Privacy Policy

2.1 Introduction and Scope

This Privacy Policy explains how HK FURENTA CO., LIMITED, a company registered in Hong Kong, collects, uses, shares, stores and protects personal data. It applies to this website, hkrongxinda.com, to the business services we deliver to clients and counterparties, and to the mobile management applications we publish on the Google Play Store and the Apple App Store. It applies to visitors to our website, to clients and prospective clients, to users of our mobile applications, and to counterparties, suppliers, agents and event partners who interact with us in the course of delivering services.

We are a business-to-business corporate services provider. Most of the personal data we hold is business contact data about people acting in a professional capacity — names, work email addresses, job titles, company names, and the records of the commercial relationship. We do not operate services intended for children, we do not knowingly collect data from children, and we do not permit our mobile applications to be used by anyone under the applicable minimum age for their region.

We do not sell personal data. We do not share personal data for the purpose of cross-context behavioural advertising as that term is defined by California law, and we treat every advertising partner listed in section 2.7 as operating under this restriction unless we say otherwise in writing to you. Where a legal or regulatory obligation requires us to disclose data other than by selling or sharing it — for example, a court order in a valid jurisdiction — we will notify you unless prohibited from doing so by law.

This document is written to satisfy, in a single readable place, the disclosure obligations imposed on us by the Apple App Store Review Guidelines, the Google Play Developer Program Policy, and the privacy and children's legislation of the European Union, the United Kingdom, California, Brazil, Canada, Australia, Singapore, Hong Kong and mainland China. Where a data subject in one of those jurisdictions has rights that differ from those described in the general sections, the specific section for that jurisdiction prevails.

2.2 Who We Are (the Controller)

HK FURENTA CO., LIMITED is the controller of the personal data described in this Privacy Policy. Our registered office is at Room 701 (Unit 127), 7/F, Tower B, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui East, Hong Kong. For general enquiries, including anything relating to this policy, write to support@hkrongxinda.com. Clients with an active engagement and counterparties dealing with a specific commercial arrangement should write to pengjinlong@hkrongxinda.com, which reaches the engagement owners directly.

We determine the purposes and means of processing the personal data described in this policy. We do not use external processors to make the decisions about why data is processed. Where we engage processors — for example, hosting, email delivery, analytics or advertising partners — they act on our instructions, and section 2.9 lists the categories of processors and the data they receive.

2.3 Definitions

"Personal data" means any information relating to an identified or identifiable natural person. In the United States, the equivalent concept is "personal information" under the California Consumer Privacy Act as amended, and we use the two terms interchangeably throughout this document.

"You" means the person reading this policy. Depending on the context, "you" may be a website visitor, a client, a prospective client, an application user, a contact at a client organisation, or a supplier or partner. "We", "us" and "our" mean HK FURENTA CO., LIMITED. "The apps" means the mobile management applications we publish on the Google Play Store and the Apple App Store, together with any future application we publish under the same policy.

"Personal data breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. "Data subject" means the person to whom personal data relates. "Supervisory authority" means the independent authority established by the relevant law — for example, the Information Commissioner's Office in the United Kingdom, the Irish Data Protection Commission where we are the subject of a GDPR establishment decision, the California Privacy Protection Agency, the Autoridade Nacional de Proteção de Dados in Brazil, or the Office of the Privacy Commissioner in Hong Kong.

"Advertising identifier" means a device-scoped identifier used to build a profile for advertising purposes, such as the Google Advertising ID on Android or the Identifier for Advertisers on Apple platforms. "Consent management platform" means the component that records your advertising consent choices and transmits them to advertising partners. "Global Privacy Control" or "GPC" means the browser signal described in section 2.6.3.

2.4 Information We Collect

We collect personal data in five ways. What we collect depends on how you interact with us, and we collect nothing that is not needed for the purpose described in section 2.5.

2.4.1 Information you provide to us

When you submit the contact form on our website, we collect the name, work email address, optional company name, optional country or region, the service you are interested in, and the content of your message. You also tick a consent box confirming that we may use those details to respond to you. If you email us directly, we collect whatever you choose to put in the message and whatever your mail client adds to it, including your name and email address.

When you engage us for services, we collect the information needed to perform that engagement. This typically includes identity and contact details for the individuals we are contracting with, corporate records for the entities involved, customs and shipping documentation, commercial terms, invoices and payment records, and the correspondence that forms the record of the engagement. For regulatory and audit purposes we also retain the records required to demonstrate that a transaction was legitimate, including counterparty due diligence files and certificates of origin.

2.4.2 Information collected through the mobile applications

The apps we publish on the Google Play Store and the Apple App Store are management tools for the services described on our Business Services page. They may collect the account identifier you create, the content you enter into project plans, order records, supply chain checkpoints and notes, and the operational files you upload, such as shipping documents or specifications. Where an app includes an advertising-supported free tier, the advertising SDKs described in section 2.7 collect the device-level data listed in that section. You control whether advertising SDKs operate at all through the consent screen and the advertising options inside the app.

2.4.3 Information collected automatically

When you visit hkrongxinda.com, our server logs the requested URL, the referring page, the timestamp, the browser and operating system you used, and the truncated IP address of the connection. These logs are used to keep the site available, to investigate errors, and to detect abuse. We do not use third-party analytics trackers on our marketing pages, we do not run cross-site advertising cookies, and we do not embed third-party maps, chat widgets or video players that would transmit your visit to a third-party server as a side effect of page load.

2.4.4 Advertising identifiers and device signals

In the apps, the advertising SDKs we integrate may read your device's advertising identifier, along with device model, operating system and version, screen resolution, language, network operator, and coarse location derived from the IP address. On Apple platforms this includes the App Tracking Transparency permission state. Where you have granted location permission to an app, precise location data may also be processed by advertising partners for interest-based advertising. Section 2.7 describes each partner individually, and section 2.8 describes what each ad format does with that data.

2.4.5 Information from third parties

We receive limited information from third parties in specific circumstances. We receive confirmation from advertising partners of whether an advertising identifier has been deleted or reset, which tells us to stop using it. We receive delivery and bounce status from our email provider, which tells us whether to correct or remove an address. We receive bank or card confirmation of a payment you have made to us. We receive counterparty information from customs brokers, carriers and inspection agencies when we are instructed to handle a shipment on your behalf. We do not buy contact lists, and we do not enrich records with data purchased from third-party data brokers.

