1. Who is responsible for your information

IWEIYI.com is operated by Hydra Internet Limited, a company incorporated in Hong Kong SAR. For the activities described here, Hydra Internet Limited determines why and how personal information is used and is the data controller, or the equivalent responsible organisation under applicable law.

Registered office: Room 1003, 10/F, Tower 1, Lippo Centre, 89 Queensway, Admiralty, Hong Kong, China.

Privacy enquiries: support@iweiyi.com or our contact form. Please identify your message as a privacy request. This notice covers customers, website visitors, people contacting us and gift recipients whose details a purchaser supplies.

2. Information we collect and where it comes from

• Account and contact details: your name, email address, telephone number, account credentials and language or currency preferences.
• Orders and deliveries: purchased products, billing details, recipient name and contact details, delivery address, requested date, instructions, card messages, order history and correspondence about delivery, refunds or complaints.
• Payment records: payment method, amount, currency, transaction reference, payment status and limited payment information returned by the payment provider. Payment providers collect the credentials needed for their payment services.
• Support and content: enquiries, chat messages, emails, attachments, photographs and reviews that you choose to submit.
• Technical and usage information: IP address, browser and device information, approximate location inferred from IP address, pages and products viewed, referral information, advertising identifiers and interactions with our website or advertising.
• Preferences and permissions: marketing choices and, where collected, consent and withdrawal records.

Information comes directly from you, from a purchaser arranging a gift for you, from your browser or device, and from payment, fulfilment and technical providers helping us deliver the service. Please do not send passwords, full payment-card details, identity documents or sensitive personal information in an ordinary support message.

3. Why we use information and the applicable legal grounds

• Orders and customer service: create and administer accounts, accept payment, prepare and deliver gifts, communicate about an order and handle service problems. For the purchaser, this is generally necessary to take requested steps before a contract or perform that contract.
• Security and service operation: prevent misuse and fraud, investigate failures and maintain the website. Depending on the applicable law, the basis may be a legal obligation or our legitimate interests in running a secure service, balanced against your rights.
• Business records: maintain accounting and tax records, meet legal requirements and establish, exercise or defend legal claims.
• Optional marketing, analytics and advertising: communicate offers, understand website use, measure campaigns and personalise advertising, subject to applicable law and the choices described below. Consent is required wherever the law or the relevant platform policy requires it.

Legal grounds differ by jurisdiction. We do not treat legitimate interests as a universal legal ground, or assume that the purchaser's contract supplies the legal basis for every use of a recipient's information. Where consent or separate consent is required, another purpose does not replace it. Reading this policy, creating an account or placing an order is not, by itself, consent to optional advertising or customer-list sharing.

4. Required information and gifts for someone else

We need enough information to process payment, identify the order and arrange delivery, including a usable delivery address and recipient contact details. Without required information, we may be unable to fulfil an order. Optional notes and optional marketing choices are not required simply to buy a gift.

If you supply someone else's information, you must have a lawful basis to do so, provide accurate details and make this policy available to them where appropriate. We use recipient details for fulfilment, delivery coordination, delivery evidence and related service issues. A gift recipient is not automatically a marketing subscriber or an eligible Customer Match contact.

Card messages, photographs and delivery instructions may reveal private matters. Provide only what is needed. An allergy or other health-related request can involve sensitive information; discuss the minimum necessary details with us. A delivery to a hospital or a condolence gift is not permission to infer health, religion or another sensitive characteristic for advertising.

5. Who receives personal information

We share necessary customer data with third parties that perform services on our behalf, and with other recipients where there is a lawful reason. These include:

• Local florists, bakeries, gift suppliers, couriers and logistics partners, who need the order contents and relevant recipient, delivery and message details.
• Payment processors, banks and fraud-prevention providers supporting payment, authentication, disputes and refunds.
• Hosting, storage, maintenance, security, email and customer-support providers, including Tawk.to for the website's live-chat service.
• Google for analytics, advertising measurement and, when used with the necessary permissions, Customer Match; and Meta for Facebook advertising technology present on the website.
• Accountants, auditors, legal advisers and public authorities where necessary for compliance or legal claims.
• Parties to a genuine business reorganisation or transfer, where lawful and subject to appropriate confidentiality and privacy safeguards.

Service-provider access should be limited to the tasks they perform for us and governed by appropriate data-protection arrangements. Some providers, including payment services, also determine their own processing purposes under their privacy notices. We do not offer customer lists for sale to other businesses for their own independent marketing; advertising disclosures can nevertheless be treated as a sale or sharing under some privacy laws, as explained below.

6. Payments and financial information

The payment options available at checkout determine which provider receives payment information. A bank, card service or digital-wallet provider may collect financial credentials, device information and fraud-screening data under its own notice. We receive the information needed to reconcile the payment and manage the order, refund or dispute; our shop does not store full payment-card numbers or card security codes.

