Privacy Policy

Last updated: [Effective Date] Version 1.0 Covers hengzhid.com and the HK EZEDON mobile management app (iOS and Android) Questions: support@hengzhid.com

1. Introduction and Scope

1.1 Who we are

HK EZEDON CO., LIMITED ("EZEDON", "we", "us" or "our") is a company incorporated in the Hong Kong Special Administrative Region. Our registered office is Room 701 (Unit 127), 7/F, Tower B, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui East, Hong Kong. We operate the website published at hengzhid.com and we publish the HK EZEDON mobile management app through the Apple App Store and Google Play. For the purposes of applicable data protection law, EZEDON is the data controller or, where we act on behalf of a customer, the data processor of the relevant personal information.

1.2 What this Policy covers

This Policy applies to personal information that EZEDON processes in connection with:

• the corporate website at hengzhid.com, including its services, culture, news and contact pages;
• the HK EZEDON mobile management app for iOS and Android, distributed through the Apple App Store and Google Play;
• business enquiries, support correspondence, account records and trade documentation sent to support@hengzhid.com and liulu@hengzhid.com;
• advertising and measurement technologies that operate inside our app and website, as described in Chapter 9.

1.3 What this Policy does not cover

This Policy does not govern third-party websites, stores, platforms or services that we link to or that operate independently of us — including the Apple App Store, Google Play, the advertising networks listed in Chapter 9, and any website operated by a customer, partner or advertiser. Those providers are responsible for their own data handling, and we encourage you to read their privacy policies before you provide information to them. Where we display an advertisement, the advertiser's own privacy policy also governs the information that the advertiser collects from you.

1.4 Our business activities

EZEDON's registered business scope is: Intelligent technology information consultation, enterprise management advisory, cross-border trade, import and export of goods; wholesale and retail of electronic products, industrial equipment and general merchandise; business agency, marketing promotion and solution planning service. Because our business includes cross-border trade, import and export, and wholesale and retail of goods, some processing described in this Policy (for example customs, shipping and record-keeping information) is necessary to meet legal obligations that apply to us as an importer, exporter and goods supplier.

2. Information We Collect

2.1 Information you give us

• Contact and enquiry details — the name, company name, email address, country, telephone number and message content you submit through the contact form, or that you include in an email to support@hengzhid.com or liulu@hengzhid.com.
• Account details — where you create an account in the mobile management app: the email address or phone number you register with, your display name, your company, your role and your password hash. We never store your password in readable form.
• Commercial and trade records — where you instruct us to act for you in connection with consulting, agency, wholesale, import or export activity: order and quotation details, product specifications, delivery and billing addresses, commercial invoices, packing lists, bills of lading, customs declarations, certificates of origin and payment instructions.
• Support and diagnostic information — the contents of your support requests, log excerpts you paste into a support ticket, and any screenshots or files you choose to send.
• Survey and marketing responses — where you choose to respond to a business survey or newsletter request.

2.2 Information collected automatically from the website

• server log entries such as IP address, request timestamp, requested URL, HTTP status, referrer page and user-agent string;
• coarse location information derived from your IP address at country or city level;
• the cookie and similar-technologies state described in Chapter 11;
• aggregate page-view, navigation and interaction statistics used to understand which pages and services are useful.

2.3 Information collected automatically from the app

• Device and system information — device model, manufacturer, operating system and version, app version, screen resolution, language and locale settings, time zone, network type, and whether the device is rooted or jailbroken;
• App interaction events — screen views, buttons tapped, searches performed, feature usage, session start and end, and crash and diagnostic events;
• Performance data — app launch time, latency, memory pressure, network performance and error traces used for stability analysis;
• Advertising identifiers — the Apple Identifier for Advertisers (IDFA) and the Google Advertising ID (AAID), collected only in the circumstances described in Chapter 9 and subject to your consent where the law requires it.

2.4 Advertising identifiers

Advertising identifiers are device-level identifiers that can be used to deliver and measure advertising. We treat them as personal information. On iOS we access the IDFA only after you have granted App Tracking Transparency permission, and we do not request that permission if you have previously denied it. On Android we access the AAID only where the required advertising permission has been granted, and we honour the "Limit Ad Tracking" setting. Where you have opted out, we present non-personalised or contextual advertising instead. Chapter 9 explains this in full.

