Privacy Policy

Effective date: 23 September 2026 · Last updated: 23 September 2026

chppanel.com is operated by WHATECH MOBILE CO., LIMITED, a company incorporated in Hong Kong, with its registered office at Room 505, 5th floor, Beverley Commercial Centre, 87-105 Chatham Road South, Tsim Sha Tsui, Kowloon, Hong Kong ("chppanel.com", "we", "us", "our"). You can contact us at [email protected] or [email protected]. We are committed to processing personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the ePrivacy rules of the EU Member States, and, for our own compliance as a Hong Kong-based company, the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO").

This document is organised in two parts. Part 1 sets out the terms that apply to our cash-on-delivery (COD) and other sales to customers located in the European Union / European Economic Area ("EU/EEA"), which is our primary market (currently Spain, Portugal, Italy, Slovakia, Slovenia, Bulgaria, Romania, Greece, Czech Republic, Poland, Hungary, Germany, Lithuania, Latvia). Part 2 sets out how we, as a company established in Hong Kong, comply with Hong Kong law, and the terms that apply to customers located outside the EU/EEA. Where both parts could apply to you, the more specific and more protective provisions of Part 1 prevail for EU/EEA consumers; nothing in Part 2 reduces the rights granted to you in Part 1.

Part 1 — European Union / EEA customers (GDPR)

1.1 Who we are (Data Controller)

The data controller responsible for your personal data when you are located in the EU/EEA is WHATECH MOBILE CO., LIMITED, registered address Room 505, 5th floor, Beverley Commercial Centre, 87-105 Chatham Road South, Tsim Sha Tsui, Kowloon, Hong Kong.

Email: [email protected] — [email protected].

EU/EEA representative (Article 27 GDPR)

Because we offer goods to individuals located in the European Union / European Economic Area from outside the EU/EEA, we are required to designate a representative in the Union. Our appointed EU representative is: Luca Luciani srl, Via Slavia 3, 50122 Firenze, Italy. EU/EEA data subjects may contact our representative on all matters related to the processing of their personal data, in addition to contacting us directly.

1.2 Scope of this Part

This Part applies to personal data we process about customers, prospective customers, and visitors of our website who are located in the EU/EEA, whether you buy from us or simply browse. It does not apply to third-party websites we may link to, which have their own privacy policies.

1.3 The personal data we collect

• Identity and contact data — first and last name, delivery and billing address, email address, telephone number.
• Order and transaction data — products ordered, order value, payment method (including cash-on-delivery selection), delivery details, order history, and communications with our customer service.
• Payment data — where you pay online, payment is processed by our payment providers; we do not store full card numbers. For cash-on-delivery orders we process only the information needed to fulfil and collect the order.
• Technical and usage data — IP address, device and browser type, operating system, referring pages, pages viewed, and interactions on our site, collected through cookies and similar technologies (see our Cookie Policy).
• Marketing and communications data — your preferences in receiving marketing from us and your communication preferences.

We do not intentionally collect special categories of data (such as health or biometric data), and we ask that you do not provide such data to us.

1.4 How we collect your data

• Directly from you — when you place an order, fill in a form or landing page, subscribe to our newsletter, or contact us.
• Automatically — through cookies, pixels and similar technologies when you use our website (see our Cookie Policy).
• From third parties — such as advertising and analytics platforms (e.g. Google, Meta), payment providers, and delivery/logistics partners who help us fulfil and confirm your orders.

1.5 Why we use your data and our legal bases

We only process your personal data where we have a lawful basis to do so under Article 6 GDPR. The table below summarises our main processing activities:

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to such processing at any time (see Section 1.12).

1.6 Marketing communications

We may send you information about similar products and offers by email or other channels where permitted by law. You can withdraw your consent or opt out at any time by using the unsubscribe link in any marketing message, or by contacting us at [email protected]. Opting out of marketing does not affect service messages relating to your orders.

1.7 Cookies, advertising and similar technologies

We use cookies, pixels and similar technologies to operate our site, remember your preferences, analyse traffic and deliver relevant advertising. We use, among others, Google Ads, Google Analytics and the Meta Pixel. In line with Google's EU User Consent Policy, non-essential cookies (including analytics and advertising cookies) are only set after you give specific, informed, freely given consent through our consent-management (cookie banner) tool; you can withdraw that consent at any time. Where Google or another third party collects data as a result of your use of our site, that party acts as an independent controller of the data it collects; you can learn more about how Google uses this data at https://policies.google.com/technologies/partner-sites. Full details, including the categories and providers involved, are set out in our separate Cookie Policy.

1.8 Who we share your data with

We do not sell your personal data. We share it only with the following categories of recipients, and only to the extent necessary:

• Logistics and delivery partners — couriers and fulfilment providers who deliver your order and, for cash-on-delivery, collect payment.
• Payment service providers — to process online payments securely.
• Technology and hosting providers — website hosting, IT, customer-service and communication tools, some of which may be located in Hong Kong or elsewhere outside the EU/EEA.
• Advertising and analytics providers — such as Google and Meta, to measure and improve our campaigns (subject to your cookie consent).
• Professional advisers and authorities — accountants, auditors, lawyers, and public authorities where required by law.

All processors act on our documented instructions under a written data-processing agreement that requires them to keep your data secure and to process it only for the agreed purposes.

1.9 International data transfers

We are established in Hong Kong, and our own processing of your data, as well as processing by some of our service providers, takes place outside the EU/EEA — including in Hong Kong, which has not been recognised by the European Commission as providing an adequate level of data protection. This means your personal data may be transferred to, and processed in, countries that do not provide the same level of data protection as your home country.

