety record-keeping, then deleted or anonymised.項目簡報、報價及生產記錄 — 於項目進行期間保留，其後一般保留最多7年，以符合合約、會計、稅務及產品安全的存檔需要，之後刪除或匿名化。
• Hotjar data — held on Hotjar's systems under the retention period set for our account; Hotjar's standard maximum for recordings and heatmap data is 365 days.Hotjar 資料 — 按我們帳戶設定的保留期存放於 Hotjar 系統；Hotjar 對錄影及熱圖資料的標準上限為365日。
• Chat transcripts — kept in Tidio while they are useful for support and reference, and deleted in line with the retention settings on our account.對話紀錄 — 在對支援及參考仍有用途期間存放於 Tidio，並按我們帳戶的保留設定刪除。
• Hosting logs — short-lived, kept only for delivery, availability and security purposes.寄存記錄 — 保留時間短暫，僅用於傳送、可用性及保安用途。
• Data on your own device — btc_lang and any saved brief stay until you clear your browser storage.你裝置上的資料 — btc_lang 及任何已儲存的簡報草稿會保留至你清除瀏覽器儲存空間為止。

9. Security9. 資料保安

The site is served over HTTPS. Access to enquiry correspondence and project files is limited to the staff who need it to do their job, and our third-party providers are chosen partly on the strength of their own security commitments. We take practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use, as Data Protection Principle 4 requires.本網站以 HTTPS 傳送。查閱查詢往來及項目檔案的權限僅限於工作上有需要的員工；我們挑選第三方服務供應商時，亦會考慮其保安承諾。按保障資料第4原則的要求，我們會採取切實可行的步驟，保障個人資料免受未經授權或意外的查閱、處理、刪除、喪失或使用。

No transmission over the internet and no storage system is completely secure, so we cannot guarantee absolute security. If a breach occurs that is likely to cause harm, we will act on it and notify those affected and the relevant authorities where we are required or where it is the right thing to do.互聯網傳送及任何儲存系統均無法做到絕對安全，故此我們不能保證絕對的安全性。若發生可能造成損害的資料外洩事件，我們會即時處理，並在法律要求或情理所需的情況下通知受影響人士及有關當局。

10. Your rights under the PDPO10. 你在私隱條例下的權利

If you are in Hong Kong — or wherever you are, in relation to data we hold here — the PDPO gives you two core rights:如果你身處香港 — 或不論你身在何處，就我們在香港持有的資料而言 — 私隱條例賦予你兩項核心權利：

• A data access request (查閱資料要求) — under sections 18 and 22 of the PDPO you may ask us to tell you whether we hold personal data about you and to give you a copy of it. We must comply within 40 days (section 19). We may charge a fee for complying, which the PDPO requires not to be excessive (section 28); we will tell you the amount before we do the work. You may use the Privacy Commissioner's Data Access Request Form (OPS003), but you are not obliged to.查閱資料要求 — 根據私隱條例第18及22條，你可要求我們告知是否持有你的個人資料，並向你提供資料副本。我們必須於40日內作出回應（第19條）。我們可就處理有關要求收取費用，而條例規定費用不得過高（第28條）；我們會在處理前告知金額。你可使用私隱專員公署的《查閱資料要求表格》（OPS003），但並非必須。
• A data correction request (改正資料要求) — under section 22, if you believe personal data we hold about you is inaccurate, you may ask us to correct it. We must respond within 40 days, and if we refuse we must tell you why.改正資料要求 — 根據第22條，如你認為我們持有關於你的個人資料不準確，可要求我們改正。我們必須於40日內回應；若拒絕，亦必須說明理由。

To make either request, email info@beautech.com.hk with “Data access request” or “Data correction request” in the subject line, and tell us enough about yourself and the data concerned for us to find it — for example the email address and company you used when you contacted us. We may ask you to verify your identity before we release anything; that is to protect you, not to obstruct you.如欲提出上述要求，請電郵至 info@beautech.com.hk，主旨註明「查閱資料要求」或「改正資料要求」，並提供足夠資料讓我們找到相關記錄 — 例如你聯絡我們時使用的電郵地址及公司名稱。在提供資料前，我們可能要求你核實身分；此舉是為保障你，而非阻撓你。