2.5 Optional location information

Where a feature genuinely requires it — for example to estimate delivery distance, to confirm the port of dispatch or arrival for a cross-border shipment, or to show nearby stock in the app — we may ask for your precise location. This permission is optional, is requested only at the moment the feature is used, and declining it does not disable the rest of the app. We do not collect location in the background and we do not build location histories.

2.6 Information we do not collect

We do not collect government-issued identity documents, financial account credentials, full payment card numbers, or special categories of personal data (such as health, biometric, racial or ethnic origin, political opinions, religious beliefs, or sexual orientation) through the website or the app. If a trade counterparty voluntarily provides such information as part of a transaction, we process it only under Chapter 4 and only for as long as Chapter 7 requires.

3. How We Use Your Information

3.1 Purposes of processing

We use personal information for the following purposes:

• to provide the mobile management app, the website and the advisory, agency, wholesale and cross-border trade services you request;
• to create, authenticate, secure and maintain your account, and to restore it if you change device;
• to respond to enquiries submitted through the contact form or sent by email, and to provide support when you contact us;
• to perform our business activities — intelligent technology information consultation, enterprise management advisory, cross-border trade, import and export of goods, wholesale and retail of electronics, industrial equipment and general merchandise, business agency, marketing promotion and solution planning — including quotations, orders, logistics coordination, documentation and invoicing;
• to comply with legal, regulatory, tax, customs and sanctions-screening obligations that apply to us as a Hong Kong company and as an importer and exporter;
• to maintain the security, integrity and availability of our systems, detect fraud and abuse, and enforce our Terms of Service;
• to measure the performance of the app and the website, understand which features are used, and plan product improvements;
• to display advertising inside the app, and to measure whether that advertising is delivered and effective;
• to send business communications about our services, where you have asked to receive them or where the law otherwise permits it;
• to establish, exercise or defend legal claims, and to cooperate with regulators, courts and law enforcement.

3.2 Profiling and automated decision-making

We do not use your personal information to make decisions that produce legal effects for you, such as deciding whether to offer you credit, or deciding the price, terms or eligibility of a trade finance arrangement. We do use limited profiling for advertising: where you have consented, an ad network may group you into broad audience segments based on your in-app activity so that it can select which advertisement to show you. You can refuse this profiling, and Chapter 12 explains how.

3.3 We do not sell personal information

EZEDON does not sell personal information for money, and we do not disclose your personal information to third parties for their own independent marketing purposes. Certain disclosures in Chapter 5 — including disclosures to advertising networks that involve their use of cookies or device identifiers — may be treated as a "sale", "sharing" or "targeted advertising" under the California Consumer Privacy Act as amended, and as "targeted advertising" under the Virginia, Colorado, Connecticut, Utah, Texas and Oregon statutes. You can opt out of those disclosures as described in Chapters 9 and 12.

3.4 Aggregated and de-identified information

We may aggregate or de-identify information so that it can no longer reasonably be linked back to you, and we may use such information for capacity planning, aggregated market and logistics analysis, and aggregated advertising reporting. De-identified information is not personal information, and it is outside the scope of this Policy.

4. Lawful Basis for Processing

4.1 Our approach

Where the GDPR, the UK GDPR or a comparable regime applies, we rely on the following bases under Article 6(1): consent (for personalised advertising, non-essential analytics, and any optional processing you can switch off); contract (where processing is necessary to provide the service you asked for, including the app features linked to your account); legal obligation (for tax, customs, sanctions-screening, record-keeping and regulatory obligations); legitimate interests (for security, fraud prevention, service quality, aggregated analytics and business administration, each subject to a documented balancing test); and vital interests in the rare circumstances where processing is necessary to protect life. We do not rely on consent where a contract, a legal obligation or a legitimate interest is the appropriate basis, and we never make consent a condition of access to the core of the service.

4.3 Withdrawing consent

Where we rely on consent, you may withdraw it at any time — in the app through the privacy or ad settings screen, on the website through the consent banner, or by writing to support@hengzhid.com. Withdrawal is prospective: processing carried out before the withdrawal remains lawful, and it does not affect the lawfulness of processing already completed. Where consent is required for a specific feature, refusing it means that feature is unavailable, but it never removes your access to the remaining service.