If you send payment evidence, hide unrelated transactions, account balances and unnecessary financial details. We will not ask you to send your banking password or a payment authentication code to customer support.

7. Cookies and similar technologies

The website uses cookies, local storage, tags and similar technologies. Essential functions include keeping a basket, maintaining a signed-in session and protecting transactions. Preference functions remember choices such as language or currency. Analytics and advertising technologies measure visits and campaigns and can associate activity with a device or account.

Where required by law, non-essential storage or access and related optional processing require prior consent. A privacy-policy link is not a consent mechanism. You can use browser controls to block or clear storage; doing so may affect login, basket or checkout functions. Browser controls do not remove an email address already supplied to an advertising audience. Contact us separately about customer-list advertising.

Cookie duration varies by technology and settings; some end with a session and others persist. Third-party notices explain their technologies. We do not claim that a browser's Do Not Track signal automatically changes every integration. See the regional section for applicable opt-out preference signals.

8. Google Analytics, Google Ads and other online services

We use Google Analytics and Google advertising tools to understand visits and measure advertising performance. Depending on the feature, permissions and settings, Google may receive device or browser information, online identifiers, IP-related information, referring pages and interaction or conversion events. Optional personalised advertising is subject to the consent requirements described in this policy.

Read how Google uses information from sites or apps that use its services and Google's Privacy Policy. You can review Google's settings in My Ad Center and the Google Analytics browser opt-out add-on.

The website also includes Meta advertising technology and Tawk.to chat. Their processing is described in Meta's Privacy Policy and Tawk.to's Privacy Policy. Using an external service or social link can involve additional processing by that provider.

9. Google Ads Customer Match and customer email lists

Where permitted by law and Google's policies, and only with any required consent, we may share customer email addresses collected directly from you with Google to provide Customer Match advertising services on our behalf. Google matches eligible identifiers with Google accounts so that we can include or exclude audiences and show relevant advertising on Google services. This is separate from subscribing to a newsletter and from cookies on this website.

Customer Match supports other contact identifiers, but a customer email-list upload does not justify sharing an entire order record. We limit any upload to eligible identifiers needed for the stated purpose. Purchased or scraped lists, recipient details supplied only by a gift purchaser, payment details, card messages and sensitive information are not appropriate inputs for this purpose.

The matching process uses SHA-256 hashing for supported identifiers such as email addresses. Hashing changes the format so identifiers can be compared; it does not make the information anonymous or remove consent requirements. Not every field supported by Google is hashed, so we do not describe all Customer Match data as encrypted or anonymous.

Google states that uploaded customer files are used to match customers to Google accounts and check compliance with its policies, not to build or enhance customer profiles from those files or disclose the files to other advertisers. Google's separate processing of interactions with advertisements is explained in its own notices. For Customer Match processing covered by the applicable Google Ads Data Processing Terms, Google acts as a processor on the advertiser's behalf; this does not describe every Google service.

For people in the European Economic Area, the United Kingdom and Switzerland, Google's EU user consent policy requires legally valid consent for collection, sharing and use of personal data to personalise ads, and for cookies or local storage where legally required. Consent records and a way to withdraw consent are required. For EEA Customer Match advertising, Google's required consent signals must reflect the person's choices, including consent to advertising data use and ad personalisation.

Read Google's Customer Match policy, EU user consent policy and explanation of Customer Match data use. To object or withdraw consent to IWEIYI customer-list advertising, email support@iweiyi.com using the address concerned, or use our contact form. Ask for removal from Google Customer Match and other customer-list advertising. We will stop future use for that purpose and arrange removal from lists we control, subject to reasonable identity verification. Provider processing may take time; withdrawal does not mean that you will see no advertisements.

10. Marketing preferences and withdrawal

You can unsubscribe from promotional emails using the message's unsubscribe link or by contacting us. You can separately object to direct marketing, withdraw advertising consent or ask not to be included in customer-list audiences. Tell us which email address and activity your request concerns. A newsletter preference, website storage choice and Google account advertising setting are different controls; changing one may not change the others.

Refusing optional marketing does not prevent an ordinary purchase. We may still send necessary order, delivery, payment, security or legal messages. Withdrawal applies to future processing and does not invalidate processing that was lawful before withdrawal. A minimal suppression record may be needed to respect your choice and avoid adding you again.

11. International processing and transfers

Our customers order from different countries, our operator is in Hong Kong, and fulfilment can take place in mainland China, Hong Kong, Macau or Taiwan. Hosting and technology providers may process information in other countries, including European countries and the United States. The information needed for a delivery may therefore cross borders.

Applicable transfer rules differ. Where required, transfers need an appropriate legal mechanism and safeguards, such as an adequacy decision, approved contractual clauses, assessments or separate consent. Foreign authorities may have access under their laws. Contact us to ask about the destination, recipient or safeguards relevant to your information; we will provide information available to you under applicable law.

