Legal
Privacy Policy
Version 1.0 Effective OGN Group (Hong Kong) Limited
This Policy explains how OGN Group (Hong Kong) Limited collects, uses, shares and keeps personal data when you visit ogngold.com, open an account or buy from us. It is our Privacy Policy Statement for the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO").
Summary of key points
- We collect what we need to verify you, take payment, supply your order and keep lawful records.
- Buying requires a verified mobile number and an identity check. We store the result of the identity check; we do not store your ID image or selfie in our own database.
- We do not sell your personal data. We share it only with the service providers, banks, couriers and authorities described below.
- Some service providers are outside Hong Kong.
- We send marketing only with your consent, and you can opt out at any time free of charge.
- You may ask for access to and correction of your personal data.
This summary is for convenience only. The full text below is what applies.
Contents
1.Who we are
The data user responsible for your personal data is OGN Group (Hong Kong) Limited (Business Registration No. 78607236), a company incorporated in Hong Kong whose registered address is Flat E, 5/F, Block 13, Yee Lok Court, 13 South Horizons Drive, Ap Lei Chau, Hong Kong. In this Policy "we", "us" and "our" mean that company.
This Policy should be read with our Personal Information Collection Statement, which is the notice we give at the point of collection, and our Cookie Policy.
2.Personal data we collect
We collect the following kinds of personal data. Unless stated otherwise it is collected from you directly.
| When | What we collect |
|---|---|
| Opening an account | Name, email address, password (stored only as a one-way hash), and, if you choose to sign in with Google, the identifier Google assigns to your account. |
| Verifying your mobile | Mobile number, the channel used (WhatsApp or SMS), the time of verification and delivery records. One-time codes are stored only as a keyed hash and expire within minutes. |
| Verifying your identity | Whether you are an individual or a company; the type of document presented; the outcome, date and reference of the check; any reason for failure; and reviewer notes. For a company: its name, Business Registration number and the name of the authorised person. Images of identity documents and selfies are captured and processed by our identity verification provider and are not stored in our own database. |
| Checkout | Billing and delivery name, address and telephone number; order contents; any note you add; the version of the Terms you accepted and the time you accepted it. |
| Source of funds | For an order of HK$120,000 or more: the category of your source of funds and the details you give. |
| Payment | From our bank or payment provider: the payer's name and account identifier, the amount, the reference, the bank's transaction identifiers and the time of credit. We keep the bank statements we import. We do not collect or store payment card details. |
| Third-party payer review | The payer's name and identity details, their relationship to the buyer, the reason for the payment, the payer's consent and supporting evidence. |
| Refunds | The name and account of the person refunded, the amount and the bank reference. |
| Collection or delivery | The name of the person receiving the gold, their relationship to the buyer, confirmation of signature, the carrier and tracking number, and a copy of the signed receipt. |
| Contacting us | Name, email, telephone number, your message, and the IP address and browser type from which it was sent. |
| Using the website | Technical data such as IP address, browser type and pages viewed, cart contents and, where you have agreed, analytics and advertising data. See our Cookie Policy. |
We record certain account security events, such as one-time code requests and account linking, together with the IP address used, in order to prevent abuse.
We do not knowingly collect personal data from anyone under 18. Our products are not offered to minors.
If you give us personal data about another person, such as a third-party payer, an authorised representative or a company director, you must make sure that person knows you are doing so and has seen this Policy.
3.Why we use personal data
We use personal data for the following purposes and for purposes directly related to them:
- opening and administering your account and confirming that you are who you say you are;
- processing orders: matching payments, assigning a pricing date, issuing invoices, collecting a top-up, paying a refund, and arranging collection or delivery;
- applying purchase limits per verified buyer;
- preventing, detecting and investigating fraud, money laundering, terrorist financing, sanctions breaches and other unlawful activity, and making any report the law requires;
- verifying a payer who is not the buyer;
- communicating with you about your account and orders, including by email, SMS and WhatsApp;
- handling enquiries, complaints, insurance claims and disputes, and establishing or defending legal claims;
- keeping the accounting, tax and transaction records the law requires;
- protecting the security of the website and of our systems;
- understanding how the website is used and improving it, where you have agreed to analytics cookies; and
- sending you marketing, where you have consented (see section 7).
We will not use your personal data for a new purpose unless it is directly related to one of these purposes, you have given your express and voluntary consent, or the law permits or requires it.
We do not make decisions about you by solely automated means that have a legal effect on you. A failed or unclear automated identity check is referred to a member of staff.