4.4 Legitimate interests

Where we rely on legitimate interests, we have assessed that the processing is necessary for a legitimate interest — such as keeping the service secure, preventing fraud, understanding aggregate usage, or administering our business — and that the interests do not override your rights. Because our interests may differ from yours, you can ask us to explain the balancing test and to stop the processing, and you can object on grounds relating to your particular situation. Write to support@hengzhid.com.

5. Sharing, Disclosure and Processors

5.1 Categories of recipients

We share personal information only with the categories of recipient described below, and only for the purposes described in Chapter 3. We do not sell personal information.

5.2 Advertising networks and ad exchanges

Our app and website integrate third-party advertising SDKs. Those providers receive device identifiers, IP address, coarse location, app and site activity, ad-interaction events and, where you have consented, advertising identifiers so that they can select and measure advertisements. The full list of providers and their own opt-out controls appears in Chapter 9. Each provider acts as an independent controller for the data it collects for its own purposes, and is responsible for its own compliance.

5.3 Service providers and processors

We engage service providers that host and secure our infrastructure, deliver email, provide customer-support tooling, maintain app-store listings, run crash and analytics tooling, and supply shipping, customs and trade-compliance data services. They process personal information on our documented instructions, are bound by data protection terms consistent with Chapter 4 and Chapter 6, and may not use the information for their own purposes.

5.4 App stores and payment processors

Apple and Google act as the distributors of the app and, where a purchase is made, as the billing agent. They process your account, payment and device information under their own privacy policies and their own terms, which are accessible from the app listing. Where a purchase is made, we receive confirmation of the transaction — typically the product identifier, the price, the currency and the transaction reference — but not your full payment card details.

5.5 Trading counterparties, carriers and authorities

Where you instruct us to trade, we share the information required to perform that instruction with the counterparties, freight forwarders, customs authorities, banks and insurers involved in the transaction. We also disclose information where we are required to do so by law, by a competent regulator, or by a court of competent jurisdiction, and we will notify you unless we are prohibited from doing so.

5.6 Corporate and business transfers

Personal information may be disclosed in connection with a merger, acquisition, financing, reorganisation or sale of assets involving EZEDON. In that case, we will require the recipient to honour the data protection obligations set out in this Policy, and we will give you notice before your information becomes subject to a different policy.

5.7 Your choices

You can limit disclosure to advertising networks by using the controls in Chapter 9, by limiting ad tracking on your device, and by declining the optional permissions described in Chapter 2. You can also ask us to confirm the categories of third parties we have disclosed your personal information to in the preceding 12 months.

6. International Data Transfers

6.1 Where we operate

EZEDON is established in the Hong Kong Special Administrative Region and our operational systems are hosted in Hong Kong and in approved service-provider regions, including the United States, Singapore, the European Economic Area, mainland China and Japan. Our advertising providers operate globally, so advertising-related data may be processed in additional countries. The transfer of information outside Hong Kong is necessary to deliver the service you have asked for and to operate a business engaged in cross-border trade.

6.2 Safeguards for transfers

Where personal information is transferred outside the applicable jurisdiction, we rely on one or more of the following:

• an adequacy decision issued by the relevant authority, recognised as providing an essentially equivalent level of protection;
• Standard Contractual Clauses adopted by the European Commission, together with a transfer impact assessment and supplementary measures where required;
• the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, for transfers subject to the UK GDPR;
• binding corporate rules or an approved certification mechanism where we are a member of a group that has adopted them;
• the Personal Information Protection (Cross-border Flow) Measures in mainland China, including the standard contract or certification route and any security assessment required by the PIPL.

6.3 Transfer risk assessments and supplementary measures

Before transferring personal information we assess the laws and practices of the destination country against the relevant standard, and we apply supplementary measures — encryption in transit and at rest, pseudonymisation, access restriction, and contractual limits on onward transfers — where we identify a residual risk. Where we cannot provide an appropriate safeguard, we do not transfer the affected information and instead restrict the feature that requires it.