2.5 How We Use Your Information and Our Lawful Bases

We use personal data only for the purposes set out below, and only where we have a lawful basis for doing so. Where the basis is consent, you may withdraw it at any time; where the basis is legitimate interests, you may object; where the basis is contract, we cannot use the data for another purpose without a further basis. We do not use your data for automated decision-making that produces legal effects or similarly significant effects about you.

We may process personal data for a new purpose that is not listed above only where the law allows it — for example, where we have obtained your consent for that purpose separately, or where the processing is necessary for the establishment, exercise or defence of legal claims.

2.6 Cookies, Similar Technologies, and Device Storage

2.6.1 What the website stores

Our website sets no advertising cookies and no cross-site tracking cookies. The site uses a small amount of first-party browser storage for functional purposes only. A session or preference store remembers interface choices such as the state of a service accordion or the language you have selected, so that the page behaves consistently as you move between sections. These items contain no identifier that can be linked back to you beyond the session in which you made the choice, they are not read by advertising partners, and clearing your browser storage removes them. If the site is later extended with a measurement or analytics tool, this section will be updated before that tool is deployed, and any such tool will be subject to a consent requirement in the EEA and the UK.

2.6.2 What the apps store

The apps store information locally on your device so that the application functions while you are offline. This includes your preferences, cached reference data, and drafts of content you have entered but not yet submitted. Some of this storage is governed by the operating system's own backup mechanism, which we do not control and which we do not receive a copy of. Deleting the app removes the local store on the device, subject to your operating system's own backup and restore settings.

2.6.3 Advertising identifier, App Tracking Transparency, and Global Privacy Control

Three device-level signals matter for advertising, and we handle all three explicitly.

Advertising identifier. The apps may read the Google Advertising ID on Android or the Identifier for Advertisers on Apple platforms, unless you have deleted or reset it. Resetting the identifier on Android, or deleting the app and reinstalling it on iOS, causes a new identifier to be issued. We do not ourselves build a persistent cross-app profile from this identifier, but our advertising partners can, within the limits described in section 2.7.

App Tracking Transparency (ATT). On Apple platforms, our apps present the system tracking permission prompt before any tracking occurs. If you decline, the app continues to function, advertising identifiers are not read, and advertising is limited to what can be delivered without tracking — typically contextual rather than personalised. Declining does not remove functionality from the paid tier, and does not remove functionality from the free tier beyond the loss of personalised advertising.

Global Privacy Control (GPC). When your browser or extension sends a GPC signal, we treat it as a valid request to opt out of the sale and sharing of personal data for cross-context behavioural advertising, and we pass that preference to our advertising partners through industry-standard consent and opt-out signals. GPC is honoured site-wide without you having to contact us. You can also set the equivalent signal on your device where your operating system supports it.

2.6.4 How to control or withdraw consent

Where you have given consent for advertising, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. You can withdraw consent in the app under Settings, by deleting the app, by resetting your advertising identifier, by declining or revoking App Tracking Transparency permission, by enabling GPC in your browser, or by writing to support@hkrongxinda.com. When consent is withdrawn, we stop loading the advertising SDKs that require it and stop sharing identifier data with the partners concerned, and we instruct the partners to stop using data attributable to the consent we previously provided. Refusing consent does not affect your access to any paid feature, and does not reduce the functionality of our services.

---

2.7 Advertising, Ad Networks, and Software Development Kits

Some of our mobile applications are free to download and are funded in part by advertising. When you use a free tier of an app, advertising is part of the exchange — but you are in control of whether it happens at all, and you are told plainly what it involves. This section names every advertising partner that may operate in our apps, describes what each one does, what data each one collects, the lawful basis we rely on, how you can stop it, and where that partner publishes its own policy.

The general rule. In the European Economic Area, the United Kingdom, and any other jurisdiction that requires prior consent, no advertising SDK listed in this section is initialised until you have given consent through the app's consent screen, and the consent screen is shown before any personal data is shared with any partner. In jurisdictions that operate an opt-out model rather than an opt-in model — including California under the CCPA as amended by the CPRA — we do not serve personalised advertising unless you have not opted out, and we honour the Global Privacy Control signal as an opt-out request. In all other jurisdictions, the partners operate under the limited purposes and opt-out routes each of them publishes, which are summarised in this section and in the table at the end of it.

Who the data goes to. The data an advertising SDK collects is disclosed by that SDK to its own operator. We do not receive the individual advertising profiles that our partners build, we do not buy audience data from them, and we do not receive any list of the individuals they have shown advertising to. The partners do receive enough information to attribute an install, count an impression, determine whether an ad was clicked, and prevent fraudulent or abusive traffic.

2.7.1 Google AdMob

Google AdMob is our primary advertising SDK and the partner most likely to be present in any app we publish. It is included in this policy in more detail than any other partner, because it is the partner whose data practices are most likely to affect the devices our users install our software on, and because it is the specific disclosure the specification requires of us.

What the SDK does. The AdMob SDK is embedded in our free-tier applications. When an advertising-supported screen is reached, the SDK contacts Google's advertising servers, receives an advertisement or a decision not to fill the slot, and renders it. The SDK also performs its own tasks locally, including reading the device advertising identifier, checking the App Tracking Transparency authorisation state on Apple platforms, generating a request for an ad with contextual information, and receiving and rendering the resulting creative. It also maintains a frequency-cap and session identifier used to limit how often a user sees advertising, and it may cache creative assets locally.

Data collected. The AdMob SDK collects the advertising identifier on the device, where one is available and not deleted; the device model, manufacturer, brand, CPU architecture, operating system and its version, screen size and density, language, and the total memory available to the app. It collects the IP address of the connection, from which a coarse geographic location is derived, and the network operator. It collects app-specific information including the package name of the app, the version of the app, the developer ID assigned to us, and the list of ad formats and ad networks enabled in the app. It records interactions: ad requests, impressions, clicks, and conversions. On Apple platforms it reads the ATT authorisation state, and where permission has been granted it reads the Identifier for Advertisers. Where you have granted location permission, it may access location data for the purpose of interest-based advertising. It collects performance and diagnostic data, including crash information and app responsiveness statistics, which is used to improve SDK stability and to detect invalid traffic.

