1. Personal Information Collection Statement (PICS)

In accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of the Laws of the Hong Kong Special Administrative Region ("PDPO"), this Personal Information Collection Statement (PICS) informs you of the purposes for which your personal data will be collected and used by EasyCart (operated by LET IT CONNECT INTERNATIONAL LIMITED, "we", "us", or "our"), the classes of persons to whom your personal data may be transferred, your rights to access and correct your personal data, and other relevant information.

1.1 Purposes of Collection

We collect your personal data for the following primary purposes:

• To register and manage your user account with EasyCart.
• To process, fulfill, and deliver your orders for products and services.
• To process payments for your purchases and handle billing or refunds.
• To provide customer support, respond to your inquiries, and manage complaints.
• To personalize your shopping experience and recommend products or services that may interest you.
• To communicate with you regarding your account, orders, and important service-related updates (e.g., order confirmations, shipping notifications, changes to our terms or policies).
• For direct marketing purposes, but only where we have obtained your explicit consent (see Section 1.4 below).
• To improve our website, services, and overall user experience, including through data analysis (we will use anonymized or aggregated data for this purpose where feasible).
• To prevent and detect fraud, and to ensure the security of our Services.
• To comply with applicable laws, regulations, and legal obligations in Hong Kong.

1.2 Mandatory or Voluntary Supply of Data & Consequences

When we collect personal data from you, fields marked with an asterisk (*) or otherwise indicated as mandatory are data that you must provide if you wish to use a particular service or complete a transaction. If you choose not to provide such obligatory data, we may not be able to:

• Complete your registration or manage your account.
• Process or deliver your order.
• Respond to your inquiries effectively.

The supply of personal data in fields not marked as mandatory is voluntary. Failure to provide voluntary data will generally not affect your ability to use our core services, though some features or personalization might be limited.

1.3 Classes of Transferees

Your personal data may be disclosed or transferred to the following classes of persons (who may be located within or outside Hong Kong) for the purposes outlined in Section 1.1:

• Service Providers: Third-party service providers who assist us in our business operations, including:
  • Payment processors.
  • Delivery and logistics partners.
  • IT and system administration service providers (e.g., cloud hosting providers , website developers, data analytics providers).
  • Customer support service providers.
• Marketing Partners: Companies that help us with our marketing efforts (e.g., email marketing platforms, advertising partners).
• Professional Advisors: Our lawyers, auditors, and insurers, when necessary for them to provide services to us.
• Government and Regulatory Authorities: Any government department, regulatory authority, law enforcement agency, or court to whom we are required to disclose personal data under applicable law or in connection with legal proceedings.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred as part of that transaction.

For more details on data transfer, especially outside Hong Kong, please refer to Section 2.6 of our Privacy Policy Statement below.

1.4 Direct Marketing

We intend to use your personal data for direct marketing, but we can only do so with your explicit consent. This means we would like to send you information about products, services, special offers, and events from EasyCart.

The kinds of personal data we would use for direct marketing include your name, email address, contact number, purchase history.

If you agree to receive direct marketing from us, please indicate your consent by ticking an explicit opt-in box on our registration or checkout page, or within your account preferences. Your consent for direct marketing is separate from agreeing to our general terms and conditions.

You can opt-out of receiving direct marketing communications at any time, free of charge, by:

• Clicking the "unsubscribe" link in any marketing email you receive from us.
• Updating your marketing preferences in your account settings on our website (if available).
• Contacting our Data Protection Officer at [email protected] or using the contact details provided in Section 2.2 of our Privacy Policy Statement.

Once we receive your request to opt-out, we will cease to use your personal data for direct marketing purposes as soon as reasonably practicable.

1.5 Your Data Access and Correction Rights

You have the right to request access to the personal data we hold about you and to request the correction of any personal data that is inaccurate. To exercise these rights, please submit your request in writing to our Data Protection Officer at [email protected] or using the contact details provided in Section 2.2 of our Privacy Policy Statement.

We may ask you to provide proof of your identity to process your request. We will respond to your Data Access Request (DAR) or Data Correction Request (DCR) within 40 days of receiving it, as required by the PDPO.

A reasonable fee may be charged for complying with a DAR to cover our administrative costs. We will inform you of any applicable fee before processing your request. There is no fee for a DCR.

In certain circumstances, as permitted by the PDPO, we may refuse your request (e.g., if fulfilling the request would reveal personal data about another individual without their consent, or if the data is subject to legal professional privilege).

1.6 Further Information

This PICS provides key information about the collection of your personal data. For more comprehensive details on how we handle your personal data, including the types of data we collect beyond initial collection points, our data retention practices, security measures, and other important aspects of our privacy practices, please refer to our full Privacy Policy Statement (PPS) below.