6.4 Your control

You may request information about the countries to which your personal information has been transferred, the safeguard relied on, and a copy of the relevant transfer documentation, by writing to support@hengzhid.com. Depending on where you live, you may also have the right to object to a transfer on the basis of your particular situation.

7. Data Retention

7.1 Retention principles

We keep personal information only for as long as we need it for the purpose for which it was collected, and then delete or irreversibly anonymise it. Where a statutory period applies — for example, Hong Kong's tax and business-records requirements — we keep the information for that period and no longer. Where deletion is not technically practicable — for example within aggregated analytics — we anonymise the data so that it can no longer be attributed to you.

7.2 Deletion and legal holds

Where we delete personal information, we remove it from production systems and from backups on the routine backup rotation cycle. Where a dispute, investigation or legal proceeding is pending, we suspend deletion for the affected records until the matter is resolved, and we will inform you where the law allows us to do so.

8. Security Measures

8.1 Technical and organisational measures

We apply a combination of technical and organisational safeguards appropriate to the nature of the information, including:

• TLS encryption for data in transit across the website, app APIs and administrative access;
• encryption at rest for account credentials, commercial documentation and backups;
• role-based access control with least-privilege permissions, multi-factor authentication for administrative accounts, and periodic access reviews;
• separation of production and development environments, and pseudonymisation of production data used in testing;
• dependency and patch management, code review, and static analysis of the app and web builds before release;
• logging, monitoring and alerting for anomalous access or exfiltration, with regular testing of our incident response plan.

8.2 Mobile app security

The app communicates with our servers over encrypted channels, stores only the minimum necessary data in local storage, requests the narrowest set of runtime permissions it needs, and does not embed secrets in the binary. Ad SDKs integrated into the app operate in their own sandboxes and do not have access to your account credentials or your commercial records.

8.3 Your responsibilities

You are responsible for keeping your account credentials confidential, for signing out of shared devices, and for notifying us promptly if you believe your account has been compromised. Write to support@hengzhid.com if you suspect unauthorised access.

8.4 Personal data breaches

If we become aware of a personal data breach, we will investigate it without undue delay, take steps to contain and remediate it, and notify the competent supervisory authority within the statutory period — 72 hours where the GDPR or UK GDPR applies, and the equivalent period under the PDPO, LGPD and other regimes. Where the breach is likely to result in a high risk to your rights and freedoms, we will inform you directly and provide the information you need to take protective action.

8.5 No absolute security

No method of transmission or storage is completely secure. We are constantly reviewing and updating our safeguards, but you should not supply sensitive personal information through the contact form or in app fields where it is not required for the enquiry.

9. Advertising and Monetisation

9.1 How advertising supports our services

The mobile management app and much of the content on the website are provided free of charge. A substantial part of our revenue comes from advertising, so the app integrates third-party advertising SDKs. Advertising is what allows the app to remain free for small and medium-sized trading businesses that would otherwise not be able to justify a management tool. In exchange, the app displays advertisements — and the data generated by ad delivery and measurement is governed by this chapter and by Chapter 4.

9.2 Advertising SDKs, mediation and ad exchanges

The app integrates advertising SDKs published by the networks listed in section 9.8, together with mediation platforms that decide which network fills each placement. In a typical request, an SDK sends the following to the selected network: your device model, operating system and app version, screen resolution, language, IP address, a coarse location, the advertising identifier (where permitted), the placement identifier, and an event timestamp. The response is a creative — an image, video or playable ad — that the SDK renders in the app.

Ad mediation means several networks may bid for the same placement. Only the winning network receives the request and renders the ad, but the mediation platform and participating networks may each retain their own logs of the bid. The mediation platform is responsible for enforcing your consent and opt-out signals across all participating networks; if you observe advertising that you believe ignores your choices, please report it to support@hengzhid.com.

9.3 Personalised and non-personalised advertising

Personalised (targeted) advertising uses information about you — such as your activity inside the app, the content you have viewed, the advertising identifier, your approximate location and your inferred interests — to select an advertisement intended to be more relevant to you. Personalised advertising is only served where the law permits it: on a consent basis in the EEA, the UK, Switzerland and other consent jurisdictions, and on an opt-out basis in jurisdictions such as California and the other US state regimes described in Chapter 4, unless you have affirmatively opted in.