4.Identity documents and biometric data
We ask for an identity document and a live selfie so that we can be satisfied that the buyer is a real person, is who they claim to be, and is the person in the document. We do this as a condition of sale under our own risk and compliance policy for high-value goods, and to meet our obligations to prevent crime and comply with sanctions.
The comparison of your selfie with the photograph in your document involves biometric data. We use it only for identity verification and fraud prevention, and for no other purpose.
The images are captured and processed by our identity verification provider on our behalf, under a contract that restricts their use to providing the service to us and limits how long they are kept. We receive and keep the result.
Identity verification is required in order to buy. If you would prefer not to use the automated check, contact us before starting it and we will tell you whether a manual alternative is available.
6.Transfers outside Hong Kong
Several of the recipients in section 5 operate or store data outside Hong Kong, including in the European Union and the United States. Those places may not have data protection laws substantially similar to the PDPO.
Where we transfer personal data outside Hong Kong we take reasonable steps, including contractual terms, so that it is given a comparable standard of protection.
7.Direct marketing
We would like to use your name, email address and mobile number to send you news and offers about our own gold products. We will do so only if you have given your consent, which is asked for separately and is never a condition of buying.
We do not provide your personal data to any other person for use in their direct marketing.
You may withdraw your consent at any time, free of charge, by using the unsubscribe link in any marketing message, by changing the setting in your account, or by writing to [email protected]. Messages about your account and orders are not marketing and will still be sent.
8.How long we keep personal data
We keep personal data only for as long as it is needed for the purpose for which it was collected, including to meet legal, accounting and record-keeping requirements and to deal with disputes. We then erase or anonymise it.
| Record | Retention |
|---|---|
| Orders, invoices, payment and refund records, bank statements, benchmark and exchange-rate records | At least 7 years after the transaction, as required for business records under the Inland Revenue Ordinance (Cap. 112) and the Companies Ordinance (Cap. 622). |
| Identity verification outcomes, source-of-funds declarations and payer reviews | For as long as you have an account, and for 7 years after your last transaction. |
| Identity document images and selfies | Held by our identity verification provider for the period set in our contract with it, and not kept in our own database. |
| One-time codes | Stored as a hash and expire within minutes. Records of verification attempts are kept with the account. |
| Account profile and addresses | While your account is open. After closure, only so far as needed for the records above. |
| Enquiries and complaints | For as long as needed to deal with them, and afterwards for the limitation period for legal claims. |
| Marketing preferences | Until you withdraw consent, and afterwards a record of your opt-out. |
| Cart and unfinished checkout data | A cart is erased automatically when it expires. An unfinished checkout is erased automatically 30 days after its last activity. |
We may keep data longer where a law, a regulator, a court or an existing dispute requires it.
9.Security
We take all practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. These include encrypted connections to the website, hashing of passwords and one-time codes, access controls and two-factor authentication for staff, an audit trail of staff actions, and rate limits and automated checks against abuse.
No system is completely secure. You are responsible for keeping your password and one-time codes confidential and for telling us at once if you believe your account has been used without your authority.
10.Your rights and how to use them
Under the PDPO you have the right to:
- ask whether we hold personal data about you and be given a copy of it (a data access request);
- ask us to correct personal data that is inaccurate (a data correction request);
- know our policies and practices on personal data and the kinds of personal data we hold; and
- withdraw your consent to direct marketing at any time.
To make a request, write to our Data Protection Officer at the address or email in section 12. For a data access request, please use the form specified by the Privacy Commissioner for Personal Data (Form OPS003), which is available on the Commissioner's website.
We will need to verify your identity before acting on a request. We will respond within 40 days of receiving it. We may charge a fee for complying with a data access request; the fee will not exceed the direct cost of complying.
We may refuse a request in the circumstances the PDPO allows, for example where we are not satisfied of your identity, or where compliance would disclose another person's data or prejudice the prevention or detection of crime. If we refuse, we will tell you and give reasons where the law permits.
We cannot erase data that we are required by law to keep. Asking us to stop using data that is needed for verification means you will not be able to buy.
If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.
11.Changes to this Policy
We may update this Policy. The current version, with its version number and effective date, is always published on this page. If a change is material we will bring it to your attention through the website or by message.
12.Contact us
Requests for access to or correction of personal data, and questions about this Policy, should be addressed to the Data Protection Officer:
| Company | OGN Group (Hong Kong) Limited |
|---|---|
| Address | Flat E, 5/F, Block 13, Yee Lok Court, 13 South Horizons Drive, Ap Lei Chau, Hong Kong |
| [email protected] | |
| Telephone | [Contact phone] |
| Website | ogngold.com |