Privacy Policy

This Privacy Policy explains how PeakEight Limited (“PeakEight,” “we,” “us,” or “our”), a company incorporated in Hong Kong (Company No. 81442471, registered office at Room 18, 2/F, Tuspark, 118 Wai Yip Street, Kwun Tong, Hong Kong), collects, uses, discloses, and protects information when you visit peakeight.com, create an account, contact us, subscribe to marketing, or place an order (the “Site”). We are the controller for the personal data described in this Policy.

1. Information We Collect

We collect information you provide directly to us, information collected automatically when you use the Site, and information from third parties.

Information you provide

• Identity and contact data: name, email address, phone number, billing and delivery addresses.
• Order and account data: products ordered, order value and currency, account details, delivery status, returns, refunds, complaints, and support correspondence.
• Customs and delivery information: for orders shipped outside Hong Kong, the information our carriers need to clear customs in your destination country (such as declared value and product description).
• Marketing preferences: your email if you sign up for Peak Club or our newsletter, and your consent/unsubscribe history.

Information collected automatically

• Device and usage data: IP address, browser type, pages viewed, referring URL, and timestamps.
• Cookies and similar technologies, described in our Cookie Policy.

Payment information

We do not collect or store your full card number, CVV, or other sensitive payment card data on our own servers. Checkout is processed by Stripe and/or other PCI-DSS compliant payment processors we engage, who collect and process your payment details directly under their own privacy policies (for example, Stripe’s privacy policy; Stripe may act as an independent controller for some of its own processing). We receive only a payment confirmation, the last four digits of your card, and the card brand, for order and support purposes. See our Payment & Security page for more.

2. How We Use Information, and Our Legal Bases

• To perform our contract with you: operate your cart and account, take payment, confirm and deliver orders, provide tracking, and handle cancellations, returns, refunds, and support.
• To comply with our legal obligations: keep tax, accounting, and customs/export records, respond to lawful requests, and meet fraud-prevention and payment-provider obligations.
• Where it serves our legitimate interests (balanced against your rights): securing the Site, preventing fraud and misuse, managing disputes, and understanding how the Site is used so we can improve it.
• With your consent: optional marketing communications and non-essential cookies or analytics, where consent is required. You can withdraw consent at any time.

Providing checkout identity, address, and payment information is necessary to enter into and perform a purchase contract with you; without it, we cannot process or deliver an order.

For visitors in the EEA or UK: the categories above correspond to the lawful bases of contract, legal obligation, legitimate interests, and consent under the UK/EU GDPR, which applies alongside Hong Kong’s Personal Data (Privacy) Ordinance as described in Section 9.

3. How We Share Information

We do not sell your personal information. We disclose only what is reasonably necessary to:

• Service providers who perform functions on our behalf, such as our website platform and hosting providers; payment processors (including Stripe); shipping carriers, customs brokers, and fulfilment partners; email and SMS providers; and web analytics providers.
• Customs and government authorities, where required to lawfully import your order into your destination country.
• Legal and safety purposes, where required to comply with a legal obligation, enforce our Terms of Service, or protect the rights, property, or safety of PeakEight, our customers, or others.
• Professional advisers and regulators, where legally required.
• Business transfers, in connection with a merger, acquisition, or sale of assets, subject to standard confidentiality terms.

Providers acting for us may use your information only for the purposes we authorise; some recipients, such as payment providers and carriers, also determine their own purposes for processing. We do not permit a provider to use your information for its own advertising merely because it supplies a service to us.

4. Data Retention

• Order, payment, refund, and tax/accounting records are normally kept for up to 7 years after the relevant financial year, or longer if a dispute or legal duty requires it.
• Account information is kept while your account is active, and normally for up to 2 years after closure, except where it forms part of an order record covered above.
• Customer-service correspondence is normally kept for up to 2 years after the matter closes, or longer where needed for a claim.
• Security and technical logs are normally kept for up to 12 months, unless an incident requires a longer investigation.
• Marketing data is kept until you unsubscribe or we determine it’s no longer needed; we may keep a minimal suppression record so we can continue to respect your opt-out.

We may retain information longer where required by law, an open chargeback, fraud review, legal claim, or regulatory request, and delete or anonymise it once it’s no longer needed.

5. Security

We use industry-standard safeguards, including encrypted transmission (TLS/HTTPS) and access controls, to protect your information. Payment-card fields are supplied directly by our payment processors, so full card details are transmitted to them and not stored on our own servers. Please never send passwords, full card numbers, security codes, or identity documents to us by ordinary email or contact form. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Your Rights and Choices

• Access & correction: review and update your account details at any time by signing in, or by contacting us. Under Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486), you have the right to request access to, and correction of, personal data we hold about you; we may charge a reasonable fee to cover the cost of complying with an access request, as the Ordinance permits.
• Deletion: request deletion of your personal information, subject to our legal retention obligations (e.g., completed order records).
• Marketing opt-out: unsubscribe at any time using the link in any marketing email, or by contacting support@peakeight.com.
• Cookies: manage cookie preferences as described in our Cookie Policy.
• Residents of the EEA/UK, California, and other jurisdictions with their own data protection laws may have additional rights under those laws, including erasure, restriction, objection to processing, data portability, and the right to lodge a complaint with your local supervisory authority, alongside the rights above. Contact us to exercise any of these rights; we may need to verify your identity, and will respond consistently with whichever law gives you the stronger protection.

If you are in Hong Kong, you may also complain to the Office of the Privacy Commissioner for Personal Data at pcpd.org.hk. If you are in the UK, you may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. We’d appreciate the chance to resolve your concern directly first, where possible.

7. Children’s Privacy

The Site is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

8. International Transfers

We are based in Hong Kong, and your information is primarily stored and processed there. Because we ship internationally and use service providers in other countries, including our payment processors, shipping carriers, and hosting providers, your information may also be transferred to, and processed in, other countries whose data protection laws may differ from those of your home country. Where we transfer personal data of customers in the EEA or UK, we use appropriate safeguards (such as standard contractual clauses or the UK International Data Transfer Agreement) where required by applicable law. Contact us for more information about the safeguard relevant to your data.

9. Governing Law for This Policy

This Privacy Policy, and our handling of personal data as a Hong Kong company, is governed primarily by the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong. Where applicable law in your own country, such as the UK/EU GDPR or US state privacy laws, grants you additional or different rights, we will also honour those rights for data about you that falls within that law’s scope.

10. Changes to This Policy

We may update this Privacy Policy when our providers, practices, or legal duties change. The “Last updated” date at the top of this page reflects the most recent revision. Material changes will be highlighted on the Site or communicated by email.

11. Contact Us

Questions about this Privacy Policy or our data practices can be directed to:

PeakEight Limited
Company No. 81442471
Room 18, 2/F, Tuspark, 118 Wai Yip Street
Kwun Tong, Hong Kong

Email: support@peakeight.com
Hours: Monday–Friday, 9am–6pm Hong Kong Time (GMT+8)