Non-personalised (contextual) advertising is selected using the content of the screen you are looking at, the country or region you are in, and your device type. It does not build a profile of you and does not require your advertising identifier. When you decline personalised advertising, or withdraw your consent, the app falls back to contextual advertising. We do not use sensitive categories of information for advertising targeting, and we do not use your commercial or trade documentation for advertising purposes.

9.4 Consent under the GDPR, ePrivacy rules, UK PECR and CCPA/CPRA

In the European Economic Area, the United Kingdom, Switzerland and other jurisdictions that require prior consent for storing or accessing information on your device, we present a consent notice before any non-essential cookie, similar technology, advertising identifier or personalised advertising is set. We use a consent management platform to record your choice, and the signal is transmitted to every advertising SDK and mediation partner before any ad request is made. Your consent is granular: you can accept or refuse each advertising and analytics category separately.

In the United States, the CCPA/CPRA and the state laws listed in Chapter 4 do not require a consent model for general data collection, but they do require that we honour an opt-out of sale, sharing and targeted advertising. We therefore recognise the Global Privacy Control signal described in Chapter 15, we honour opt-out preference signals transmitted by participating ad networks, and we provide the "Do Not Sell or Share My Personal Information" control described in Chapter 12. We do not knowingly sell or share the personal information of anyone under 16 for cross-context behavioural advertising.

9.5 Apple App Tracking Transparency and the IDFA

On iOS, the Identifier for Advertisers (IDFA) is a device identifier that Apple requires us to declare as "tracking" in our privacy manifest. Our app therefore presents the App Tracking Transparency (ATT) system prompt on first launch, explaining why the identifier would be used. If you allow the request, the IDFA may be used for advertising and analytics as described in this chapter. If you disallow it, the IDFA is not accessed, the app requests no IDFA value, and you receive contextual advertising only. You can change your answer at any time in Settings → Privacy & Security → Tracking on your device, and we respect that change at the next app launch. Where Apple's ATT prompt is not required (for example, on non-Apple platforms) we apply the equivalent consent gate described in section 9.4.

9.6 Google's Advertising ID and Android advertising permissions

On Android, the Google Advertising ID (AAID) is a resettable identifier used by Google advertising products. Where the app is distributed through Google Play, we declare the data use in the Google Play Data Safety form and we obtain the required advertising permissions. Android 13 and later present a permission prompt for advertising ID access, and a user who declines it is served contextual advertising only. Users can also reset the AAID or enable "Delete advertising ID" in Android Settings → Privacy → Ads, and we honour the resulting "limit ad tracking" signal by suppressing personalised advertising and by omitting the identifier from ad requests.

9.7 Opt-out and limited ad tracking controls

You can reduce or stop personalised advertising in several independent ways, and combining them gives you the strongest control:

• refuse or withdraw consent in the app's privacy settings or through the website consent banner;
• decline the App Tracking Transparency prompt on iOS, or later change the answer in system settings;
• decline the advertising permission on Android, enable "Delete advertising ID", or limit ad tracking;
• opt out of interest-based advertising in your Google, Meta, Amazon, Apple and other account settings using the links in the table below;
• opt out of the sale or sharing of personal information for cross-context behavioural advertising through our "Do Not Sell or Share" control, described in Chapter 12;
• send a Global Privacy Control signal, described in Chapter 15;
• clear the app's local data and advertising identifiers in your device settings.

9.8 Advertising platforms used in our services

The table below lists the advertising networks whose SDKs are integrated in the app or whose platforms are used for website advertising, the purpose of each integration, and the vendor's own control where you can opt out of personalised advertising. We review this list at least annually and whenever the SDK set changes.

Opting out with one provider does not automatically opt you out of every provider. If you want to be removed from personalised advertising across the ecosystem, use the opt-out link for each provider in the table above, or install a recognised opt-out preference platform in your browser. For mobile devices, the operating-system controls described in sections 9.5 and 9.6 are the most reliable single switch, because they are enforced at the SDK level.

9.9 Rewarded advertising and reward fulfilment

When you choose to watch a rewarded video to unlock a feature, the SDK records that the impression occurred, that the video started, and that it completed. To grant the reward we need to know only that the placement completed — we do not need your identity, your order history or your account password to do so, and we do not share your commercial data with the reward provider. Reward fulfilment is stored against a temporary, randomised reward token rather than your advertising identifier, so that completing a rewarded video cannot be used to build an advertising profile of you.

