Privacy policy

Last updated: 1 January 2026

1. Introduction

We are committed to protecting your privacy and ensuring the security of your personal data. This privacy policy explains how we collect, use, disclose, and protect your personal data when you visit our Website, purchase our products, or use our services. By using our Website or services, you consent to the collection, use, and disclosure of your personal data as described in this privacy policy. If you do not agree to this privacy policy, do not use our Website or services.

2. Data controller

Under applicable privacy laws, including the General Data Protection Regulation (GDPR) where applicable, FLINTWRK is the data controller.  Email: privacy@flintwrk.com

3. Information we collect

3.1 Information you provide to us

We collect personal data that you voluntarily provide to us when you:

Create an account

  • Name
  • Email address
  • Password (encrypted)
  • Date of birth (if required for age verification)
  • Account settings

Place an order

  • Billing name and address
  • Shipping name and address
  • Email address
  • Phone number
  • Payment details (processed by third-party payment providers)
  • Order details and purchase history

Contact us

  • Name
  • Email address
  • Phone number
  • The content of your message
  • Any other information you choose to provide

Subscribe to marketing communications

  • Email address
  • Name (optional)
  • Communication preferences

Submit reviews or user content

  • Name or username
  • Email address
  • Review text and ratings
  • Photos or videos (if uploaded)

3.2 Information collected automatically

When you visit our Website, we automatically collect certain information about your device and browsing activity:

Device and browser information

  • IP address
  • Browser type and version
  • Operating system
  • Device type (desktop, mobile, tablet)
  • Screen resolution
  • Language preferences

Usage information

  • Pages visited and content viewed
  • Date and time of visits
  • Referring website or source
  • Links clicked
  • Products viewed and added to cart
  • Searches
  • Session duration and navigation paths

Location information

  • Approximate geographic location based on IP address
  • Precise location (only if you grant permission)

3.3 Information from third parties

We may receive information about you from third-party sources, including:

  • Payment providers: Transaction information from Stripe, Airwallex, PayPal, and other payment service providers
  • Carriers: Delivery status and tracking information
  • Analytics providers: Aggregated usage data and demographic data
  • Social media platforms: If you interact with us on social media or use social login features
  • Fraud prevention services: Information to verify identity and prevent fraud
  • Marketing partners: Information about your interaction with our marketing campaigns

3.4 Cookies and tracking technology

We use cookies, web beacons, pixels, and similar tracking technology to collect information about your browsing activity. For detailed information about the cookies we use and how to manage your preferences, see our cookie policy.

4. How we use your information

We use your personal data for the following purposes:

4.1 To provide our services

  • Process and fulfil your orders
  • Manage your account and settings
  • Communicate with you about your orders and account
  • Provide customer support and respond to enquiries
  • Process payments and prevent fraud
  • Arrange shipping and delivery
  • Handle returns and refunds

4.2 To improve our services

  • Analyse usage patterns and trends
  • Conduct research and development
  • Test new features and functionality
  • Optimise Website performance and user experience
  • Troubleshoot technical issues

4.3 To communicate with you

  • Send order confirmations and delivery updates
  • Respond to your questions and requests
  • Send service announcements and updates
  • Send marketing communications (with your consent)
  • Conduct surveys and request feedback

4.4 For marketing and advertising

  • Send promotional emails and newsletters (with your consent)
  • Display personalised advertisements
  • Run marketing campaigns and promotional offers
  • Analyse marketing effectiveness
  • Retarget visitors with relevant advertisements

4.5 For security and fraud prevention

  • Verify your identity
  • Detect and prevent fraud, abuse, and unlawful activity
  • Protect the security of our systems and information
  • Enforce our terms and conditions
  • Comply with legal obligations

4.6 To comply with the law

  • Comply with applicable laws and regulations
  • Respond to legal requests and court orders
  • Protect our legal rights and interests
  • Resolve disputes

5. Legal basis for processing (GDPR)

If you are located in the European Union, the United Kingdom, or another jurisdiction with similar privacy laws, we process your personal data on the following legal bases:

5.1 Necessary to perform a contract

Processing is necessary to perform our contract with you (for example, to process your orders, provide customer support, and deliver products).

