Privacy Policy

1.1 This Privacy Policy ("Policy") explains how Silva Wine Auctions Limited (菁蔓葡萄酒拍賣有限公司), a company incorporated in Hong Kong with its registered office at Unit 1104A, 11/F, Kai Tak Commercial Building, 317-319 Des Voeux Road Central, Hong Kong ("Silva", "we", "us" or "our"), collects, uses, holds, discloses and otherwise handles your personal data.

1.2 Silva operates an online fine-wine marketplace for Hong Kong offering weekly Auctions, Buy Now and Limited Offers (the "Platform"). Silva sells Lots supplied on consignment by wine merchants and private collectors, and arranges their packing, dispatch and delivery; a Consignor that retains custody may pack and dispatch a Lot on Silva's behalf. Silva also operates the Platform, processes payments and carries out marketing. In respect of the personal data described in this Policy, Silva acts as a data user for the purposes of the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (the "PDPO").

1.3 This Policy applies to personal data we collect through the Platform, through our related websites, pages and channels, and through your other dealings with us. It should be read together with our Terms of Service and any other notice we give you when we collect your personal data.

1.4 We are committed to handling your personal data in accordance with the PDPO and the six Data Protection Principles ("DPPs") set out in Schedule 1 to the PDPO. By using the Platform or providing personal data to us, you acknowledge that you have read and understood this Policy.

1.5 The Platform is intended for individuals who are 18 years of age or older (see Section 11).

2.1 Depending on how you interact with us, we may collect and hold the following categories of personal data:

(a) Account and identity/contact details — your name, username, password (stored in encrypted form), email address, telephone number, and, where required for verification, age/date-of-birth confirmation and identity or proof-of-age information;

(b) Bidding and purchase history — bids placed, lots won, orders, transaction records, invoices, pricing information relating to your activity, and Buy Now / Limited Offer transactions;

(c) Delivery details — recipient name, delivery address, and related fulfilment instructions;

(d) Payment details — we use a PCI-DSS compliant third-party payment processor (Stripe) to process card payments. We do not store your full card number or CVV/security code. We store only payment tokens and limited data such as the card type and the last four digits, together with transaction references;

(e) Communications — records of your correspondence and communications with us, including customer-service enquiries, dispute or claim records, and feedback;

(f) Device and usage data, and cookies — your IP address, device and browser type, operating system, log data, pages viewed, referring/exit pages, and similar information collected automatically when you use the Platform (see Section 7);

(g) Marketing-engagement data — your marketing preferences, and data about how you interact with our marketing (for example whether you open our emails or engage with our Instagram or other channels); and

(h) Consignor data — if you consign wine through the Platform as a merchant or a private collector: your name and contact details; identity-verification documents (such as HKID or passport details) where required for verification or anti-money-laundering checks; records of your consignments, listings and sales; and the bank account details we use to remit consignment proceeds to you.

2.2 You are not obliged to provide your personal data to us. However, if you do not provide certain personal data (for example account, identity, delivery or payment details), we may be unable to open your account, verify your eligibility, accept your bids, process your orders or provide our services to you.

3.1 We collect personal data in the following ways:

(a) Directly from you — when you register an account, complete your profile, place a bid or an order, make a payment, arrange delivery, list or consign wine for sale, contact our customer-service team, subscribe to updates, or otherwise communicate with us;

(b) Automatically through the Platform — when you access or use the Platform, we and our service providers automatically collect device, log, usage and cookie data using cookies and similar technologies (see Section 7);

(c) From third parties — we may receive personal data from our payment processor (for example payment confirmations, tokens and the last four digits of your card), from Consignors acting for Silva and couriers in connection with fulfilment, from fraud-prevention and identity/age-verification providers, and from our IT and analytics service providers, in each case to the extent permitted by law.

