Política de privacidade

Privacy Policy

Last updated 17 September 2026

RAYORA INTERNATIONAL LIMITED, trading as Circa Beauty, operates thecircabeauty.shop and is the data user responsible for personal data described in this Privacy Policy. This policy explains what personal data we collect, why we use it, who may receive it, how long we keep it, and the choices and rights available to you. We handle personal data in accordance with Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) and other applicable privacy laws.

1 Personal data we collect

· Identity and contact data, such as your name, email address, telephone number, billing address, shipping address, and account details.

· Order and transaction data, such as products viewed, cart contents, purchases, returns, exchanges, discounts, delivery status, and communications relating to an order.

· Payment-related data. Payment card and wallet information is generally collected and processed directly by Shopify and the payment provider selected at checkout. We normally receive transaction status, limited payment details, and fraud-screening information rather than complete card numbers.

· Device and usage data, such as IP address, browser, device identifiers, operating system, referral source, pages viewed, interaction events, approximate location derived from IP address, and cookie or similar-technology data.

· Marketing and preference data, such as newsletter choices, consent records, campaign interactions, product preferences, and advertising identifiers where permitted.

· Customer-service and user-submitted data, such as messages, photographs, videos, reviews, survey responses, and information supplied when you contact us or make a claim.

2 How we collect personal data

We collect personal data directly from you, automatically when you use the website, and from service providers or partners that support checkout, payments, fraud prevention, analytics, advertising, fulfilment, delivery, and customer service. Providing data marked as required is necessary for the stated purpose. If required order or delivery information is not provided, we may be unable to process or deliver the order.

3 Purposes of use

· To create and manage accounts, process orders and payments, provide checkout, arrange fulfilment and delivery, and handle returns, refunds, disputes, and customer support.

· To verify transactions, prevent fraud and misuse, maintain website and payment security, and protect customers, our business, and service providers.

· To operate, troubleshoot, measure, personalise, and improve the website, products, services, and customer experience.

· To send service messages, including order confirmations, account notices, shipping updates, policy notices, recall or safety information, and responses to inquiries.

· To send marketing or personalised advertising where permitted and, where required, with your consent or indication of no objection.

· To comply with law, lawful requests, tax and accounting duties, sanctions or fraud controls, dispute resolution, and the establishment, exercise, or defence of legal claims.

4 Direct marketing

We may use your name, email address, telephone number, location or purchase and preference information to market Circa Beauty nail products, accessories, promotions, and related beauty content only where permitted by law. Where Hong Kong law applies, we will inform you of the intended marketing use and the classes of products or services before first use and will not use the data unless we have received the required consent or indication of no objection. We do not provide personal data to another person for that person's direct marketing without the notice and consent required by law.

You may stop marketing at any time, free of charge, by using the unsubscribe link in an email, following the opt-out instructions in a message, adjusting available preferences, or emailing support@thecircabeauty.shop. We may still send non-marketing messages needed for an order, account, safety issue, or legal notice.

5 Cookies analytics and advertising

We and our service providers use or may use cookies, pixels, local storage, and similar technologies, including Meta Pixel, Google Analytics, Google Ads, TikTok Pixel, and SMS marketing tools, to keep the website functioning, remember preferences and cart contents, understand website performance, prevent fraud, measure campaigns, provide advertising, and send messages where permitted. Where applicable law requires consent for non-essential technologies or marketing, we will request that consent through an available cookie or messaging control. You can also control cookies through your browser, although blocking necessary cookies may affect checkout or site functions.

6 Disclosure and classes of recipients

We disclose only the personal data reasonably needed for the relevant purpose. Recipients may include:

· Shopify and providers of website hosting, ecommerce, cloud storage, security, analytics, customer support, email or messaging, and technical services.

· Payment processors, card networks, banks, digital-wallet providers, fraud-prevention providers, and chargeback or dispute-resolution services.

· Manufacturers, fulfilment partners and warehouses in mainland China, and postal operators, couriers, customs agents, and delivery providers used to fulfil and dispatch orders.