Lawful basis. In the EEA and the UK, AdMob is initialised only after you consent through the app's consent screen; the lawful basis for the personal data that follows is consent under Article 6(1)(a) GDPR, and separately legitimate interests under Article 6(1)(f) for the limited purposes of frequency capping, security, and preventing invalid traffic, which do not require consent. In jurisdictions that do not require consent for this processing, we rely on legitimate interests for the same limited purposes and on your opt-out rights under local advertising law. In California and other opt-out jurisdictions, we do not share your advertising identifier for cross-context behavioural advertising unless you have not exercised your right to opt out and have not enabled GPC.

Opt-out and control. You can opt out of personalised advertising from AdMob in several ways. In our apps, use Settings, then Privacy, then Advertising Options, and turn off "Limit Ad Tracking" or "Personalised Ads". On iOS, decline or revoke the tracking permission in Settings, Privacy & Security, then Tracking. On Android, delete or reset the advertising identifier in Google Settings, then Privacy, then Ads. In your browser, enable Global Privacy Control. You can also use Google's About Ads opt-out page to opt out of interest-based advertising on participating websites and apps, and Google's Ads Settings to review and change your ad preferences. Opting out does not stop advertising from appearing; it changes it from personalised to contextual or limits its targeting. In the EEA and the UK, you can withdraw consent at any time through Settings or by writing to support@hkrongxinda.com, in which case the AdMob SDK will no longer be initialised.

Google Play Families and app-open advertising. Where an app is designated for children, we do not serve interest-based advertising and we do not use personal information for the purposes of interest-based advertising. Our free-tier apps are not designated for children, and we configure our AdMob account accordingly so that child-directed treatment is applied where it is required. On Android, the Google Play Families policy and the Families Ads Settings we select determine that treatment.

Google's own policy. AdMob is operated by Google LLC. Google's handling of the data described above is governed by Google's Privacy Policy, available at https://policies.google.com/privacy, which also explains how to change your Google privacy settings and how to manage data associated with your Google account.

2.7.2 Google Ad Manager (GAM)

Google Ad Manager is a server-side advertising platform rather than an on-device SDK. It is used where we serve advertising through web placements or through a mediation layer that allocates a request to a specific partner. It receives the request and the context of the placement, performs the auction or selection, and returns the winning creative to be rendered by the app or the page. The data it processes includes the advertising identifier where available, IP address, device and operating system information, coarse location, language, the referring URL, and the logs of the auction and the impression. The lawful basis is legitimate interests for the delivery of the placement we have contracted for, and consent in the EEA and the UK where the placement is served to a web user rather than inside an app. You can opt out through Google's Ads Settings, the About Ads opt-out page, Global Privacy Control, and the in-app advertising options. Google's policy applies at https://policies.google.com/privacy.

2.7.3 Meta Audience Network

Meta Audience Network is Meta's advertising network for publishers other than Facebook and Instagram. The SDK requests an advertisement and renders the resulting native, banner, interstitial or rewarded format. It may collect the advertising identifier, the IP address, device and operating system information, the language, the screen resolution, the network operator, coarse location derived from the IP address, precise location where you have granted the permission, the app's install and usage events, and interaction events such as impressions and clicks. On Apple platforms it participates in the App Tracking Transparency prompt and is treated as tracking only if Meta has declared the SDK as such in our app's privacy manifest; where you decline tracking, Meta restricts the data it can receive. The lawful basis is consent in the EEA and the UK, and legitimate interests plus opt-out elsewhere, with the opt-out honoured in California. You can opt out through Meta's Advertising Preferences page at https://www.facebook.com/ads/ and the Audience Network settings in the app, by declining ATT, by deleting or resetting the advertising identifier, or by using the in-app advertising options. Meta's policy applies at https://www.facebook.com/privacy/policy/.

2.7.4 Unity Ads

Unity Ads is the advertising service of Unity Technologies Inc., the same company that maintains the Unity LevelPlay mediation layer. The SDK requests and renders advertisements and may collect the advertising identifier, device model and operating system version, IP address, language, screen resolution, app install and usage events, and ad interaction data. It is used in our applications in connection with LevelPlay mediation. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through Unity's Privacy Controls, by declining ATT, or through the in-app advertising options. Unity's policy applies at https://unity.com/legal/privacy-policy.

2.7.5 AppLovin MAX

AppLovin MAX is AppLovin Corporation's mediation platform, which requests advertisements from multiple demand sources on our behalf and returns a single ad to render. It collects the advertising identifier, device and operating system information, IP address, install and session events, ad interaction events, and diagnostic information including crash and latency data used to keep the mediation path healthy. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through AppLovin's Privacy Controls, by declining ATT, or through the in-app advertising options. AppLovin's policy applies at https://www.applovin.com/privacy-policy/.

2.7.6 ironSource / Unity LevelPlay

ironSource, now part of Unity Technologies Inc., operates LevelPlay as a mediation and advertising platform. The SDK performs the initial request, applies mediation rules, and returns the winning creative; it may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation and session events, and advertisement performance data. Where ironSource also operates demand sources directly, that traffic is attributed to ironSource and is treated as described here. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through Unity's Privacy Controls, by declining ATT, or through the in-app advertising options. Unity's policy applies at https://unity.com/legal/privacy-policy.

2.7.7 Pangle (ByteDance)

Pangle is ByteDance's global advertising platform. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse and, with permission, precise location, app installation and usage events, language, and interaction events. ByteDance operates its own demand sources, and because ByteDance also operates consumer applications, its policy describes the circumstances in which data may be combined with data from those applications; we do not use our apps to build a profile of you for ByteDance's own purposes, and ByteDance's retention and combination rules are set out in its published policy. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through the Pangle privacy centre, by declining ATT, or through the in-app advertising options. Pangle's policy applies at https://www.pangleglobal.com/privacy.

2.7.8 Vungle (Liftoff)

Vungle is operated by Liftoff Monetization, Inc. The SDK requests and renders advertisements across the app-open, interstitial, rewarded video and banner formats and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation and usage events, and ad interaction events. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through Liftoff's privacy settings, by declining ATT, or through the in-app advertising options. Liftoff's policy applies at https://liftoff.io/privacy-policy/.

2.7.9 Chartboost

Chartboost provides advertising and attribution services. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation source and attribution data, app usage events, crash information, and ad interaction events. Attribution data links an app install to the campaign or publisher that referred it. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through the Chartboost Privacy Center, including withdrawing consent already given, by declining ATT, or through the in-app advertising options. Chartboost's policy applies at https://www.chartboost.com/privacy/.