5.2 Legitimate interests

Processing is necessary for our legitimate business interests, such as:

  • Improve our products and services
  • Analyse usage and trends
  • Prevent fraud and maintain security
  • Conduct marketing and advertising (where not based on consent)
  • Manage our business

We balance our legitimate interests against your rights and freedoms and will not process your information where your interests override ours.

5.3 Consent

Processing is based on your express consent, for example for:

  • Marketing communications
  • Non-essential cookies
  • Sharing information with third parties for marketing purposes

You may withdraw your consent at any time by contacting us or using the unsubscribe function in our communications.

5.4 Legal obligation

Processing is necessary to comply with legal obligations, such as tax and accounting requirements, responding to legal requests, and regulatory compliance requirements.

6. How we share your information

We may share your personal data with the following categories of recipients:

6.1 Service providers

We share information with third-party providers who perform services on our behalf, including:

  • Payment providers: Stripe, Airwallex, PayPal, and other payment service providers to process payments
  • Carriers: DHL, FedEx, UPS, and other carriers to fulfil and deliver orders
  • Cloud hosting providers: To operate our Website and store information
  • Email service providers: To send transactional and marketing emails
  • Analytics providers: Google Analytics and similar services to analyse Website usage
  • Customer support tools: To provide customer service
  • Marketing platforms: To run marketing campaigns and advertising
  • Fraud prevention services: To verify identity and prevent fraud

These service providers are contractually required to protect your information and use it only for the purposes for which it was disclosed.

6.2 Business transfers

If we are involved in a merger, acquisition, sale of assets, bankruptcy, or other business transaction, your personal data may be transferred to the acquiring entity or successor. We will notify you of any such transfer and any choices you may have regarding your information.

6.3 Legal requirements and protection

We may disclose your information if required by law or in response to:

  • Legal process (subpoenas, court orders, litigation)
  • Requests from government or law enforcement authorities
  • Protection of our legal rights and interests
  • Investigation of fraud, security issues, or unlawful activity
  • Protection of the safety and security of individuals

6.4 With your consent

We may share your information with third parties when you have expressly consented to such sharing.

6.5 Aggregated and anonymised information

We may share aggregated, anonymised, or de-identified information that cannot reasonably be used to identify you with third parties for analytics, research, and marketing purposes.

7. International data transfers

We are based in Hong Kong and operate internationally. Your personal data may be transferred to, stored in, and processed in countries other than your country of residence, including Hong Kong, the United States, the European Union, and other jurisdictions where our service providers operate. These countries may have data protection laws that differ from those in your country. When we transfer your personal data to other countries, we take appropriate measures to ensure that your information is protected in accordance with this privacy policy and applicable data protection laws.

7.1 EU data transfers

If you are located in the European Union or the United Kingdom, we ensure that transfers of your personal data to countries outside the EU/UK are protected by appropriate safeguards, such as:

  • Standard contractual clauses approved by the European Commission
  • Adequacy decisions by the European Commission
  • Other legally recognised transfer mechanisms

You may request a copy of the safeguards we use for international transfers by contacting us at privacy@flintwrk.com.

8. Retention period

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including:

  • Account information: As long as your account exists, plus a reasonable period thereafter, or as required by law
  • Order and transaction data: At least 7 years for tax and accounting purposes, or as required by law
  • Marketing communications: Until you unsubscribe or withdraw consent
  • Customer support records: 3–5 years, or as required by law
  • Website usage data: Usually 12–24 months, unless longer retention is required

When we no longer need your personal data, we securely delete or anonymise it in accordance with our data retention policy and applicable laws. We may retain certain information for longer periods where required by law, to resolve disputes, enforce our agreements, or for legitimate business purposes.

9. Your rights and choices

9.1 Access and portability

You have the right to request access to the personal data we hold about you and to receive a copy of your information in a structured, commonly used, and machine-readable format (data portability).