· Advertising and marketing providers, including social-media and analytics platforms, where enabled and permitted by law.

· Professional advisers, insurers, auditors, prospective purchasers or successors in a genuine corporate transaction, courts, regulators, law-enforcement bodies, and other persons where disclosure is legally required or reasonably necessary to protect rights and safety.

Each independent third party may also process personal data under its own privacy notice. We do not sell personal data for money. Some privacy laws define certain advertising-related disclosures more broadly as a sale, sharing, or targeted advertising; where those laws apply, we will provide the choices they require.

7 Shopify

Our store is hosted by Shopify. Information submitted through the store is transmitted to Shopify and may be processed by Shopify and its service providers to provide and improve ecommerce services, security, checkout, and related features. Shopify may act as our processor and, for some features, as an independent controller or data user. More information is available in Shopify's consumer privacy policy at https://www.shopify.com/legal/privacy/app-users and privacy portal at https://privacy.shopify.com/.

8 International data transfers

Our customers, service providers, fulfilment operations, and technology systems may be located outside Hong Kong and outside your country of residence. Your personal data may therefore be transferred to and processed in other jurisdictions. We take reasonably practicable steps to use reputable providers and appropriate contractual, organisational, or technical safeguards, taking account of the sensitivity of the data and applicable legal requirements.

9 Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected or a directly related purpose, including order fulfilment, customer service, fraud prevention, accounting and tax requirements, dispute handling, and legal compliance. Retention periods vary by record type. We delete, anonymise, or securely dispose of personal data when it is no longer required, subject to lawful retention duties and technical backup cycles.

10 Security and incidents

We use reasonably practicable administrative, technical, and organisational safeguards appropriate to the nature of the data, including access controls and secure ecommerce and payment services. No internet transmission or storage system is completely secure. If a personal-data incident occurs, we will investigate, take reasonable containment and remedial steps, and notify affected persons or authorities when required or appropriate under applicable law.

11 Your Hong Kong access and correction rights

Subject to the Personal Data (Privacy) Ordinance, you may request confirmation of whether we hold your personal data, obtain a copy, and request correction of inaccurate data. A Hong Kong data access request should be made in writing using the form specified by the Privacy Commissioner for Personal Data where required. We may ask for information to verify identity and locate the requested data and may charge a fee that is not excessive where permitted. We will respond within the period required by law, generally not later than 40 days for a valid Hong Kong data access or correction request, subject to lawful exceptions.

Send privacy requests to support@thecircabeauty.shop with the subject line Privacy Request, or by post to: Privacy Contact, RAYORA INTERNATIONAL LIMITED, Room 316, 3/F, 143 Wai Yip Street, Kwun Tong, Hong Kong.

12 Rights in other jurisdictions

Depending on where you live, you may have additional rights to access, correct, delete, restrict, object to, or receive a copy of personal data, withdraw consent, or opt out of certain advertising uses. These rights are subject to applicable conditions and exceptions. We will not discriminate against you for exercising a right granted by applicable law. We may verify identity and authority before completing a request.

13 Children

The website is not directed to children under 16, and we do not knowingly collect personal data directly from a child under 16 without any consent required by applicable law. If you believe a child has provided personal data to us, contact support@thecircabeauty.shop so that we can review and take appropriate action.

14 Third party links

The website may link to third-party sites or services that we do not control. Their handling of personal data is governed by their own privacy notices. A link does not mean that we endorse the third party's privacy or security practices.

15 Complaints

Please contact us first at support@thecircabeauty.shop so that we can try to resolve a privacy concern. You may also have the right to complain to the privacy or data-protection authority where you live. In Hong Kong, the relevant authority is the Office of the Privacy Commissioner for Personal Data at https://www.pcpd.org.hk/.

16 Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, services, or legal duties. We will post the revised version, update the last-updated date, and provide any additional notice required by law. Material changes will apply from the stated effective date and will not retroactively remove rights already accrued.