Privacy Policy
Effective date: November 7, 2026 · Last updated: November 7, 2026
This Privacy Policy explains how SwiftCart Media Limited ("SwiftCart Media", "we", "us" or "our") collects, uses, shares, stores and deletes personal data when you:
- visit our website at swiftcartmedia.com (the "Website");
- contact us by email or phone; or
- work with us as a client, a prospective client or a supplier (our "Client Services").
This policy also serves as our Personal Information Collection Statement under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and as our privacy notice under the EU and UK General Data Protection Regulation ("GDPR").
Apps are not covered by this policy. Each app we build or publish has its own privacy policy, which you can find in the app and on its App Store or Google Play page.
1. Who is responsible for your data
The data controller (data user under the PDPO) responsible for your personal data is:
SwiftCart Media Limited
Unit B, 3/F., Kai Wan House, 146 Tung Choi Street, Mongkok, Kowloon, Hong Kong
Email: privacy@swiftcartmedia.com
Phone: +43 677 63882574
Requests and questions about personal data are handled by our Privacy Officer at the address and email above.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Contact details | Name, job title, company name, email address, phone number | You, when you contact us or become a client |
| Communications | Emails, call notes, meeting notes and messages exchanged with us | You and our team |
| Project information | Requirements, designs, documents, files, and test or staging account details you share for a project | Clients |
| Billing information | Billing contact, company address, invoices, payment records. We do not store full card numbers. | Clients and our payment providers |
| Supplier information | Contact and payment details of freelancers and suppliers | Suppliers |
| Technical data | IP address, browser type and pages requested, logged by our hosting provider for security | Collected automatically when you visit the Website |
We do not ask for sensitive personal data, such as health, biometric, racial or religious information. Please do not send it to us.
3. Why we use your data
- To reply to your enquiries and prepare proposals.
- To plan, deliver, test, publish and maintain client projects.
- To manage our relationship with clients and suppliers, including contracts, invoicing and payments.
- To keep the Website secure and working.
- To send service messages about your project. We send marketing emails only if you opt in, and you can opt out at any time.
- To meet legal, tax and accounting obligations, and to establish or defend legal claims.
We use your data only for these purposes or directly related ones, and we will ask for your consent before using it for any new, unrelated purpose. We do not sell your personal data, and we do not make decisions about you based solely on automated processing.
4. Legal bases (EEA and UK)
- Contract: to prepare and perform an agreement with you or your company.
- Legitimate interests: to reply to enquiries, run our business, and keep the Website and our systems secure. You can object at any time.
- Consent: for marketing emails. You can withdraw consent at any time.
- Legal obligation: to keep tax and accounting records and to respond to lawful requests.
5. Is providing data required?
Giving us personal data is voluntary. However, we need your contact details to reply to you, and we need billing details to enter into and perform an agreement with you. If you don't provide them, we may not be able to answer your enquiry or work with you.
6. Who we share data with
- Service providers that host our Website, email and files, or provide project management, accounting and payment services. They may use the data only to provide services to us, under contracts that require them to protect it to a standard at least equal to this policy.
- Subcontractors who help us deliver a client project, under confidentiality obligations, and only with the data they need.
- Professional advisers such as accountants, auditors and lawyers, under confidentiality obligations.
- Authorities, when the law or a valid legal process requires it.
- A buyer or successor, if our business is reorganised, merged or sold. Your data would remain protected by this policy.
We do not share personal data with anyone else without your consent.
7. Data we handle for clients
When we build or maintain software for a client, we may access personal data of the client's own users, for example in a database or test environment. When we do, we act as a data processor on the client's behalf. We follow the client's instructions, keep the data confidential, protect it with appropriate security measures and delete or return it at the end of the project. The client's own privacy policy applies to that data, not this one. We are happy to sign a data processing agreement on request.
8. Website, cookies and Do Not Track
Our Website is an information site. It does not use advertising, tracking or analytics cookies, and it has no forms that collect personal data. Our hosting provider, Cloudflare, processes technical data such as IP addresses to deliver the Website and protect it from attacks, and may set strictly necessary security cookies.
Do Not Track: the Website does not track visitors, so it treats every visit as if a Do Not Track or Global Privacy Control signal had been sent.
9. How long we keep data
| Data | Retention period |
|---|---|
| Enquiries that don't lead to a project | Up to 24 months after the last contact |
| Client project communications and files | For the project and any maintenance period, then up to 3 years |
| Contracts, invoices and accounting records | 7 years, as required by Hong Kong tax and accounting law |
| Client users' data accessed during a project | Deleted or returned at the end of the project, or earlier on the client's instruction |
| Website security logs (held by our hosting provider) | Short periods, typically no more than 30 days |
10. How we protect data
- The Website and our email are encrypted in transit (HTTPS/TLS).
- We store data with reputable providers that encrypt it at rest.
- Only people who need access for their work can see personal data, and accounts are protected by strong passwords and two-factor authentication.
- Client credentials and confidential files are stored in access-controlled systems and are not shared beyond the project team.
- If a data breach is likely to put you at risk, we will tell you and the relevant authorities as the law requires.
11. International transfers
We are based in Hong Kong, and our service providers may process data in other countries, including the United States and the European Union. When we transfer personal data out of the EEA, the UK or Hong Kong, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses or equivalent contractual protections.
12. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and get a copy of it;
- Correct personal data that is inaccurate or incomplete;
- Delete your personal data;
- Restrict or object to certain processing, including direct marketing;
- Data portability;
- Withdraw consent at any time where we rely on it;
- Complain to a data protection authority, such as the Office of the Privacy Commissioner for Personal Data, Hong Kong, or the supervisory authority in your country.
How to make a request: email privacy@swiftcartmedia.com or write to our Privacy Officer at the address in section 1. We may need to confirm your identity first. We respond within 30 days, and in any event within the 40 days allowed by the PDPO. We don't normally charge a fee. The PDPO allows us to charge a fee not exceeding our direct costs for repeated or unusually large requests, and we would tell you the amount first.
13. California residents
We do not sell or share personal information for cross-context behavioural advertising. In the last 12 months we have collected the categories described in section 2 (identifiers, contact and professional information, commercial information and internet activity) for the purposes in section 3, and shared them only as described in section 6. You may request access to, correction of or deletion of your personal information by emailing privacy@swiftcartmedia.com, and we will not discriminate against you for doing so.
14. Children
The Website and our Client Services are intended for businesses and adults. They are not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.
15. Changes to this policy
We may update this policy from time to time. We will post the new version on this page and change the "Last updated" date. If changes are significant, we will notify current clients by email.
16. Contact us
SwiftCart Media Limited — Attn: Privacy Officer
Unit B, 3/F., Kai Wan House, 146 Tung Choi Street, Mongkok, Kowloon, Hong Kong
Email: privacy@swiftcartmedia.com
Phone: +43 677 63882574