What we keep, and for how long.

What we collect

When you write to the desk we hold the name and email address on the message, any phone or WhatsApp number you use, the company or shop name you trade under, the delivery address, the pieces, shades and quantities you ask about, and the text of the correspondence itself. If a monogram is ordered we also hold the letters, the thread shade, the placement and the approval image we send you before stitching.

The site itself keeps ordinary server logs: IP address, browser and operating system, the page requested, the time, and a referrer if one was sent. These are security and capacity records. They are not matched against your enquiry and are not used to build a profile of you.

Cookies and the shortlist

The site sets a session cookie so that a shortlist of pieces survives a page change, and a short-lived cookie that remembers a dismissed notice. Those are functional, not marketing. We do not run advertising cookies, social pixels, cross-site trackers or a third-party analytics script, and we do not sell attention to anyone.

If you send the shortlist to us it becomes part of the enquiry, and the rules below apply to it. You can clear the cookies in your browser at any time and the shortlist disappears with them.

Why we hold it

We use enquiry data to reply, to quote, to check stock and the mill date, to arrange a sample, and to prepare a monogram proof. We use order data to cut, hem, embroider, pack and ship, to prepare the commercial invoice and the customs declaration, and to handle a return or a claim. We use accounting records because Hong Kong law requires them. We keep security logs to keep the site up and to investigate abuse.

The lawful basis is the performance of a contract or the steps you asked us to take before one, our legitimate interest in running a trading business and defending claims, your consent where you have given it for a sample or a follow-up, and legal obligation for tax and accounting records. We do not need your consent to answer an email you sent us, and we do not treat silence as consent for anything else.

Who else sees it

Our mailbox and hosting providers process the correspondence and the logs on our instructions. The courier receives the delivery name, address, phone number, piece count, weight and declared value — enough to move the carton and clear it, nothing more. The bank named on the invoice sees the payment reference and the amount, not your enquiry. If you ask for a lab-dip or a mill test report, the mill receives the shade reference and the lot number, not your personal details.

We do not sell, rent or trade personal data, and we do not pass an enquiry list to a marketing partner. We disclose data to a public authority only where Hong Kong law compels it, and where we are allowed to we tell you that we have done so.

Transfers outside Hong Kong

We operate from Hong Kong. Mail is handled on servers in the region of the mailbox provider we use, and the mill that weaves or dyes a special lot may sit in Europe or mainland China. That means your details can leave Hong Kong. Where they do, we keep the transfer to what the order needs, we use providers with contractual data-protection terms, and we do not send the enquiry text when a lot number and a shade reference are enough.

How long we keep it

An enquiry that does not become an order is deleted or anonymised after 24 months. If it becomes an order, the order file — the pieces, the shades, the quantities, the invoice and the correspondence that fixed the terms — is kept for 7 years, because that is the period we must be able to answer for under Hong Kong accounting and limitation rules.

Monogram embroidery details are retained with the order file for the same period. The letters, the thread shade, the placement and the approval image stay attached to the order, because a stitched cloth cannot be un-stitched and a later repeat of the same monogram has to match the first one. If you want the monogram record removed before the 7 years are up, write to us: we will delete what we are not obliged to keep, and tell you plainly what we must keep and why.

Server logs are rotated after 90 days. Cookies live only as long as your browser session or the short lifetime set on the notice cookie.

Your rights

Under the Personal Data (Privacy) Ordinance you may ask whether we hold your personal data, ask for a copy, ask us to correct anything inaccurate, and ask us to stop using your data for a purpose you no longer want — including a sample follow-up or a shade update. Where the data is not needed for a legal record, you may ask us to delete it.

Write to WELLAY1914@outlook.com with the email address or order number you used. We answer a data access or correction request within 40 days as the Ordinance allows, and usually much sooner. We may ask one question to confirm it is you, because sending an order file to the wrong person would be a worse failure than a slow reply.

Marketing, children and security

We do not run a newsletter and we do not add an enquiry address to a marketing list. If we ever write about a new mill lot, it goes to people who have asked for it, and every such message carries a one-line way to stop. We do not profile you, we do not score you, and we do not make automated decisions about your order.

This site is for adults trading or buying for a household. We do not knowingly collect data from a child under 18. If a child has written to us, tell us and the message goes. Data in transit is encrypted, access to the mailbox is limited to the desk and the bookkeeper, and order files are kept on machines with disk encryption and an access log.

How to complain

Tell us first. Write to WELLAY1914@outlook.com with the subject line PRIVACY. We acknowledge in 2 working days and give a written answer within 30 days, including what we did and what we changed. If you are not satisfied, you may complain to the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong, which supervises the Ordinance independently of us. You can also complain to a regulator in your own country where local law gives you that right, and we will cooperate with a lawful request from either.

Changes and contact

We may update this notice when the way we handle data changes — a new courier, a new mailbox provider, a new retention duty. The current version is always the one on this page, and the date at the foot tells you when it last moved. If the change affects an order already in progress, we will tell you in the correspondence for that order rather than hoping you re-read the page.

The data controller is WELLAY TRADING CO., LIMITED, RM 03, 24/F, HO KING COMMERCIAL CENTRE, 2-16 FA YUEN STREET, MONGKOK, HONG KONG. Write to WELLAY1914@outlook.com for anything in this notice.