9.10 What we do not share with advertisers

We do not provide advertisers with your name, your email address, your telephone number, your account credentials, or the contents of your commercial and trade documentation. Advertisers receive aggregated campaign statistics — impressions, clicks, completion rates and conversion counts — that are not linked to you individually.

9.11 Advertising and children

The app is not directed at children and is not designed for them. We do not serve personalised advertising to users we know to be under 13, and we do not knowingly collect advertising identifiers from children. Where a store age rating indicates the app may be used by minors, contextual advertising is served only. Chapter 13 sets out our age policy in full.

9.12 Advertising measurement and fraud prevention

Advertising measurement necessarily involves counting impressions and detecting invalid traffic. These activities require the device and network information listed in section 9.2, and we apply frequency capping, exclusion lists for sensitive categories, and automated invalid-traffic filtering. Measurement data is retained for the periods set out in Chapter 7 and is not used to build an advertising profile beyond what the relevant consent or opt-out permits.

10. Advertising Formats and User Controls

The app uses four advertising formats. Each is described below with what it is, when it appears, and the controls you have over it.

10.5 Native and other placements

Occasionally a network may deliver a native advertisement that is formatted to match the surrounding content. Native advertisements are clearly labelled as "Ad" or "Sponsored", they are never presented as editorial content, and they are subject to the same consent and opt-out rules as the formats above. We do not use sponsored content in our own editorial material without a visible advertisement label.

10.6 Your controls over advertising formats

• the app's privacy settings allow you to disable personalised advertising and to reset the consent state without reinstalling;
• the operating-system controls in sections 9.5 and 9.6 apply to every format at once, because they act on the identifier rather than on the placement;
• frequency caps mean that declining one format does not necessarily remove another, so the identifier-level controls are the most complete option;
• where you have asked us not to be contacted for marketing, we apply that instruction to our own business communications as well as to advertising we serve on our behalf.

11. Cookies and Similar Technologies

11.1 What cookies and similar technologies are

Cookies are small text files placed on your device by a website. Similar technologies include local storage, session storage, pixels, beacons, SDK identifiers and URL parameters that perform the same function of storing or reading information on your device. In the app, the equivalent technologies are the advertising identifier, the app's local preference storage, and the attribution tokens used to link an install to a campaign.

11.2 Categories we use

11.3 Managing cookies in the app

The app does not use advertising cookies. It uses the advertising identifier, which is a device-level identifier rather than a cookie, together with local storage for preferences and the consent state. You can reset the identifier and clear local app data from your device settings, and you can reset the consent state from within the app.

11.4 Consent management

Where consent is required, it is collected through a consent management platform that records the purpose, the vendor list and the timestamp of your decision, and that transmits the resulting signal to every advertising SDK before an ad request is made. Rejecting all optional categories is a valid choice and does not degrade the core service, though the app will then show contextual advertising only and will provide less detailed usage statistics to us.

12. Your Regional Privacy Rights

12.1 Overview

Depending on where you live, you may hold rights to access, correct, delete, restrict, object to, or port your personal information, and to withdraw consent. We apply these rights on a single operational standard across all of the regions below, so that a request is handled in the same way wherever you are. We never charge a fee for a reasonable request and we never require you to create a new account to make one.

12.2 The "Do Not Sell or Share" control

Where the CCPA/CPRA or a similar state law applies, we provide a control through which you can opt out of the sale or sharing of your personal information for cross-context behavioural advertising, and through which you can limit the use of sensitive personal information. Where you exercise this control, we will also treat it as a Global Privacy Control signal under Chapter 15 and apply it across our advertising providers. The control is available in the app's privacy settings and through the website consent banner, and you can also request it by writing to support@hengzhid.com.

12.3 Verification of identity

Before we act on a request we take reasonable steps to verify that the requester is the person whose information is concerned. Depending on the sensitivity of the information, we may ask you to confirm control of the registered email address, to provide the transaction or order reference, or to confirm a small amount of information we already hold. We will not ask for excessive identification information, and we will not discriminate against you for exercising a right.