12. How long information is kept

Retention depends on the information and the reason for keeping it. We consider account activity, fulfilment and customer-service needs, applicable tax and accounting periods, payment disputes, limitation periods, security investigations and your preferences. Order records may need to remain after an account is closed or marketing consent is withdrawn.

Marketing identifiers should be kept only while eligible and needed for that purpose; consent evidence and suppression records may need to remain to demonstrate or respect your choice. Google audience membership and the uploaded source file have different retention rules, described in Google's documentation. A platform's maximum audience duration is not a reason for us to retain data longer than necessary.

When information is no longer needed, it should be deleted or irreversibly anonymised. Restricted backups may persist through their recovery cycle and legal holds may delay deletion; retained copies must not become a new source for optional marketing.

13. Protecting your information

We use technical and organisational measures designed to reduce unauthorised access, misuse, loss and disclosure, including HTTPS for website connections and access controls. Security measures must be appropriate to the information and the risks. No website, payment service or storage system can guarantee absolute security.

Keep your account password private and contact us if you suspect misuse. We will assess reported incidents and make notifications where applicable law requires them. Do not send sensitive documents unless they are necessary and we have agreed an appropriate way to receive them.

14. Your rights and how to make a request

Depending on the law that applies, you may be entitled to access or obtain a copy of your information, correct it, request deletion, restrict processing, receive portable data, object to processing or direct marketing, withdraw consent, or ask for an explanation and human review of certain automated decisions. These rights have legal conditions and exceptions.

Email support@iweiyi.com or use our contact form. Describe your request and how we can identify the relevant information. We may ask for proportionate identity verification or proof of authority for a representative; do not send an identity document unprompted. We will respond within the period required by applicable law and explain any lawful refusal, extension or applicable fee.

You may complain to the relevant data-protection authority. If a right to appeal a refusal applies, contact us to request a review. We will not penalise you merely for exercising a privacy right, although we may be unable to provide a service without the information needed to deliver it.

15. Additional information for different regions

• Hong Kong: the Personal Data (Privacy) Ordinance provides rights including access and correction. Direct marketing is subject to its notice and consent requirements. You may contact the Office of the Privacy Commissioner for Personal Data with a complaint.
• Mainland China: where the Personal Information Protection Law applies, processing must have a lawful basis and respect applicable rights to know, decide, restrict or refuse, access, copy, correct and delete information. Sensitive personal information, providing information to another independent handler and cross-border transfers may require additional notices, separate consent or other measures required by law. Contact us for the recipient and transfer details relevant to your request.
• EEA, UK and Switzerland: where the applicable data-protection laws apply, the purposes, grounds, recipients and rights in this policy should be read with those laws. You can object to direct marketing and complain to your competent supervisory authority. Google's consent-policy requirements described above also apply to its covered services.
• US states, including California: where the relevant law applies to us and to you, disclosures for cross-context behavioural advertising may be treated as a sale, sharing or targeted advertising even without payment. You may request an opt-out through the contact details above, including by asking us not to sell or share your information for advertising. Applicable rights can include knowing, accessing, correcting, deleting and obtaining a copy of information, using an authorised agent and appealing a refusal. Legally recognised opt-out preference signals must be honoured where required; do not assume every browser signal changes an existing uploaded email list.

Mandatory local rights are not limited by this policy. The contact route above is available to customers and recipients in other regions as well.

16. Automated processing

Commerce, payment, security and advertising systems use automated processing to operate services, identify suspicious activity, measure conversions and form audiences. Audience matching can associate an identifier with an account; advertising systems may use interactions to select advertisements. Authorised staff may use software-assisted tools to manage orders and enquiries, subject to the purposes and provider safeguards described here.

If a decision affecting you is based on automated processing, you may contact us for an explanation or human review where applicable law provides that right. We do not treat a privacy notice as permission to use sensitive gift messages or recipient circumstances for advertising profiles.

17. Children and external websites

Our ordering service is intended for adults or people with legal capacity to enter a purchase contract. A child can receive a gift, but provide only the delivery information needed and obtain parental or guardian authority where required. Children and known under-age users must not be added to personalised-advertising customer lists. Contact us if you believe a child's information has been used inappropriately.

External payment pages, social networks and other linked websites operate under their own privacy notices. Review those notices before supplying information. A link does not mean that this policy governs the other organisation.

18. Changes to this policy

We may revise this policy as our services, providers or legal obligations change. The date at the top identifies this version. Material changes will be communicated where required, and new consent must be obtained where required before a new optional use. An update does not retrospectively supply consent for an old customer list, and continuing to use the website is not consent to optional advertising.

For questions or privacy requests, contact support@iweiyi.com.