§Legal
Privacy Policy
This policy explains what personal data we collect when you use tintavell.com, why, who we share it with and what your rights are. It follows the Personal Data (Privacy) Ordinance of Hong Kong (Cap. 486, “PDPO”) and its six Data Protection Principles. If you are in the European Economic Area or the United Kingdom, the EU and UK General Data Protection Regulation (GDPR) also apply, and this policy covers what they require.
Who is responsible
Light In The Box Limited (trading as TINTAVELL), 5/F, Tack Building, 50 Gilman Street, Central, Hong Kong. Email: support@tintavell.com. Phone: +852 59074326. We are the data user under the PDPO and the controller under the GDPR.
What we collect and why (DPP1, DPP3)
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, email, phone (optional), billing and delivery address | Process, deliver and support your order; send order and delivery emails | Contract (Art. 6(1)(b)) |
| Order contents, amounts, currency, order language | Fulfil the order, handle returns and refunds, keep accounting records | Contract; legal obligation (Art. 6(1)(c)) |
| Payment status (not card numbers) | Confirm payment and refunds. Card details go directly to our payment provider; we never see or store them. | Contract |
| Messages you send us (contact form, email, withdrawal form) | Answer you and keep a record of withdrawals and returns | Contract; legitimate interest (Art. 6(1)(f)) |
| Account login (if you create one) | Let you see your orders | Contract |
| Technical data: IP address, browser, pages requested | Keep the site secure, detect fraud, work out your delivery country for prices | Legitimate interest |
We only collect what we need for these purposes. Giving us your name, email and address is necessary to place an order; without them we cannot deliver it. Your phone number is optional. We will not use your data for a new purpose without your express and voluntary consent. We do not send marketing emails, we do not sell your data, and we do not use advertising or analytics trackers.
Who we share it with
- Payment provider: to take your payment and issue refunds, and to prevent fraud.
- Carriers and postal services: your name, address and phone or email for delivery.
- Hosting and email providers: our website and mailbox are hosted by service providers who process data only on our instructions.
- Authorities: only when the law requires it.
Transfers outside your country
We are based in Hong Kong and our service providers may process data in other countries, including the EU and the United States. We follow the PCPD’s guidance on cross-border data transfer, including its recommended model contractual clauses, as a matter of practice. For data from the EEA or UK, transfers rely on an adequacy decision or on the European Commission’s standard contractual clauses (or the UK equivalent).
How long we keep it (DPP2)
- Order and accounting records: 7 years, as Hong Kong tax law requires.
- Messages and withdrawal requests: 3 years after the matter is closed.
- Accounts: until you ask us to delete it; inactive accounts are deleted after 3 years.
- Technical logs: up to 90 days.
Security (DPP4)
The whole site uses HTTPS. Access to customer data is limited to the people who handle orders. Card payments are handled entirely by our payment provider. Hong Kong does not currently require breach notification; we will notify the Privacy Commissioner for Personal Data and the people affected anyway where a breach creates a real risk of harm.
Your rights (DPP6 and GDPR)
You can ask us for a copy of your personal data and ask us to correct it. Under the PDPO we may charge a fee for a data access request that is not excessive; we will tell you before. If the GDPR applies to you, you can also ask us to delete your data, restrict or object to its use, and receive it in a portable format, and you will not be charged.
Send requests to support@tintavell.com. We reply within 40 days (PDPO) or one month (GDPR).
Complaints
You can complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD). If you are in the EEA or UK, you can also complain to the data protection authority in your country, for example Datatilsynet in Denmark, the data protection authority of your German federal state, the CNIL in France, IMY in Sweden or the ICO in the UK.
Cookies
We only use cookies that the shop needs to work. See our Cookie Policy.
Children
Our shop is for adults. We do not knowingly collect data from children.
Changes
Hong Kong’s data protection law is under review. We will update this policy if the requirements change. The current version is always on this page.
Last updated: 9 October 2026.