9.2 Correction and update

You have the right to request that we correct or update inaccurate or incomplete personal data. You can update your account information by logging into your account or contacting us.

9.3 Deletion

You have the right to request that we delete your personal data under certain circumstances, such as:

  • The information is no longer necessary for the purposes for which it was collected
  • You withdraw your consent (where processing is based on consent)
  • You object to processing based on legitimate interests
  • The information has been unlawfully processed
  • Deletion is required by law

Please note that we may not be able to delete your information if we are legally required to retain it or need to keep it for legitimate business purposes (for example, to complete transactions, comply with legal obligations, or resolve disputes).

9.4 Restriction of processing

You have the right to request that we restrict the processing of your personal data under certain circumstances, such as when you contest the accuracy of the information or object to the processing.

9.5 Objection to processing

You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes. If you object to direct marketing, we will stop processing your information for that purpose.

9.6 Withdraw consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

9.7 Marketing communications

You can opt out of marketing communications by:

  • Clicking the “unsubscribe” link in our emails
  • Updating your communication preferences in your account settings
  • Contacting us at privacy@flintwrk.com

Please note that you cannot opt out of transactional or service-related communications (such as order confirmations and delivery updates).

9.8 Cookies and tracking

You can manage your cookie preferences through your browser settings or our cookie consent tool. For more information, see our cookie policy.

9.9 How to exercise your rights

To exercise any of your rights, contact us at privacy@flintwrk.com. We will respond within the timeframe required by applicable law and may request information to verify your identity before processing your request.

9.10 Right to complain

If you are located in the European Union, the United Kingdom, or another jurisdiction with data protection authorities, you have the right to complain to your local supervisory authority if you believe we have infringed your privacy rights. Residents of the EU/UK may contact their local data protection authority. A list of EU data protection authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en

10. Security of your information

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, disclosure, alteration, and destruction. These measures include:

  • Encryption of data in transit (SSL/TLS)
  • Encryption of sensitive data at rest
  • Secure authentication and access control
  • Regular security assessments and audits
  • Employee privacy and security training
  • Incident response and breach notification procedures
  • Compliance with the Payment Card Industry Data Security Standard (PCI DSS)

Although we take reasonable measures to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee that your information is absolutely secure. You are responsible for keeping your account login details confidential and for all activity that occurs under your account. Notify us immediately if you suspect unauthorised access to your account.

11. Children's privacy

Our Website and services are not intended for individuals under 18 years of age (or the age of majority in their jurisdiction). We do not knowingly collect personal data from children. If you are under 18, do not use our Website or provide us with personal data. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information. If you believe we have collected information from a child, contact us at privacy@flintwrk.com.

12. Third-party websites and services

Our Website may contain links to third-party websites, services, or applications that we do not own or control. This privacy policy does not apply to third-party websites or services. We are not responsible for the privacy practices of third parties. We encourage you to read the privacy policies of any third-party websites or services you visit or use.

13. California privacy rights (CCPA)

If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA):

13.1 Right to know

You have the right to request information about the categories and specific pieces of personal data we have collected about you, the sources of that information, the purposes for which it is used, and the categories of third parties with whom we share it.

13.2 Right to delete

You have the right to request that we delete your personal data, subject to certain exceptions.

13.3 Right to opt out of sale

We do not sell your personal data as defined by the CCPA. If our practices change, we will update this privacy policy and give you the right to opt out of sale.

13.4 Right to non-discrimination

You have the right not to receive discriminatory treatment for exercising your rights under the CCPA.

13.5 How to exercise your rights

To exercise your rights under the CCPA, contact us at privacy@flintwrk.com. We will verify your identity before processing your request.

14. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the “Last updated” date at the top of this privacy policy. If we make material changes to this privacy policy, we will notify you by:

  • Posting a notice on our Website
  • Sending an email to the address associated with your account
  • Using other appropriate methods

Your continued use of our Website or services after the effective date of the updated privacy policy constitutes your acceptance of the changes. We encourage you to review this privacy policy regularly to stay informed about how we protect your information.