Privacy Policy

Last updated: 8 November 2026

This Privacy Policy explains how iD55 LIMITED (“iD55”, “we”, “us”) collects, uses and shares personal data when you visit https://www.id55.com/, place an order, contact us or subscribe to our newsletter. We are the data controller for that data.

Contact: [email protected] · Unit 1203, 12/F, 55 Wellington Street, Central, Hong Kong. We do not have a statutory data protection officer; privacy questions go to the same address and are handled by our operations lead.

1. What we collect

Category	Examples	Source
Order and account data	Name, email, phone, billing and delivery address, order history, VAT number	You, at checkout or in your account
Payment data	Card brand and last four digits, payment status, fraud signals. Full card numbers never reach our servers.	Stripe
Communication data	Emails, contact form messages, return and repair requests	You
Marketing data	Email address, consent status and timestamp, engagement with our emails	You
Technical data	IP address, browser and device type, pages viewed, referring URL, approximate location from IP	Automatically, when you use the Site
Cookie data	Session identifiers, cart contents, language preference, consent choices	Your browser

2. Why we use it and on what legal basis

• To fulfil your order — taking payment, shipping, customs paperwork, returns and refunds. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• To comply with the law — tax, accounting, product safety and consumer records. Legal basis: legal obligation (Art. 6(1)(c)).
• To run and secure the Site — preventing fraud and abuse, debugging, load management. Legal basis: legitimate interests (Art. 6(1)(f)), balanced against your rights.
• To answer you — support, repairs and complaints. Legal basis: contract or legitimate interests.
• To send marketing — only with your consent (Art. 6(1)(a)), which you can withdraw at any time. Existing customers may receive relevant product updates where soft opt-in rules allow, always with an unsubscribe link.
• To measure and improve — analytics only after you consent through the cookie banner; marketing measurement (Meta Pixel / Conversions API) only after separate marketing consent, where required.

3. Cookies and similar technologies

We use strictly necessary cookies to run the cart and checkout, and optional analytics and marketing cookies only with your consent. The Cookie Policy lists the cookies we set, their purpose and lifetime, and explains how to change your choices. We honour the Global Privacy Control signal where our consent tooling supports it.

4. Who we share data with

We share only what is necessary, under contracts that require confidentiality and security:

• Stripe — payment processing, fraud prevention (Stripe Payments Europe, Ltd. / Stripe, Inc.).
• Hosting — Hetzner Online GmbH, EU data centres (Germany/Finland), for the Site and database.
• Meta — Meta Platforms Ireland Limited / Meta Platforms, Inc., for the Meta Pixel, Conversions API and catalogue, only where you have accepted marketing cookies and the integration is enabled.
• Email — our transactional email provider, for order confirmations, shipping updates and support replies.
• Carriers — DHL, UPS, Deutsche Post or local postal operators, to deliver and track your parcel.
• Fulfilment and dropshipping partners — the warehouse that packs and ships your order, where applicable. They receive the delivery details needed to fulfil it and act on our instructions.
• Professional advisers — accountants, auditors and lawyers, where necessary.
• Authorities — where required by law or to establish, exercise or defend legal claims.

We do not sell your personal data. We do not share it for cross-context behavioural advertising except through consent-based marketing tools that load only after you opt in.

5. International transfers

We operate from Hong Kong and use service providers in the European Union, the United Kingdom and the United States. Where personal data leaves the EEA/UK, we rely on an adequacy decision or on Standard Contractual Clauses approved by the European Commission (and the UK Addendum where relevant), together with additional technical and organisational safeguards such as encryption in transit.

6. How long we keep it

• Order, invoice and tax records: 10 years, as required by accounting law.
• Account data: while your account is active, then 12 months after last activity.
• Support and contact messages: 24 months after the conversation closes.
• Marketing consent records: until you unsubscribe, plus 3 years as proof of consent.
• Abandoned carts: 30 days.
• Server and security logs: 30–90 days.

Where a legal claim is pending, we keep the relevant data until it is resolved.

7. Your rights

Depending on where you live, you may have the right to: access your data and receive a copy; correct inaccurate data; delete data we no longer need; restrict or object to certain processing; receive your data in a portable format; withdraw consent at any time; and lodge a complaint with your local data protection authority.

To exercise any right, email [email protected]. We respond within 30 days and may ask you to verify your identity. Exercising your rights is free and we will not treat you differently for doing so.

California residents: you have the right to know, delete and correct personal information, and to opt out of sale or sharing. We do not sell personal information. We do not knowingly collect data from consumers under 16 for sale or sharing. You can designate an authorised agent; we may ask for proof of authorisation.

8. Security

The Site runs on encrypted HTTPS connections. Access to the WordPress admin and database is restricted, password-protected and logged. Card data is tokenised by Stripe and never stored on our servers. We keep software patched, take encrypted backups and review access regularly. No system is perfectly secure, but we notify affected individuals and regulators of a breach where the law requires it.

9. Children

Our store is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has provided personal data, contact us and we will delete it.

10. Automated decision-making

Stripe and our fraud tools may score a payment automatically to block high-risk transactions. This can result in a declined order. You can contact us to ask for a human review of a decline. We do not make other automated decisions with legal effects.

11. Changes

We may update this policy to reflect changes in our services or the law. The “last updated” date shows the current version; material changes will be announced on the Site. Where consent is required for a new use, we will ask for it again.

12. Contact and complaints

Email [email protected] or write to Unit 1203, 12/F, 55 Wellington Street, Central, Hong Kong. If you are in the EEA or UK and are not satisfied with our response, you can complain to your national data protection authority. In Hong Kong, the Office of the Privacy Commissioner for Personal Data handles complaints.

13. 中文摘要（以英文版為準）

我們（iD55 LIMITED）為處理你的個人資料的資料控制者。我們只會為完成訂單、履行法律責任、保障網站安全、回覆查詢，以及在你同意的情況下發送市場推廣資訊而使用你的資料。我們不會出售你的個人資料。付款由 Stripe 處理，我們不會儲存完整的信用卡號碼。你可隨時電郵 [email protected] 查閱、更正或刪除你的資料，或取消訂閱。資料可能傳送至香港、歐盟、英國及美國的服務供應商，並以標準合約條款等機制保障。本摘要僅供參考，如中英文版本有差異，以英文版為準。