2.7.10 InMobi

InMobi is an independent mobile advertising and monetisation platform. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse and, with permission, precise location, app usage events, and sensor and interaction signals used to build an interest profile. InMobi publishes the categories of interest it derives and the mechanism by which you can withdraw consent for a specific purpose. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through the InMobi Privacy Center, by declining ATT, or through the in-app advertising options. InMobi's policy applies at https://www.inmobi.com/legal/privacy-policy.

2.7.11 Tapjoy

Tapjoy is an advertising and offerwall platform. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation source, attribution and conversion events, and app usage events. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through the Tapjoy Privacy Center, by declining ATT, or through the in-app advertising options. Tapjoy's policy applies at https://www.tapjoy.com/privacy-policy/.

2.7.12 Mintegral

Mintegral is operated by Mobvista Inc. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation and usage events, and ad interaction events. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through the Mintegral privacy centre, by declining ATT, or through the in-app advertising options. Mintegral's policy applies at https://www.mintegral.com/privacy.

2.7.13 Digital Turbine / Fyber

Digital Turbine operates the Fyber advertising platform and also supplies the AdColony SDK. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation source and usage events, and ad interaction events including video completion events for rewarded advertisements. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through Digital Turbine's Privacy Choices, by declining ATT, or through the in-app advertising options. Digital Turbine's policy applies at https://www.digitalturbine.com/privacy-policy/.

2.7.14 Liftoff / Viant

Viant Technology Inc. operates the Liftoff advertising network, which supplies demand to the mediation layer. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation and usage events, frequency-control state and conversion events. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through Viant's privacy preferences, by declining ATT, or through the in-app advertising options. Viant's policy applies at https://viant.com/privacy-policy/.

2.7.15 Moloco

Moloco operates a machine-learning advertising platform that predicts which advertisement is most likely to be useful in a given slot. The SDK submits a request containing the advertising identifier where available, device and operating system information, IP address, coarse location, app installation and usage data, and receives and renders a creative. Moloco publishes information about the model features it uses and the controls available to users. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through Moloco's Privacy Choices and its "Do Not Sell or Share My Personal Information" mechanism, by declining ATT, or through the in-app advertising options. Moloco's policy applies at https://www.moloco.com/privacy-policy.

2.7.16 Yahoo Ads (Verizon Media)

Yahoo Ads is part of the Verizon Media advertising group. It is used primarily for web placements and may also be one of the demand sources inside our mediation layer. It collects the advertising identifier where available, IP address, device and browser information, cookie and local storage data on the web, language, and coarse location, together with the request and click logs of the placement. The lawful basis is consent for web users in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through the Yahoo Privacy Dashboard, the About Ads opt-out page, Global Privacy Control, and the in-app advertising options. Yahoo's policy applies at https://privacy.yahoo.com/.

2.7.17 Smaato

Smaato is an independent mobile advertising exchange. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation and usage events, and ad interaction events. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through the Smaato Privacy Center, by declining ATT, or through the in-app advertising options. Smaato's policy applies at https://www.smaato.com/privacy-policy/.

2.7.18 Start.io

Start.io operates a mobile advertising network and app discovery platform. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app usage data, and ad interaction events. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through the Start.io privacy settings, by declining ATT, or through the in-app advertising options. Start.io's policy applies at https://www.start.io/privacy-policy/.

2.7.19 Appodeal

Appodeal is a mediation platform that selects among multiple advertising demand sources. The SDK performs the initial request and returns a single creative, and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation and usage events, and ad interaction events. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through the Appodeal Privacy Center, by declining ATT, or through the in-app advertising options. Appodeal's policy applies at https://appodeal.com/privacy-policy/.

2.7.20 BidMachine

BidMachine operates a mobile advertising exchange and demand-side platform. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation and usage events, and attribution and conversion events. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through BidMachine's privacy settings, by declining ATT, or through the in-app advertising options. BidMachine's policy applies at https://www.bidmachine.com/privacy-policy.

2.7.21 AdColony

AdColony was acquired by Digital Turbine and now operates as part of the Digital Turbine and Fyber family. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation and usage events, and video ad interaction events including reward completion. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through Digital Turbine's Privacy Choices, by declining ATT, or through the in-app advertising options. AdColony's policy applies at https://www.adcolony.com/privacy/.

2.7.22 HyprMX

HyprMX operates a mobile video advertising network. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation and usage events, and video ad interaction events. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through HyprMX Privacy Choices, by declining ATT, or through the in-app advertising options. HyprMX's policy applies at https://www.hyprmx.com/privacy-policy/.

2.7.23 Ogury

Ogury operates a mobile advertising platform with a focus on consumer consent management and data transparency. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app usage data, and ad interaction events. Ogury publishes a list of the data it collects and the purposes for which it is used. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through the Ogury privacy centre, by declining ATT, or through the in-app advertising options. Ogury's policy applies at https://ogury.com/privacy-policy/.

2.7.24 Amazon Publisher Services

Amazon Publisher Services provides advertising services to app publishers and is one of the demand sources available in our mediation layer. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation and usage events, and signals relating to retail and content interests. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through Amazon's Advertising Preferences, by declining ATT, or through the in-app advertising options. Amazon's policy applies at https://www.amazon.com/privacy.

2.7.25 Yandex Ads

Yandex Ads is operated by Yandex N.V. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation and usage events, and search and content interest signals. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through the Yandex Privacy Center, by declining ATT, or through the in-app advertising options. Yandex's policy applies at https://yandex.com/privacy/.

2.7.26 Kidoodle

Kidoodle operates a mobile advertising exchange. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation and usage events, and ad interaction events. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through the Kidoodle privacy centre, by declining ATT, or through the in-app advertising options. Kidoodle's policy applies at https://www.kidoodle.com/privacy-policy/.

2.7.27 Adivery

Adivery operates a mobile advertising platform with mediation and bidding capabilities. The SDK requests and renders advertisements and may collect the advertising identifier, device and operating system information, IP address, coarse location, app installation and usage events, and ad interaction events. The lawful basis is consent in the EEA and the UK and legitimate interests or opt-out elsewhere. You can opt out through the Adivery privacy settings, by declining ATT, or through the in-app advertising options. Adivery's policy applies at https://www.adivery.com/privacy-policy/.

2.7.28 Summary of partner opt-out routes

---

2.8 Ad Formats

Our free-tier applications use four advertising formats. Each one has its own trigger, its own data consumption and its own set of choices available to you. We describe them separately because a format you can dismiss is not the same as a format you can choose to watch, and because you should be able to predict when an advertisement is going to appear.