2. Privacy Policy Statement (PPS)

2.1 Our Commitment to Your Privacy

This Privacy Policy Statement ("PPS") outlines the commitment of EasyCart (operated by LET IT CONNECT INTERNATIONAL LIMITED, "we", "us", or "our") to safeguarding the privacy, confidentiality, and security of the personal data we collect, use, hold, and process. We adhere to the requirements of the Personal Data (Privacy) Ordinance (Cap. 486) of the Laws of the Hong Kong Special Administrative Region ("PDPO").

2.2 Our Identity and How to Contact Us

EasyCart is operated by:

If you have any questions about this Privacy Policy Statement, our privacy practices, or if you wish to exercise your rights regarding your personal data, please contact our Data Protection Officer (or designated contact person):

2.3 Scope of This Policy

This PPS applies to all personal data collected, held, processed, or used by EasyCart through our website (https://admin.easycart.shop), mobile application (EasyCart AI 助手), and other related services (collectively, the "Services").

2.4 Types of Personal Data We Hold

In addition to data collected as per our PICS, the types of personal data we may hold include, but are not limited to:

• Identity and Contact Data: Your name, email address, telephone number, shipping address, and billing address. For merchants or business partners, this may include business registration details and professional information.
• Account Data: Your username, password (which will be stored in a hashed format), purchase history, wish lists, product preferences, and communication records with us.
• Transaction Data: Details about products and services you have purchased from us or sold through our platform (if applicable), payment transaction details (e.g., transaction ID, date of transaction. Note: We do not store your full credit card details; these are processed by our secure third-party payment gateway).
• Technical Data: Internet Protocol (IP) address, browser type and version, device identifiers, operating system, platform, location data (if enabled), and other technology on the devices you use to access our Services.
• Usage Data: Information about how you use our website and Services, such as pages visited, time spent on pages, links clicked, Browse history, and search queries.
• Marketing and Communications Data: Your preferences in receiving marketing from us and our third parties (where applicable and consented to), and your communication preferences.

2.5 How and Why We Use Your Personal Data

We will only use your personal data for the purposes for which it was collected, as outlined in our PICS (Section 1.1), or for directly related purposes, unless we have obtained your explicit and voluntary consent for a new purpose, or if the use is otherwise permitted or required by law. These purposes broadly cover:

• Service Delivery: Including account creation, order processing, payment facilitation, delivery, and managing returns or refunds.
• Customer Support: Responding to your inquiries, feedback, or complaints.
• Service Improvement and Personalization: Analyzing usage data to improve our platform, develop new features, and personalize content or product recommendations.
• Marketing Communications: Sending you information about our products, services, and promotions, subject to your explicit consent as detailed in Section 1.4 of the PICS.
• Security and Fraud Prevention: Protecting our platform, users, and business from fraudulent activities and security threats.
• Legal and Regulatory Compliance: Fulfilling our legal obligations, responding to lawful requests from authorities, and enforcing our terms and conditions.

2.6 Disclosure and Transfer of Your Personal Data

As mentioned in the PICS (Section 1.3), we may share your personal data with various classes of transferees. This section provides further details, especially concerning data processors and cross-border transfers.

Data Processors: When we engage third-party service providers (data processors) to process personal data on our behalf (e.g., cloud hosting, payment processing), we use contractual or other means to ensure they provide a comparable level of protection to the personal data as we do, and that they comply with the requirements of the PDPO. This includes ensuring they have adequate security measures and only process data for the purposes we specify.

Transfer of Personal Data Outside Hong Kong: Some of our service providers or affiliates may be located or process data in jurisdictions outside of Hong Kong. If we transfer your personal data outside of Hong Kong, we will take appropriate steps to ensure that your personal data continues to receive a standard of protection that is at least comparable to that provided under the PDPO. These steps may include:

• Using model contractual clauses approved by the Privacy Commissioner for Personal Data (PCPD).
• Ensuring the recipient jurisdiction has in force any law which is substantially similar to, or serves the same purposes as, the PDPO.
• Obtaining your explicit consent for the transfer after informing you of the risks involved.

2.7 Accuracy and Retention of Your Personal Data

Accuracy: We take all reasonably practicable steps to ensure that the personal data we collect, use, and hold is accurate, complete, and up-to-date for the purposes for which it is to be used. You can help us maintain accurate data by keeping your account information current. You may update your personal data through your account settings or by contacting us as detailed in Section 2.2.