Where we transfer personal data out of the EU/EEA, we rely on appropriate safeguards, in particular the Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical and organisational measures where necessary. Where a recipient (for example, a major advertising or analytics provider such as Google) is certified under the EU-US Data Privacy Framework for its own processing, transfers to that recipient for that processing may instead rely on that framework's adequacy decision. You may request a copy of the relevant safeguards by contacting us at [email protected].

1.10 How long we keep your data

• Order and transaction data — retained for the duration of our relationship and afterwards for the periods required by tax, accounting and consumer-protection law.
• Customer-service records — retained for as long as needed to handle your request and any related claim.
• Marketing data — retained until you withdraw consent or object, after which we suppress your details to honour your choice.
• Technical/cookie data — retained for the periods set out in our Cookie Policy.

When your data is no longer needed, we securely delete or anonymise it.

1.11 How we protect your data

We implement appropriate technical and organisational measures — including encryption in transit, access controls, and restricted staff access — designed to protect your personal data against unauthorised access, loss, misuse or alteration. While no method of transmission over the internet is completely secure, we work to protect your data and to notify you and the competent authority of any personal-data breach where required by law.

1.12 Your rights under the GDPR

If you are located in the EU/EEA, you have the right to:

• access the personal data we hold about you and obtain a copy;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten") in certain circumstances;
• restrict or object to our processing, including objecting to direct marketing at any time;
• data portability — receive your data in a structured, commonly used, machine-readable format;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at [email protected]. We will respond within one month, as required by the GDPR. You also have the right to lodge a complaint with your local data protection authority (a list of EU/EEA authorities is available on the European Data Protection Board website, edpb.europa.eu). We would, however, appreciate the chance to address your concerns before you approach the authority.

For the countries in which we currently sell, the competent data protection authorities are:

1.13 Children's privacy

Our website and products are not directed at children, and we do not knowingly collect personal data from children under the age of 16 (or the applicable minimum age in your country). If you believe a child has provided us with personal data, please contact us and we will delete it.

1.14 Third-party links

Our website may contain links to third-party sites, plugins and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. We encourage you to read the privacy policy of every site you visit.

1.15 Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Where we use automated tools to detect fraud or non-genuine orders, meaningful human review is available on request.

Part 2 — Hong Kong compliance (PDPO)

WHATECH MOBILE CO., LIMITED is a limited company incorporated in Hong Kong. As a data user established in Hong Kong, we are subject to the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and its six Data Protection Principles, as well as to the guidance issued by the Office of the Privacy Commissioner for Personal Data, Hong Kong ("PCPD"). This Part supplements, and does not replace, Part 1 above for EU/EEA data subjects, and sets out the position for customers and website visitors located outside the EU/EEA.

2.1 Principles we follow

In line with the Data Protection Principles of the PDPO, we collect personal data only for lawful purposes directly related to our activities and only to the extent necessary; we inform you of the purposes of collection and of the classes of persons to whom your data may be transferred; we keep personal data accurate and for no longer than necessary; we use it only for the purposes for which it was collected, or directly related purposes, unless you give your express consent; we protect it against unauthorised or accidental access, processing, erasure, loss or use; and we make our policies and practices on personal data available to you.

2.2 Direct marketing

In accordance with Part 6A of the PDPO, we will not use your personal data in direct marketing, or provide it to others for that purpose, without first informing you and obtaining your consent. You may opt out of direct marketing at any time, free of charge, by using the unsubscribe link in our messages or by writing to [email protected].

2.3 Your rights under the PDPO

Subject to the conditions and exemptions of the PDPO, you have the right to:

• ask whether we hold personal data about you and obtain a copy of it (data access request);
• ask us to correct personal data about you that is inaccurate (data correction request);
• withdraw at any time your consent to the use of your personal data in direct marketing;
• be informed of our policies and practices on personal data and of the kinds of personal data we hold.

To exercise these rights, write to us at [email protected]. We will respond to data access and data correction requests within 40 days, as required by the PDPO. We may charge a fee for complying with a data access request, which will not be excessive, and we may need to verify your identity before acting on a request.

2.4 Transfers of personal data outside Hong Kong

Personal data we collect may be transferred to, and processed in, places outside Hong Kong, including the EU/EEA (where our customers are located) and the countries of our service providers. When we do so, we take all practicable steps — including contractual safeguards in line with the PCPD's Recommended Model Contractual Clauses for cross-border transfers of personal data — to ensure that your data is protected to a standard comparable to the PDPO, and we apply the additional safeguards described in Section 1.9 for data of EU/EEA data subjects.

2.5 Security and personal-data breaches

We apply appropriate technical and organisational measures to protect personal data. If a personal-data breach occurs, we will act promptly to contain it and, where appropriate, notify the PCPD and the affected individuals in line with the PCPD's guidance and, for EU/EEA data subjects, as required by the GDPR.

2.6 Complaints

If you believe we have not complied with the PDPO, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk). We would, however, appreciate the chance to address your concerns directly first.

2.7 Identity of the data user

The data user (controller) responsible for personal data handled under this Part 2 is WHATECH MOBILE CO., LIMITED, Room 505, 5th floor, Beverley Commercial Centre, 87-105 Chatham Road South, Tsim Sha Tsui, Kowloon, Hong Kong.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The "Last updated" date at the top shows when it was last revised. Material changes will be notified through our website or by other appropriate means.

Contact us

If you have any questions about this document, or wish to exercise any of your rights, please contact us:

chppanel.com (operated by WHATECH MOBILE CO., LIMITED)

Registered address: Room 505, 5th floor, Beverley Commercial Centre, 87-105 Chatham Road South, Tsim Sha Tsui, Kowloon, Hong Kong

Email: [email protected]

Email: [email protected]

Website: chppanel.com