2.8.1 App-Open (Splash) Ads

When it is shown. An app-open advertisement is presented when you launch the app, or when you bring it back to the foreground after a period of inactivity, typically after a short delay of a few seconds so that the app's own screen is already visible. It appears once per session and at most a limited number of times per day, subject to frequency capping. In our applications it is the first advertisement you are likely to encounter.

What it consumes. The advertisement request includes your advertising identifier where one is available and permitted, device model and operating system version, IP address, coarse location, language, and the identifier of the app and the placement being filled. No content you have entered into the app is transmitted with the request, and no file you have uploaded is accessible to the advertiser. The ad is downloaded and cached locally so that it can be displayed without a further network round trip.

Your choices. You can dismiss the app-open advertisement and continue into the app immediately. You can turn off app-open advertisements entirely in Settings, then Privacy, then Advertising Options. If you have declined consent, declined the App Tracking Transparency prompt, enabled Global Privacy Control, or reset your advertising identifier, app-open advertisements are limited to contextual placements and the identifier is not transmitted.

2.8.2 Rewarded Video Ads

When it is shown. A rewarded video advertisement is presented only when you actively request one, typically by tapping a button labelled with what you will receive in exchange for watching it. It never appears on its own. It plays for a set duration before it can be closed, and the reward is granted only after the full duration completes.

What it consumes. The request includes the advertising identifier where available and permitted, device and operating system information, IP address, coarse location, language, and the placement identifier. The advertiser receives the fact that the video was requested and completed, which we use to award the in-app benefit. The advertiser does not receive a record of the work you performed before or after the video.

Your choices. Rewarded video is entirely optional and you are always in control of whether to watch. If you do not opt in, the in-app benefit remains locked, but no other part of the app is degraded. You can disable rewarded video entirely through the advertising options in Settings, and disabling it removes the button that triggers it.

2.8.3 Interstitial Ads

When it is shown. An interstitial advertisement appears at a natural transition in the app rather than over live content — typically after you complete a task such as saving a record, closing a screen, or finishing a workflow. It does not interrupt an action in progress, and it is frequency capped so that it does not repeat on every single transition.

What it consumes. The request includes the advertising identifier where available and permitted, device and operating system information, IP address, coarse location, language, and the placement identifier. No personal content entered into the app is shared with the advertiser, and we do not include your business data in the advertising request.

Your choices. An interstitial can be closed using the close control, and the app continues immediately afterwards. You can disable interstitials through the advertising options in Settings. Where you have not consented to advertising, or have opted out, interstitials are limited to contextual placements and no identifier is transmitted.

2.8.4 Banner Ads

When it is shown. A banner advertisement is a small strip displayed at the top or bottom of a screen within the app, present while that screen is open. It is the least intrusive format because it does not interrupt anything, but it is the only one that occupies space continuously rather than appearing at a moment.

What it consumes. The request includes the advertising identifier where available and permitted, device and operating system information, IP address, coarse location, language, and the placement identifier. Banner requests are refreshed periodically while the screen is open, and each refresh is a new request carrying the same categories of device data. Banner impressions are counted so that we can attribute revenue to a placement.

Your choices. You can close or minimise a banner where the format allows it. You can disable banners through the advertising options in Settings, and doing so reclaims the screen area. Where you have not consented, banners are limited to contextual placements and no identifier is transmitted.

2.8.5 Frequency control and summary of your controls

Advertising frequency is capped in every format so that advertising remains a background element rather than the product. If you feel you are seeing too much advertising, the fastest route is Settings, then Privacy, then Advertising Options, where each format can be disabled individually. Disabling a format removes it entirely; it does not downgrade the app or charge you for it. The same screen lets you withdraw consent where consent is the basis on which advertising operates.

2.9 How We Share Your Information

We do not sell personal data. We disclose personal data only in the following circumstances, and in each case we disclose the minimum necessary to the recipient.

Service providers and processors. We engage processors who host our infrastructure, deliver our email, process our payments, provide customer support tooling and operate our business systems. These processors act on our instructions under written terms that restrict them from using the data for their own purposes. A change of processor may result in a change of the country in which data is stored, which is addressed in section 2.10.

Advertising partners. We disclose advertising identifier, device information and ad interaction data to the partners listed in section 2.7, on the lawful bases described there and subject to the consent or opt-out position that applies in your jurisdiction. We do not disclose the content of your business records to advertising partners.

Professional advisers and auditors. We disclose personal data to our legal, accounting and audit advisers where necessary to obtain advice or to meet a statutory audit requirement.

Corporate and business transfers. We may disclose personal data in connection with a merger, acquisition, reorganisation or sale of assets, in which case the acquirer will be bound by this Privacy Policy or will be given notice and an opportunity to object before the data continues to be processed on the same basis.

Legal and regulatory disclosure. We disclose personal data where we are required to do so by a competent authority, a court, or applicable law, or where disclosure is necessary to establish, exercise or defend legal claims. Where we are permitted to do so, we notify the affected person before disclosure.

With your direction. We disclose personal data to the counterparties, agents, carriers, inspectors, brokers and event partners that you instruct us to work with, to the extent needed to perform the instruction.

We do not disclose personal data for the purpose of direct marketing by third parties, and we do not provide lists of our clients, users or contacts to anyone.

2.10 International Data Transfers and Standard Contractual Clauses

We are established in Hong Kong and work with clients, suppliers, counterparties and service providers located in other countries, including the European Economic Area, the United Kingdom, the United States, mainland China, Brazil, Canada, Australia and Singapore. As a result, some personal data is transferred outside the jurisdiction in which it was collected.

Where personal data originating in the European Economic Area or the United Kingdom is transferred to a country that does not have an adequacy decision from the European Commission, we rely on the European Commission's Standard Contractual Clauses, adopted by Implementing Decision (EU) 2021/914, together with a transfer risk assessment and supplementary measures where they are necessary, such as encryption in transit and at rest, access controls on the recipient, and a policy of keeping the volume of transferred data to the minimum required for the service. Where we rely on the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses, we apply equivalent protections and a transfer risk assessment.

We do not transfer personal data to a destination for the purpose of circumventing the data protection law that applies to it. Recipients outside the EEA and the UK are required to apply confidentiality obligations, to process the data only on our instructions, and to implement appropriate technical and organisational security measures. Where a transfer cannot be safeguarded, we do not make it. A copy of the safeguards we apply can be requested from us using the contact details in section 2.21.