Retention: We will retain your personal data only for as long as is necessary to fulfill the purposes for which it was collected (as outlined in Section 1.1 of the PICS and Section 2.5 of this PPS), including for the purposes of satisfying any legal, accounting, or reporting requirements, or for any directly related purposes. The retention period may vary depending on the type of data and the purposes for which it is held. For example:

• Order and transaction data will be retained for required by law to comply with financial record-keeping obligations in Hong Kong.
• Account information will be retained as long as your account is active and for a reasonable period in case you wish to re-activate it, for dispute resolution, or as required by law.
• Enquiries or correspondence may be kept to allow us to address follow-up questions.

When your personal data is no longer required for these purposes, we will take reasonably practicable steps to securely erase or de-identify it (e.g., through anonymization or aggregation).

2.8 Cookies and Other Tracking Technologies

Our website and Services use cookies and similar tracking technologies (e.g., web beacons, pixels, scripts) to enhance your user experience, analyze site traffic and usage patterns, understand user preferences, and for marketing purposes.

• What are Cookies? Cookies are small text files stored on your device (computer, mobile phone, tablet) when you visit certain websites.
• Types of Cookies We Use may include:
  • Strictly Necessary Cookies: Essential for the operation of our website, such as enabling you to log in, use a shopping cart, make payments, and ensure security. These typically cannot be disabled.
  • Performance/Analytical Cookies: Allow us to recognize and count the number of visitors and see how visitors move around our website. This helps us improve the way our website works (e.g., by ensuring that users are finding what they are looking for easily). The data collected is often aggregated and anonymized.
  • Functionality Cookies: Used to recognize you when you return to our website and enable us to personalize our content for you (e.g., remember your username, language, or region preferences).
  • Targeting/Advertising Cookies: Record your visit to our website, the pages you have visited, and the links you have followed. We may use this information to make our website and the advertising displayed on it (or on third-party sites) more relevant to your interests. We may also share this anonymized or pseudonymized information with third parties for this purpose.

Your Choices & Consent: When you first visit our website, you will be informed about our use of cookies via a cookie banner or pop-up. For cookies that are not strictly necessary (such as those for analytics, functionality, or targeting), we will seek your consent before placing them on your device. You can manage your cookie preferences and withdraw your consent at any time through our cookie consent management tool, a dedicated cookie settings page, or by adjusting your browser settings. Please note that disabling or blocking certain cookies may affect the functionality and your experience of our website.

2.9 Security of Your Personal Data

We are committed to protecting the security of your personal data. We take all reasonably practicable steps, including implementing appropriate physical, technical, and organizational security measures, to protect your personal data against unauthorized or accidental access, processing, erasure, loss, or use. These measures are designed to provide a level of security appropriate to the risk of processing your personal data and include:

• Using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) encryption for data transmission where appropriate.
• Implementing robust access controls (e.g., multi-factor authentication, role-based access) to limit access to personal data to authorized personnel on a need-to-know basis.
• Storing passwords in a hashed and salted format.
• Regularly reviewing our information collection, storage, and processing practices, including physical security measures, to guard against unauthorized access to systems.
• Providing regular data privacy and security training to our staff.
• Implementing procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
• Use of firewalls, secure servers, data minimization practices, regular security assessments/audits.

While we strive to protect your personal data, please be aware that no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security. We encourage you to take precautions to protect your personal data, such as choosing a strong password, keeping your password confidential, and logging out of your account after use.

2.10 Children's Privacy

Our Services are not intended for individuals under the age of 18 ("Children"). We do not knowingly collect personal data from Children. If you are a parent or guardian and you become aware that your Child has provided us with personal data without your consent, please contact us using the details in Section 2.2. If we become aware that we have collected personal data from Children without verification of parental consent, we will take steps to remove that information from our servers and/or terminate the child's account.

2.11 Links to Other Websites

Our website may contain links to other websites operated by third parties that are not owned or controlled by us (e.g., social media sites, partner websites). This Privacy Policy Statement does not apply to those third-party websites. We are not responsible for the privacy practices or content of such other websites. We encourage you to review the privacy policies of any third-party websites you visit before providing any personal data to them.

2.12 Governing Law and Language

This Privacy Policy Statement shall be governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region.

This Privacy Policy Statement is written in English. In the event of any inconsistency or discrepancy between the English version and the Chinese version, the English version shall prevail.

2.13 Changes to This Privacy Policy

We may update this Privacy Policy Statement from time to time to reflect changes in our data handling practices, legal or regulatory requirements, or for other operational reasons. We will notify you of any material changes by posting the updated policy on our website and indicating the "Last Updated" date at the top of this policy. For significant changes, we may also provide a more prominent notice (e.g., by email notification or a banner on our website).

Your continued use of our Services after such changes have been made will constitute your acknowledgement and acceptance of the revised Privacy Policy Statement. We encourage you to review this policy periodically to stay informed about how we are protecting your personal data.