4.1 We use your personal data for the following purposes, consistent with DPP 1 and DPP 3 of the PDPO:

(a) Operating auctions and accounts — creating and administering your account, verifying your identity and eligibility (including age), enabling you to place bids and orders, and running our Auctions, Buy Now and Limited Offers;

(b) Processing payments — processing your payments through our payment processor, reconciling and releasing historical pre-authorisation holds on your payment method, issuing invoices and receipts, handling refunds, chargebacks and reconciliations, and remitting consignment proceeds to Consignors;

(c) Arranging fulfilment — sharing only the necessary delivery details with the Consignor acting for Silva where that Consignor packs or dispatches the order, and with the relevant courier/logistics provider, so that your wine can be delivered to you;

(d) Customer service — responding to your enquiries, requests, feedback, disputes and claims, and maintaining records of our dealings with you;

(e) Security and fraud prevention — protecting the Platform, verifying transactions, detecting and preventing fraud, unauthorised access, and other unlawful or prohibited activity, and ensuring the integrity of our Auctions;

(f) Legal and regulatory compliance — complying with applicable laws, regulations, codes of practice and lawful requests by public authorities, and establishing, exercising or defending legal claims;

(g) Service improvement and analytics — understanding how the Platform is used, maintaining and improving our services, and carrying out internal record-keeping, research and analysis; and

(h) Direct marketing — subject to Section 5, sending you marketing and promotional communications about our Auctions, offers, products and services.

4.2 We will not use your personal data for a new purpose materially different from those set out above unless we have first obtained your consent or are otherwise permitted or required to do so under the PDPO.

5.1 We would like to use your personal data — namely your name, contact details (including email address and telephone number) and your marketing-engagement and preference data — to send you direct-marketing communications about our weekly Auctions, Buy Now listings, Limited Offers, events, products, services and related promotions, including through email and our founder-led Instagram and other channels.

5.2 In accordance with the requirements of the PDPO (in particular Part 6A of Cap. 486), we will not use your personal data for direct marketing without your consent or your indication of no objection. We will, when we first intend to so use your personal data, inform you of our intention and of the classes of personal data and marketing subjects concerned, and we will not so use your personal data unless we have received your consent or indication of no objection.

5.3 You may withdraw your consent and opt out of direct marketing at any time, free of charge. You can do so by:

(a) using the "unsubscribe" link or opt-out facility contained in our marketing emails; or

(b) contacting us using the details in Section 14.

5.4 Upon receiving your opt-out request, we will cease to use your personal data for direct marketing without charge to you. Opting out of direct marketing will not affect our continued use of your personal data for the other purposes set out in Section 4 (for example operating your account and fulfilling your orders).

5.5 We will not provide your personal data to any other person for that other person's use in direct marketing unless we have first obtained your written consent as required under the PDPO.

6.1 We keep your personal data confidential but may disclose or transfer it to the following classes of persons for the purposes set out in Section 4:

(a) Consignors acting for Silva — where a Consignor packs or dispatches your order on Silva's behalf, we share only the delivery details necessary for that fulfilment. We do not share buyer details with a Consignor merely because it supplied a Lot;

(b) Payment processor — our PCI-DSS compliant third-party payment processor (Stripe), for the purpose of processing payments, historical pre-authorisation holds, refunds and chargebacks;

(c) Couriers and logistics providers — delivery, warehousing and logistics providers engaged to store, handle and deliver your order;

(d) IT and service providers — our IT, hosting, cloud, communications, analytics, customer-service, marketing, identity/age-verification, fraud-prevention, accounting, audit and professional-advisory service providers, who are authorised to use your personal data only to provide services to us;

(e) Legal, regulatory and successor recipients — any person to whom we are required or permitted to make disclosure under any applicable law, regulation, court order or request by a competent authority; and any actual or proposed assignee, transferee, participant or acquirer in connection with a reorganisation, merger, sale or transfer of our business or assets.

6.2 Transfer outside Hong Kong. Some of the recipients described above (including our payment processor and certain IT, cloud and service providers) may be located, or may process your personal data, outside Hong Kong. Where we transfer your personal data outside Hong Kong, we will take reasonable steps to ensure that it is afforded a level of protection comparable to that required under the PDPO, including through appropriate contractual and security safeguards with the recipients.

6.3 We do not sell your personal data.

7.1 The Platform uses cookies and similar technologies (such as pixels, tags and local storage) to enable core functionality, remember your preferences and login session, maintain security, understand how the Platform is used, and measure the effectiveness of our content and marketing.

7.2 Cookies we use may include: (a) strictly necessary cookies required for the Platform to function; (b) functional cookies that remember your settings; (c) performance/analytics cookies that help us understand usage; and (d) marketing cookies relating to our promotional activity.