2.11 Data Retention

We keep personal data for as long as we need it for the purposes described in section 2.5, and for no longer than that.

Where data is held for a period longer than necessary to achieve the purpose for which it was collected, we either anonymise it or delete it. Where deletion is not technically possible, the data is placed beyond use. If you ask us to delete your data and we are required by law to retain part of it — for example, transaction records subject to a statutory retention period — we will tell you what we are keeping, why, and for how long.

2.12 Your Rights and Choices

Depending on where you live, you may have the following rights over your personal data.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to request access to your personal data, to have inaccurate data corrected, to have data erased, to have data restricted or objected to, to data portability, and to withdraw consent at any time. You also have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significant effects about you, and the right to complain to your supervisory authority.

If you are in California, you have the right to know what personal information is collected, used, disclosed or sold, the right to delete it, the right to correct it, the right to opt out of its sale or sharing, the right to limit its use for sensitive personal information, and the right to be free of discrimination for exercising any of these rights.

If you are in Brazil, Canada, Australia, Singapore, Hong Kong or mainland China, you have rights of access, correction, deletion and objection, and the right to complain to the relevant authority. Section 2.19 describes the position in each of these jurisdictions.

How to exercise a right. Write to support@hkrongxinda.com with the subject line "Data rights request" and tell us which right you wish to exercise and how we can identify you. We may ask for information that lets us verify your identity before we act, which we will only use for that purpose. We respond within one month of receiving a verified request, and we do not charge for it. If you are unhappy with our response you may ask us to review it, and you may complain to the relevant supervisory authority.

Consent withdrawal and objection. You can withdraw consent at any time, and you can object to processing based on legitimate interests at any time. Where consent is the basis, withdrawal stops that processing from that point forward. Where legitimate interests is the basis, we will stop unless we can show compelling legitimate grounds that override your interests, and you may then exercise your right to object.

Marketing communication. Every marketing message we send includes a way to unsubscribe. We never sell contact data and we never pass it to advertising partners for marketing purposes.

2.13 "Do Not Sell or Share" My Personal Information

We do not sell personal information as that term is defined by the California Consumer Privacy Act as amended by the California Privacy Rights Act, and we do not share personal information for cross-context behavioural advertising as that term is defined by that law. We treat every advertising partner described in section 2.7 as operating under this restriction.

If you nevertheless want to opt out of any sharing for cross-context behavioural advertising that you believe is occurring, you can do so using any of the following, and we will honour it across all of our applications: enable Global Privacy Control in your browser, which we treat as a valid opt-out request without any further action from you; turn off "Limit Ad Tracking" in Settings, then Privacy, then Advertising Options, inside any of our applications; decline the App Tracking Transparency prompt on Apple platforms; delete or reset the advertising identifier on your device; or write to support@hkrongxinda.com and ask us to record an opt-out against your device. We do not sell or share the personal information of anyone under 16.

2.14 Children's Privacy

Our apps and this website are business tools intended for adults. We do not knowingly collect personal information from children, and we do not knowingly permit children to create accounts or to use our advertising-supported free tier. We do not serve interest-based advertising in any app that is directed at children, and we configure our advertising accounts for child-directed treatment where it is required.

United States — COPPA. The Children's Online Privacy Protection Act and its implementing rule restrict the collection of personal information from children under 13. Because our services are directed at business decision-makers and are not directed at children, we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, write to support@hkrongxinda.com and we will investigate and delete it.

European Union — GDPR-K. Under Article 8 of the GDPR, the age of digital consent for information society services offered directly to a child is 16, but Member States may lower it to not less than 13. We do not offer services directly to children, and we do not knowingly collect personal information from a child below the applicable national threshold. Our apps are not directed at children and are not intended for child-directed use.

United Kingdom — Age-Appropriate Design Code. We do not provide a "relevant service" within the meaning of the Children's Code, and our applications are not likely to be accessed by children. Should that change, we will complete the risk assessment the Code requires before making the service available, and we will explain in this policy what assessment we have made.

Brazil — LGPD. Under the Brazilian General Data Protection Law, the legal bases set out in Article 14 apply to the processing of children's data, and best interests are the prevailing principle. We do not process children's data, and if we are ever notified that data we hold relates to a child under 18, we will apply the heightened protections the law requires, including obtaining the authorisation of a parent or legal guardian where required.

General commitment. Where we discover that we have collected personal information from a child in breach of this section, we will delete it as soon as we are able to identify it, and we will report the breach to the relevant authority where the law requires us to.

2.15 Age Ratings and Store-Side Age Gates

Each application we publish carries an age rating determined by the store, based on the content and functionality of the application and on the content of the advertising SDKs it integrates. Because our applications are business tools that include advertising-supported free tiers, their ratings reflect the presence of advertising and, where the app includes user-generated text entry, the rating reflects that content is not moderated in real time.

We do not implement a formal age-verification gate in our free-tier applications, because our applications are not directed at children and are intended for professional use. Store-level age ratings and any store-level age assurance mechanism operated by Apple or Google apply in addition to anything described here. We do not use age-related signals to target advertising, and we do not build profiles of users based on age.

2.16 Account Registration and Data Deletion

Some functionality in our applications requires an account. Registration requires an email address, and in some cases a company name and a role. You are responsible for the accuracy of the information you provide and for keeping your credentials confidential. You are responsible for all activity that occurs under your account, including activity by any device on which you have signed in.

You can request deletion of your account and of the personal data associated with it at any time, without giving a reason, by writing to support@hkrongxinda.com from the registered address or from inside the app. We will verify that the request comes from the account holder, we will confirm receipt, and we will complete the deletion within 30 days. Deleting the account removes your profile, your session data, and the content you have entered, except for data we are legally required to retain — for example, records forming part of an active engagement, transaction records subject to a statutory retention period, and correspondence with you, which we keep for the periods described in section 2.11. When we delete something, we also instruct our processors to delete it and instruct our advertising partners to stop using identifiers associated with your account.

You may also delete your account directly from within the application, where that option is present. Where you have a right to erasure that arises from a statutory ground other than consent — for example, a request under Article 17 GDPR — the same process applies, and where we decline for a lawful reason we will tell you which reason and how to complain.

2.17 Security

We apply technical and organisational measures appropriate to the risk, including encryption of personal data in transit using TLS and encryption at rest for the systems that hold it, role-based access control with least-privilege permissions, multi-factor authentication for administrative access, environment separation between development and production, centralised logging with alerting on anomalous access, and documented review of access rights. Access to client records is restricted to personnel who need it for the engagement and is recorded.