12.4 Complaints and appeals

If you are unhappy with how we have handled a request, write to support@hengzhid.com and we will escalate the matter to our privacy lead, who will review the decision and respond in writing. Where the law gives you a right of appeal — as it does in Colorado, Connecticut and several other US states — we will tell you that right in our response. You also retain the right to complain to your local supervisory authority at any time.

12.5 Response times

We aim to acknowledge every request within three business days and to resolve it within the period required by the law that applies to you — one month under the GDPR and UK GDPR, 30 days under the PDPA, and 45 days under the CCPA/CPRA and most US state statutes, extendable where the law allows. We do not charge for a request unless it is manifestly unfounded or excessive, and we will explain any charge before it is incurred.

13. Children's Privacy and Age Policy

13.1 Children under 13 (COPPA)

The Children's Online Privacy Protection Act (COPPA) restricts the collection of personal information from children under 13 in the United States. EZEDON does not knowingly direct any part of the website or the app to children under 13, we do not knowingly collect personal information from a child under 13, and we do not knowingly allow a child under 13 to create an account. If you believe a child has provided us with personal information, write to support@hengzhid.com; we will verify the report and delete the information promptly, and we will remove it from our backups on the next rotation cycle.

13.2 Children under 16 (GDPR-K and the digital consent age)

The GDPR prohibits the offering of information society services to a child where consent is required and the child is below the digital consent age of the Member State — 13 in some Member States and 16 in others, and 13 in the United Kingdom. The app is not designed or marketed for children, and we do not knowingly collect personal data from a child below the applicable digital consent age. Where we learn that such data has been collected, we delete it.

13.3 Store age ratings

Our listings carry an age rating that reflects the content and data handling of the app. We do not distribute a build that is rated for children on the "Designed for Families" or child-directed programme, because the app includes advertising and business-management features intended for adults. The App Store age rating and the Google Play target audience and content rating are displayed on each listing, and the age rating displayed on the store you downloaded from is the age rating we have set. We re-assess the rating whenever the app's data practices change in a way that would affect it.

13.4 Families and parental controls

We do not operate a child-directed service and we do not run child-directed advertising. We do not knowingly serve personalised advertising to users under 13, and we do not knowingly collect advertising identifiers from children. Parents who believe a child has installed the app or created an account should write to support@hengzhid.com and we will close the account and delete the associated data.

13.5 Minimum age for the services

Consistent with the Terms of Service, you must be at least 18 years old, or the age of majority where it is higher, to enter into a contract with EZEDON. Where a user acts with the authorisation and consent of a parent or guardian, that parent or guardian is the contracting party and is responsible for the account.

14. App Store and Platform Compliance

14.1 Apple App Store Review Guidelines

The app is submitted to, and operates under, the Apple App Store Review Guidelines. In particular, we comply with Guideline 1.4 (Privacy — data collection and storage, including the requirement that apps obtain explicit permission before tracking users and the requirement to provide an accessible privacy policy link in App Store Connect), Guideline 1.2 (User Generated Content), Guideline 3.1.1 (In-App Purchase), Guideline 3.2.2 (unacceptable business models), Guideline 4.2 (minimum functionality), Guideline 4.3 (spam and repetitive content) and Guideline 5.1.1 (Data Collection and Storage) and Guideline 5.1.2 (Data Use and Sharing). Our App Privacy label is kept consistent with the practices described in this Policy, and we re-review it before every release that changes data collection.

14.2 Google Play Data Safety

The Google Play Data Safety form for the app declares every category of data collected and shared, whether the collection is optional or required, whether the data is encrypted in transit, whether users can request deletion, and the purposes of collection. Our declarations match the practices described in this Policy, including the treatment of advertising identifiers, location, app activity and diagnostics. Where a new data type is added, the Data Safety form is updated in the same release in which the collection begins.

14.3 Google Play Families policy and the Apple Kids Category

The app is not designed for children and is therefore not enrolled in the Google Play Families programme, and it is not submitted to the Apple Kids Category. We do not use third-party advertising SDKs that are not certified for child-directed use, and we do not permit child-directed advertising configuration in the app. If we ever publish a child-directed product in the future, it will be a separate listing with its own data handling, its own advertising configuration restricted to certified child-appropriate providers, and its own privacy policy.