7.3 You can control or disable cookies through your browser settings. Please note that disabling certain cookies may affect the availability or functionality of parts of the Platform.

7.4 We may use analytics tools provided by third parties to help us analyse usage of the Platform. These providers may process device and usage data on our behalf in accordance with Section 6.

7.5 We use Google Analytics, which uses cookies and anonymised IP addresses to measure visits. You can block it through your browser settings or the Google Analytics opt-out add-on. 我們使用 Google Analytics，透過 Cookie 及匿名化 IP 位址量度瀏覽量。您可在瀏覽器設定中封鎖此功能，或使用 Google Analytics 停用瀏覽器外掛程式。

7.6 We use Meta Pixel and cookies to measure the effectiveness of our advertising. You can block it through your browser settings. 我們使用 Meta Pixel 及 Cookie 量度廣告成效。您可在瀏覽器設定中封鎖此功能。

8.1 We take practicable steps, consistent with DPP 4 of the PDPO, to safeguard your personal data against unauthorised or accidental access, processing, erasure, loss or use. These measures include access controls, encryption of data in transit and of sensitive stored data (such as passwords), use of a PCI-DSS compliant payment processor so that we do not store raw card or CVV data, network and application security controls, and staff confidentiality obligations.

8.2 While we strive to protect your personal data, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

9.1 Consistent with DPP 2 of the PDPO, we will retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to operate your account, complete and record transactions, provide customer service, and satisfy our legal, accounting, tax, regulatory and record-keeping obligations, or to establish, exercise or defend legal claims. In particular, records of transactions and related accounting, tax and business records (which may include personal data) are retained for at least seven (7) years in accordance with Hong Kong company and tax record-keeping requirements.

9.2 When your personal data is no longer required for these purposes, we will take reasonably practicable steps to erase it or otherwise cease to hold it in a form that identifies you, unless retention is required or permitted by law.

10.1 Under the PDPO (in particular sections 18, 22 and 38, and DPP 6), you have the right to:

(a) make a data access request — to ascertain whether we hold personal data about you and to obtain a copy of such data; and

(b) make a data correction request — to request that we correct any of your personal data that is inaccurate.

10.2 To exercise these rights, please submit your request in writing to our data-protection contact using the details in Section 14. We may need to verify your identity before responding, and we may charge a fee that is not excessive, as permitted under the PDPO.

10.3 We will respond to a data access or data correction request within the time limits and in the manner required by the PDPO. In certain circumstances we may be entitled to refuse a request to the extent permitted or required under the PDPO, in which case we will notify you of our reasons.

10.4 You also have the right to opt out of direct marketing at any time free of charge, as described in Section 5.

10.5 If you have any concern about how we handle your personal data, you may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).

11.1 The Platform relates to the sale of alcoholic beverages and is intended for individuals aged 18 years or older. We do not knowingly collect personal data from any person under the age of 18.

11.2 If you are under 18, you must not use the Platform or provide any personal data to us. If we become aware that we have collected personal data from a person under 18 without appropriate authority, we will take reasonable steps to delete such data.

12.1 The Platform may contain links to, or integrations with, third-party websites, channels or services (including our payment processor and our social-media channels such as Instagram). This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third party before providing your personal data to them.

13.1 We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. The updated Policy will be posted on the Platform with a revised effective date, and any changes take effect when so posted. Where required by law, we will provide additional notice of material changes. Your continued use of the Platform after such changes indicates your acknowledgement of the updated Policy.

14.1 If you have any questions about this Policy, wish to exercise your rights, or wish to make a data access request, a data correction request, or a direct-marketing opt-out request, please contact our data-protection contact:

Silva Wine Auctions Limited (菁蔓葡萄酒拍賣有限公司)

Data-Protection / Privacy Contact: The Data Protection Officer

Email: sales@silvawines.com

Registered office: Unit 1104A, 11/F, Kai Tak Commercial Building, 317-319 Des Voeux Road Central, Hong Kong

14.2 This Policy is governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region of the People's Republic of China.

This document is a draft prepared for discussion purposes only and does not constitute legal advice. Silva Wine Auctions recommends seeking independent legal advice before use.