We keep our applications and systems updated, we run vulnerability scanning, we log and investigate suspected security incidents, and we maintain a documented incident response procedure. Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and we will notify affected individuals where the breach is likely to result in a high risk to them. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we will not knowingly accept a level of risk that we cannot justify.

2.18 App Store and Platform Policy Compliance

2.18.1 Apple App Store Review Guidelines

Privacy — Guideline 5.1.1 and 5.1.2. We do not collect data from our applications in a way that is not disclosed in this policy, and the privacy nutrition label we submit to Apple accurately describes the data categories collected, the purposes, and the tracking practices of the advertising SDKs described in section 2.7. We update the App Store privacy labels whenever a data category, purpose, or SDK changes, and before the corresponding build is released. We do not use data collected from an application for purposes unrelated to the application without a separate consent that is presented to the user.

"Data Used to Track You" — Guideline 5.1.2 (iii). Any SDK that reads the Identifier for Advertisers, or that combines data from our applications with data received from other companies to serve advertising, is declared in our App Store privacy label under the heading "Data Used to Track You". We describe which purposes qualify as tracking in that label, we list the tracking domains involved, and we provide the privacy policy URL that Apple displays on the product page — which is this document at https://hkrongxinda.com/privacy-policy.html. A tracking domain we add is also added to our App Privacy Details, and we do not add a tracking domain that we have not disclosed in this policy.

Children — Guideline 1.3 and the Kids Category. Our applications are not directed at children and are not submitted to the Kids Category. We do not collect personal information from children under 13, and we do not enable child-directed advertising treatment in any application that is directed at children. Where a child-directed treatment flag is applied in any configuration of our applications, the advertising we serve is child-directed and we do not permit interest-based advertising.

Account deletion — Guideline 5.1.1(v). If an application supports account creation, it supports in-app account deletion. Users can delete their account and their associated data directly within the application without needing to contact us, and the deletion request mechanism described in section 2.16 is also available. Deletion is completed within 30 days, and we explain in the app what happens to the small amount of data we are required to retain for legal reasons.

Consent for tracking and ATT. Where an application uses a tracking SDK, the App Tracking Transparency prompt is presented before any data is collected for tracking, and the prompt is not conditioned on access to the app's core functionality. The ad unit described in section 2.8 is never loaded before consent has been recorded where consent is required.

2.18.2 Google Play Developer Program Policy

Data Safety section. Our Play Console Data Safety form is completed for every application and accurately reflects the data described in this policy, including advertising identifiers, device or other IDs, app activity, app info and performance, and approximate location. Where the form indicates that data is shared with third parties, the categories listed correspond to the advertising and service providers described in section 2.7 and section 2.9, and the purposes and lawful bases we have stated match the purposes given in the form.

Families Policy. Our applications are not directed at children and are not in the "Made for Families" category. We do not serve ads that are inappropriate for children, we do not use child-directed identifiers, and we configure our advertising accounts to treat traffic from child-directed apps appropriately. If any application is later designated for children, we will complete the Families Policy requirements, including using the self-certified SDKs list where required, before publishing.

Ads Policy. Our advertising is delivered through the mediation layer and demand sources described in section 2.7, and we do not use self-promotional advertising, no-content advertising, or advertising that interferes with the device or the app. We do not implement an interstitial that appears on app launch, at the moment of input, or in a way that would cause an accidental click, and the rewarded format described in section 2.8.2 is only used for an opt-in, user-initiated action with a clear reward. We do not use a device with modified software or an automated means to generate impressions, and we do not buy or sell incentivised or forced-click traffic.

Ads ID and permission — Permissions policy. The advertising ID permission is declared and its use is limited to advertising and analytics functions, which is what we use it for. We do not use the advertising ID for fraud prevention of a kind that requires device fingerprinting, and we do not build persistent device identifiers of our own.

Privacy policy requirement. Every application we publish links to this policy from its Play Console listing and from within the application, and the link points to the live document at https://hkrongxinda.com/privacy-policy.html rather than to a landing page or a PDF. The policy URL is checked as part of the release checklist for each version, and we verify that it resolves and displays the current version.

2.18.3 Privacy policy URL and in-app disclosures

The privacy policy URL we submit to both stores is https://hkrongxinda.com/privacy-policy.html. In each application, a link to this policy is available from the settings or about screen, and the first-run consent screen explains in plain language what data is collected and what choice you are making. The in-app disclosure and this document are maintained as the same text, so that the app and the policy never disagree.

2.18.4 app-ads.txt

We publish an app-ads.txt file at the root of hkrongxinda.com. It is the standard file used by advertising platforms to verify that an app publisher has authorised a specific seller to offer ads on its behalf. We maintain the file as an accurate reflection of the sellers we have authorised to operate in our applications, and we remove any seller line when that authorisation ends. The presence of the file does not change what we disclose in this policy: the partners described in section 2.7 are the partners that operate in our applications.

2.19 Regional Disclosures

This section sets out the position for the specific jurisdictions in which our clients and users are located. Where a provision here provides more specific information than the general sections above, it applies.

2.19.1 European Union — GDPR, and the United Kingdom — UK GDPR

We process personal data under the GDPR and the UK GDPR on the lawful bases set out in section 2.5, and the data subject rights set out in section 2.12 apply in full. We do not carry out profiling that produces legal effects or similarly significant effects, and we do not use your data for automated decision-making. You have the right to lodge a complaint with your local supervisory authority — in the United Kingdom, the Information Commissioner's Office — and we would rather you came to us first, because we can usually resolve the concern faster.

Where we transfer personal data outside the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses or the UK International Data Transfer Agreement, as described in section 2.10. Our records of processing activities, our retention schedule and our records of data subject requests are available on request.

2.19.2 United Kingdom — Age-Appropriate Design Code

The Children's Code applies to online services likely to be accessed by children in the United Kingdom. Our applications and this website are business services aimed at professional adults, and we do not believe they are accessed by children; our services are not "relevant services" within the meaning of the Code. We have nevertheless adopted the Code's risk-assessment discipline for our consent and advertising flows, so that a user of any age is not confronted with a dark pattern, is not misled about what a button does, and is not defaulted into sharing personal data. If our assessment changes, we will publish the assessment and the resulting changes in this section.

