1. Who We Are
This Privacy Policy explains how HK Nextone Limited ("we", "us" or "our") collects, uses, discloses and protects personal data in connection with our websites, including https://shop.bgp.sh (the "Websites"), and the services we provide (the "Services").
BGP Shop is a trading name of HK Nextone Limited. HK Nextone is the data user (data controller) of the personal data described in this Policy. We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the "PDPO").
2. Personal Data We Collect
We collect the following categories of personal data:
- Account and contact information: name, company name, email address, telephone number, billing address and country.
- Billing and transaction information: invoices, order history, payment amounts, currencies, payment method type and transaction references. Payments are processed by third-party payment service providers; we do not store full payment card numbers.
- Technical information: IP addresses, login times, browser and device information, and cookie data collected when you use the Websites.
- Support communications: the content of support tickets, emails and other correspondence, including any contact details you choose to provide.
- Service information: service configurations, assigned IP addresses, resource and bandwidth usage, and system logs required to operate and secure the Services.
- Business customer information: contract details, the names and contact details of authorised representatives, and verification documents where required by law or our internal policies.
Customer content. Data that customers store on or transmit through servers they rent or colocate with us ("Customer Content") is controlled by the customer. We do not access Customer Content except where necessary to provide support at the customer's request, to comply with applicable law, or to investigate suspected abuse or a security incident. Customers are responsible for their own compliance with data protection laws in relation to Customer Content.
3. How We Use Personal Data
We use personal data to:
- provide, deliver, maintain and manage the Services and your account;
- issue invoices, process payments and maintain accounting records;
- respond to support requests and communicate with you about the Services, including service, maintenance and security notices;
- protect the security and integrity of our network and systems, and prevent and investigate fraud, abuse and violations of our Terms of Service;
- comply with legal and regulatory obligations, including tax, accounting and anti-money laundering requirements, and lawful requests from authorities; and
- analyse aggregated usage to improve the Services.
Where a field on our Websites is marked as required, failure to provide the information may mean we are unable to provide the relevant Service.
Direct marketing. We will not use or provide your personal data for direct marketing without your consent, as required by Part 6A of the PDPO. You may withdraw your consent at any time by contacting us or using the unsubscribe link in our communications, free of charge.
4. Disclosure of Personal Data
We do not sell personal data. We may disclose personal data, only as necessary for the purposes above, to:
- payment service providers and banks that process payments on our behalf;
- data centre, network and infrastructure suppliers that help us deliver the Services;
- IT service providers that host or support our billing, email and support systems;
- professional advisers such as auditors, accountants and lawyers;
- government authorities, regulators, courts and law enforcement agencies, where required or permitted by law; and
- a successor entity in connection with a merger, acquisition or transfer of all or part of our business, subject to this Policy.
We require our service providers to protect personal data and to use it only for the purposes for which it was provided.
5. Cross-Border Transfers
Our service providers may store or process personal data outside Hong Kong, including in [LOCATIONS, e.g. Singapore / United States]. Where personal data is transferred outside Hong Kong, we take reasonable steps to ensure that it receives a level of protection comparable to that required under the PDPO.
6. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected:
- account and service data: for the duration of your account and up to [24] months after it is closed;
- transaction and accounting records: for at least seven years, as required by Hong Kong law; and
- system and access logs: generally for up to [90] days, unless needed longer to investigate a security incident or abuse.
When personal data is no longer required, we delete or anonymise it.
7. Security
We maintain reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include encryption of data in transit (TLS), role-based access controls, multi-factor authentication for administrative access, regular backups and system monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Cookies
Our Websites use essential cookies to keep you signed in, maintain your shopping cart and protect against security threats. [We also use analytics cookies to understand how the Websites are used.] You can control cookies through your browser settings; disabling essential cookies may affect the functionality of the Websites.
9. Your Rights
Under the PDPO, you have the right to:
- request access to the personal data we hold about you;
- request correction of personal data that is inaccurate; and
- withdraw consent to direct marketing at any time.
You may also request deletion of your account data, subject to our legal retention obligations. To make a request, contact us using the details below. We will respond within 40 days, as required by the PDPO, and may charge a reasonable fee for processing a data access request. If you are located outside Hong Kong, you may have additional rights under local law; please contact us and we will handle your request in accordance with applicable law.
10. Children
The Services are not directed to individuals under 18 years of age, and we do not knowingly collect personal data from them.
11. Third-Party Websites
Our Websites may contain links to third-party websites. We are not responsible for the privacy practices of those websites.
12. Changes to This Policy
We may update this Policy from time to time. The updated version will be posted on this page with a revised "Last updated" date. Where changes are material, we will notify customers by email or through the Websites.
13. Contact Us
HK Nextone Limited
Email: [email protected]
If this Policy is translated into another language, the English version prevails in case of inconsistency.
Saturday, September 26, 2026