14.4 Account deletion

You can delete your account at any time from within the app, or by writing to support@hengzhid.com from the registered email address. Where you delete your account, we delete your account profile and associated personal information from production systems, and we delete it from backups on the next rotation cycle. We may retain information that we are required to keep by law — for example trade and customs records under Chapter 7 — and we will tell you if that is the case.

14.5 Privacy choices and advertising transparency

The app publishes an app-ads.txt file listing the advertising sellers authorised to serve ads through the app, as required by the IAB Tech Lab advertising transparency standard. The app also honours the advertising identifier and permission signals described in sections 9.5 and 9.6, and it registers the attribution platforms used for install measurement with their own industry registries.

15. Do Not Track and Global Privacy Control

15.1 Do Not Track

Legacy "Do Not Track" (DNT) headers are not a standard and are not uniformly honoured across the industry, and for that reason browsers have largely replaced them with the Global Privacy Control. We do not treat the absence of a DNT header as a request to be tracked, and we do not treat the presence of a DNT header as a legally binding opt-out under the GDPR or the CCPA/CPRA. We do, however, record the DNT preference and apply it as a signal where it is straightforward to do so, and we treat it as equivalent to a request for non-personalised advertising.

15.2 Global Privacy Control

The Global Privacy Control (GPC) is a browser signal that asks a website to opt the user out of sale or sharing of personal information for cross-context behavioural advertising. We recognise the GPC signal on hengzhid.com, and we treat it as a valid opt-out request for the purposes of the CCPA/CPRA and the US state laws listed in Chapter 4. Where the GPC signal is present, we do not sell or share your personal information for cross-context behavioural advertising, we suppress personalised advertising, and we propagate the signal to our advertising SDKs, mediation partners and downstream demand sources so that it is honoured across the ecosystem rather than only on our own properties.

15.3 Other signals and preferences

We also honour the opt-out preference signals exchanged through advertising preference platforms and the industry-wide vendor lists used by participating ad networks, including the AboutAds and IAB Europe vendor lists. Where you have expressed a choice to one of our advertising providers, we will treat it as a choice to us and will apply it to the placements we control.

16. Changes to This Policy

16.1 How we notify you of changes

We update this Policy when our practices change, when the law changes, or when we introduce a new SDK or provider. For a material change — a new category of data collected, a new purpose, a new category of recipient, or a change to the lawful basis — we will give prominent notice in the app, by email to registered account holders, or by a notice on hengzhid.com, at least 14 days before the change takes effect where the law requires advance notice.

16.2 Version control

Each version is dated and identified by a version number, and we will publish prior versions on request. The current version is always the one published on hengzhid.com.

16.3 Continued use

Where we ask for your consent to a new processing activity and you do not consent, the new activity does not begin and the service continues to operate on the basis of your existing choices. We will not make continued use of the service conditional on agreeing to a change that is not required by law.

17. Contact Us

17.1 Privacy enquiries and rights requests

For any question about this Policy, or to exercise a right described in Chapter 12, contact us at support@hengzhid.com. Please put "Privacy" or "Data subject request" in the subject line so that your message reaches the right team promptly.

17.2 Account and commercial correspondence

For account administration, invoice and trade documentation enquiries, and for the key accounts team, write to liulu@hengzhid.com.

17.3 Our registered address

HK EZEDON CO., LIMITED
Room 701 (Unit 127), 7/F, Tower B, New Mandarin Plaza,
14 Science Museum Road, Tsim Sha Tsui East, Hong Kong

17.4 Website

Our website is published at hengzhid.com. Our Terms of Service, which govern your use of the website and the app, are published at hengzhid.com/terms.html.

17.5 Complaints

If you are not satisfied with our response, you may contact your local data protection authority. We would rather resolve the concern with you first, so please write to support@hengzhid.com in the first instance.

18. Effective Date

18.1 Date of this version

Last updated: [Effective Date]

18.2 First publication

This is the first published version of the HK EZEDON privacy policy. It replaces no previous policy and no previous notice. The version number, the effective date and the date of last review are shown in the metadata line at the top of this document and are updated whenever the policy changes.