2.19.3 California — CCPA and CPRA

We do not sell personal information and we do not share personal information for cross-context behavioural advertising, as described in section 2.13. The categories of personal information we collect are those described in section 2.4; the sources are the person themselves and, in limited cases, the third parties described in section 2.4.5; the purposes are those described in section 2.5; and the categories of recipients are those described in section 2.9. We retain personal information for the periods described in section 2.11. We honour the right to know, the right to delete, the right to correct, the right to opt out of sale or sharing, the right to limit the use of sensitive personal information, and the right to be free of discrimination for exercising these rights. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you. Requests can be made to support@hkrongxinda.com and are answered within 45 days, extendable by 45 days where we notify you.

2.19.4 Brazil — Lei Geral de Proteção de Dados (LGPD)

Under the LGPD, we process personal data on the bases set out in section 2.5, which map onto the LGPD's lawful bases of consent, legitimate interest, contract, legal obligation and protection of the credit collection or fraud prevention. The data subject rights of access, correction, anonymisation, blocking, deletion, portability, information about sharing, information about the possibility of refusing consent and about the consequences of refusal, and revocation of consent are available. Where consent is the basis, its refusal does not result in the loss of functionality of our services beyond the loss of the personalised feature that consent enabled. We do not transfer personal data out of Brazil without a mechanism recognised by the LGPD, such as an adequacy decision or standard contractual clauses. Requests are handled by our privacy team and may be submitted in Portuguese.

2.19.5 Canada — PIPEDA

Under PIPEDA, we obtain meaningful consent for the collection, use and disclosure of personal information, and we identify ourselves and the purpose for which the information is used at or before the time of collection. We apply the principle of limiting collection to what is necessary, the principles of safeguarding accuracy, protecting against inappropriate access, and limiting use and disclosure. We do not sell personal information, we do not use it for any purpose that is incompatible with the purpose identified, and we make reasonable efforts to confirm the accuracy of information used to make a decision about you. Our accountability and audit obligations are met through the retention schedule, the access controls and the audit trail described in section 2.17.

2.19.6 Australia — Privacy Act 1988 and the Children's Online Privacy Code

We comply with the Australian Privacy Principles. We collect personal information only for the purposes described in section 2.5, we do not collect more than is necessary, we do not collect sensitive information unless it is reasonably necessary, and we use and disclose personal information only for the purpose for which it was collected or where the individual has consented. Our contractual relationships with processors include the restrictions described in section 2.9. The Australian Privacy Principles require us to be able to demonstrate compliance; the records described in sections 2.11 and 2.17 are what we rely on for that purpose. We do not offer a service that is reasonably likely to be used by children, so the Children's Online Privacy Code does not currently apply to us; if that changes we will complete the age-assurance assessment the Code requires before we proceed.

2.19.7 Singapore — Personal Data Protection Act

Under the PDPA, we have a data protection obligation to protect personal data with reasonable security arrangements, and we apply the Purpose Limitation Obligation so that personal data is collected, used and disclosed only for purposes reasonably related to the purpose stated at collection. We apply the Consent Obligation where consent is required, and we provide individuals with the ability to withdraw consent as described in section 2.12. Personal data is not transferred outside Singapore except where the transfer is necessary for a purpose reasonably related to the stated purpose and the recipient is bound by comparable protection. Where an individual has concerns, they may contact the Personal Data Protection Commission.

2.19.8 Hong Kong — Personal Data (Privacy) Ordinance

We comply with the Personal Data (Privacy) Ordinance, including the data protection principles: personal data is collected for a legitimate purpose, in a manner that is not excessive, and with all practicable security; the purpose is notified to the individual at or before collection; personal data is used only for the purpose for which it was collected or a directly related purpose; personal data is kept no longer than is necessary; and access to and correction of personal data is available on request. Individuals may make a data access request and a data correction request, which we handle within 40 days of receiving a properly made request. Requests are directed to support@hkrongxinda.com. We do not transfer personal data to a third party for a new purpose without consent or a permitted exception.

2.19.9 Mainland China — Personal Information Protection Law

Where we handle personal information of individuals in mainland China, we do so in accordance with the Personal Information Protection Law and related standards. We rely on consent as the primary lawful basis, with separate consent where the law requires it, such as for the processing of sensitive personal information and for the transfer of personal information outside mainland China. We conduct a personal information protection impact assessment before processing sensitive personal information, before entrusting a third party to process personal information, and before transferring personal information abroad, and we retain the assessment. We provide the mechanisms for individuals to exercise their rights of knowing, deciding, restricting, refusing, and requesting deletion, and we respond to requests in a timely manner. Where a separate consent requirement applies, the consent request states clearly the purpose, method, the categories of personal information processed and the recipients.

2.20 Changes to This Privacy Policy

We review this Privacy Policy when our services, our applications, our advertising partners or the law change. The current version is 1.0, dated 4 November 2026. We will publish a new version with an updated "Last updated" date and an increased version number whenever we make a material change, and we will describe what has changed in the section below. Where a change is required by law or by a store policy, we will implement it by the date it takes effect. We do not apply a material change retrospectively. If you disagree with a material change, you may close your account and request deletion of your data under section 2.16, and we will stop the processing that the change concerns.

Change history.

2.21 Contact Us and Our Privacy Team

Questions about this Privacy Policy, requests to exercise a data subject right, and complaints about how we handle personal data should all be directed to our privacy team.

• Business support and privacy enquiries: support@hkrongxinda.com
• Key accounts and active engagements: pengjinlong@hkrongxinda.com
• Post: HK FURENTA CO., LIMITED, Room 701 (Unit 127), 7/F, Tower B, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui East, Hong Kong

Our privacy team is the designated point of contact for data protection enquiries. Where you write to us in the EEA or the United Kingdom, we will deal with your request in line with the GDPR or the UK GDPR, including confirming receipt within five working days and responding within the statutory period. We do not currently maintain a separately appointed statutory Data Protection Officer under Article 37 GDPR; the role is discharged by our privacy team, and if that changes we will update this section, our App Store privacy label and our Play Console Data Safety form at the same time.

We do not charge for handling a request, and we do not ask for information we do not need in order to act on it. Please do not send us identity documents, payment card details, or trade secrets when contacting us about your rights.

---

Questions about this document? Write to support@hkrongxinda.com. Clients with an active engagement, or counterparties dealing with a specific commercial arrangement, can write to pengjinlong@hkrongxinda.com, which reaches the engagement owners directly.

Back to top