If you are not satisfied with how we handle a request, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong — pcpd.org.hk, enquiry hotline +852 2827 2827. We would rather you told us first, so we can put it right.如你對我們處理有關要求的方式不滿意，可向香港個人資料私隱專員公署投訴 — pcpd.org.hk，查詢熱線 +852 2827 2827。當然，我們更希望你先告訴我們，讓我們有機會改善。

11. If you are in the EEA or the UK11. 歐洲經濟區及英國訪客

We work with beauty brands across Europe, so the GDPR and UK GDPR may apply to what we do with your data. Where they do, you also have the right to:我們與歐洲各地的美容品牌合作，因此 GDPR 及英國 GDPR 可能適用於我們對你資料的處理。在適用的情況下，你另享有以下權利：

• access a copy of your personal data, free of charge in normal circumstances;查閱你的個人資料副本，一般情況下免費；
• rectify data that is inaccurate or incomplete;更正不準確或不完整的資料；
• erase data where we no longer have a good reason to hold it;在我們已無充分理由持有資料時，要求刪除；
• restrict or object to our processing — including processing based on legitimate interests, such as the analytics described above;限制或反對我們的處理 — 包括基於正當利益的處理，例如上文所述的分析工具；
• receive the data you gave us in a portable, machine-readable form (data portability);以可攜、機器可讀的格式取得你提供的資料（資料可攜權）；
• withdraw consent at any time where we relied on consent, without affecting what we did before you withdrew it;在我們以同意為依據時，隨時撤回同意，而不影響撤回前已進行的處理；
• complain to your national supervisory authority, or to the UK Information Commissioner's Office if you are in the UK.向你所在國家的監管機關投訴；若你身處英國，可向英國資訊專員辦公室（ICO）投訴。

Email info@beautech.com.hk to exercise any of these. We aim to respond within one month.如欲行使上述任何權利，請電郵 info@beautech.com.hk。我們的目標是於一個月內回覆。

12. Direct marketing12. 直接促銷

Part 6A of the PDPO requires us to notify you and obtain your consent before we use your personal data in direct marketing. We will not add you to a marketing list simply because you sent an enquiry. If we ever want to send you news, product updates or invitations, we will ask you first and tell you exactly what we would use and for what.私隱條例第6A部規定，我們在將你的個人資料用於直接促銷前，必須通知你並取得你的同意。你僅因發出查詢，我們不會將你加入促銷名單。若我們日後希望向你發送消息、產品更新或活動邀請，會先徵詢你的意見，並清楚說明會使用哪些資料及作何用途。

You can require us to stop using your data for direct marketing at any time, free of charge, by emailing info@beautech.com.hk (section 35G of the PDPO). We will act on it and confirm.你可隨時免費要求我們停止將你的資料用於直接促銷，只需電郵 info@beautech.com.hk（私隱條例第35G條）。我們會照辦並作出確認。

13. Children13. 兒童

This is a trade site for brand owners and buyers. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, tell us and we will delete it.本網站為面向品牌持有人及採購人員的業界網站，並非以兒童為對象；我們不會在知情下收集16歲以下人士的個人資料。若你認為有兒童向我們提供了個人資料，請通知我們，我們會予以刪除。

14. Links to other sites14. 其他網站連結

Our pages link to other places — our Facebook and YouTube channels, WhatsApp, and occasionally to industry references in the Journal. Once you follow a link you are on someone else's site, under their privacy policy, not this one.我們的頁面設有通往其他網站的連結 — 包括我們的 Facebook 及 YouTube 頻道、WhatsApp，以及「專欄」中偶爾引用的業界參考資料。一旦你點擊連結，即進入他方網站，適用其私隱政策，而非本政策。

15. Changes to this policy15. 政策修訂

We will update this page when what we do changes — for example if we add a cookie consent banner, change analytics provider or start handling enquiries through a new system. The date at the top always shows the current version. If a change materially affects how we use data you have already given us, we will make that clear rather than bury it.當我們的做法有所改變時，我們會更新本頁 — 例如加設 Cookie 同意橫額、更換分析工具供應商，或改用新系統處理查詢。頁首日期即為現行版本日期。若某項改動會對我們使用你已提供資料的方式造成重大影響，我們會清楚說明，而不會含糊帶過。

16. How to reach us16. 聯絡我們