Privacy Policy

This policy explains how Sevenstones ("we", "us"), collects and uses your personal data when you visit sevenstonesjewellery.com, create an account, place an order or contact us. It is our Personal Information Collection Statement under Hong Kong's Personal Data (Privacy) Ordinance (PDPO) and our privacy notice under the EU and UK General Data Protection Regulation (GDPR), which apply when we offer our pieces to customers in Europe.

1. Who is responsible for your data

The data user (PDPO) and controller (GDPR) is Sevenstones, Hong Kong SAR. For anything about your personal data, write to us through the Contact page.

2. The data we collect

Information you give us

Contact and identity details: your name, email address and telephone number.
Delivery and billing addresses.
Order details: the pieces you buy, ring sizes, engraving text, and the amounts paid, including duties and taxes.
Account details: your login email and password (stored only as a secure hash by our authentication provider), saved addresses, wishlist and order history.
Messages: what you send us through the contact form, by email or phone, and appointment requests, including any notes you add.
Reviews: the review text and the name you choose to display, which are published on the product page.

Information collected automatically

Technical data needed to run and secure the site: IP address, browser and device type, and request logs kept by our hosting provider.
The contents of your shopping bag, saved on your device and, when you are signed in, on our servers so it follows you between devices.

Payment data

Payments are processed by Stripe. Your card number, expiry date and security code are entered into Stripe’s secure payment form and sent directly to Stripe; they never pass through or are stored on our servers. We receive only what we need to manage your order: the payment status and the card brand and last four digits. Stripe also uses information about your device and transaction to detect and prevent fraud, as described in its own privacy policy at stripe.com/privacy.

What we do not collect

Our ring-size tool measures any photo you use inside your own browser; the photo is never uploaded to us. We do not use advertising cookies or tracking pixels, and we do not collect sensitive data such as health or biometric information.

3. How we use it, and our legal basis

To take payment, prepare, ship and deliver your order, handle returns, warranty and aftercare, and keep your account — because it is necessary to perform our contract with you.
To keep the accounting, tax and customs records the law requires — to comply with our legal obligations.
To prevent fraud and keep the site and your account secure — in our legitimate interest in protecting our customers and our business.
To send signed-in customers up to two reminders about a bag left in their account — in our legitimate interest in helping you complete a purchase you started. You can ask us to stop at any time by writing to us.
To answer your messages and appointment requests — to take steps you asked for, or in our legitimate interest in providing good service.
To send news about collections and events only if you have opted in; you can withdraw at any time using the link in each email — on the basis of your consent. Under the PDPO we will not use your personal data for direct marketing without your consent.

4. Who we share it with

We do not sell or rent your personal data. We share it only with the service providers who help us run Sevenstones, under contracts that require them to protect it and use it only on our instructions:

Stripe — payment processing and fraud prevention.
DHL Express — delivery: your name, address, telephone number and the contents and value of the parcel, which DHL also passes to customs authorities for clearance.
Supabase — database and account authentication hosting.
Vercel — website hosting and delivery.
Resend — sending order confirmations and other service emails.
Google Maps Platform — address suggestions and verification at checkout; we send only the address text you type, from our server.

We may also disclose personal data to our professional advisers, or where required by law, a court order or a public authority, or to protect our rights or the safety of others.

5. International transfers

We are based in Hong Kong and our service providers process data in Hong Kong, the United States, the European Union and other countries. When we transfer personal data of customers in the EU or UK outside those regions, we rely on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission (and the UK addendum), together with additional safeguards where needed.

6. Cookies and local storage

We use only what is strictly necessary to run the shop. None of it is used for advertising or to track you across other websites:

Sign-in cookies set by our authentication provider (Supabase), which keep you signed in to your account.
Local storage on your device for your shopping bag and saved ring-size calibration, and session storage to remember that you closed the announcement bar.
Cookies set by Stripe on the checkout page to prevent fraud and keep payments secure.

Because these are essential to the services you request, they do not need your consent. If we ever introduce analytics or marketing cookies, we will ask for your consent before setting them and update this policy.

7. How long we keep it

Order, payment and invoice records: seven years after the end of the financial year of the transaction, as Hong Kong tax law requires.
Your account: until you ask us to close it. Order records then follow the rule above.
Messages and appointment requests: two years after our last exchange with you.
Abandoned shopping bags: up to 90 days.
Marketing preferences: until you unsubscribe, after which we keep only a record that you opted out.

8. How we protect it

Data is encrypted in transit (HTTPS) and access to it is restricted to the staff who need it for their role. Our database enforces row-level security, so customers can only ever read their own records, and passwords are stored only as secure hashes. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the relevant authority of any breach where the law requires.

9. Your rights

Under the PDPO you may ask for access to and correction of the personal data we hold about you, and ask us to stop using your data for direct marketing. If you are in the EU or UK, you also have the right to erasure, to restrict or object to our processing, to data portability, and to withdraw consent at any time without affecting earlier processing.

To exercise any of these rights, write to us through the Contact page. We may need to verify your identity first. We respond to data access requests within 40 days as the PDPO requires, and to GDPR requests within one month. Under the PDPO we may charge a fee that is not excessive for supplying a copy of your data; we do not charge for GDPR requests unless they are manifestly unfounded or excessive.

If you are unhappy with how we have handled your data, please contact us first. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk), or to the data protection authority in the EU country, or the UK, where you live or work.

10. Automated decisions

Stripe screens payments automatically for fraud, and a payment it considers high-risk may be declined. If you believe a payment was declined in error, contact us and a person will review it.

11. Children

Our site is not intended for anyone under 18, and we do not knowingly collect data from children.

12. Changes to this policy

We will update this policy when our practices change and show the new date at the top. If a change materially affects how we use data you have already given us, we will tell you by email before it takes effect.