CRYSTAL CAVA — PRIVACY POLICY

Last updated: 5 September 2026

Crystal Cava Limited ("the Company", "we", "us" or "our") is a limited company incorporated in Hong Kong. We operate the natural crystal online store at www.crystalcava.com.hk and maintain a physical warehouse in Chai Wan, Hong Kong. We hold a valid Hong Kong Business Registration and are registered as a Dealer in Precious Metals and Stones in Hong Kong (Registration No. A-B-23-10-01801).

We respect your personal data privacy and are committed to complying with the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (the "Ordinance") and its Data Protection Principles.

This Privacy Policy explains how we collect, use, disclose and protect your personal data, and what rights you have under the Ordinance.

1. Personal Data We Collect

We collect only the personal data necessary to provide our goods and services. Depending on how you interact with us, this may include:

Order and delivery information

• Name or recipient name
• Delivery address
• Contact telephone number (including WhatsApp number)
• Email address
• Order and purchase history

Member account information

• Login name and password (passwords are stored in encrypted form)
• Membership tier and reward point records
• Order-related preferences such as wrist size, where you choose to provide them

Payment information

We do not store your credit card number, expiry date or security code. All payments are processed directly by third-party payment service providers (see Section 4). We receive only the transaction outcome and reference number.

Technical information

• IP address, browser type, device type
• Browsing activity on our website, collected through cookies and similar technologies (see Section 5)

Social media interactions

Where you contact us or place an order through our Facebook page, Instagram account or Carousell account, we receive the content of those messages and the public account information that the platform displays to us.

We do not collect the following: identity card numbers, passport numbers, tax identification numbers, dates of birth, gender, race, marital status, immigration or residency status, financial standing, health information, or any sensitive personal data under the Ordinance.

Providing personal data to us is voluntary. However, if you do not provide the information necessary for delivery and contact, we will not be able to process your order.

2. Purposes of Collection

We collect and use your personal data for the following purposes:

1. Processing orders, packing and arranging delivery
2. Contacting you regarding orders, dispatch, returns, exchanges or enquiries
3. Creating and administering member accounts, including calculating membership tiers and discounts
4. Processing payments, refunds and transaction reconciliation
5. Responding to customer enquiries and providing after-sales service
6. Handling return and exchange requests and disputes
7. Preventing fraud and safeguarding transaction security
8. Internal record-keeping, accounting and business analysis
9. Complying with applicable legal and regulatory requirements
10. Direct marketing, where you have given your consent (see Section 3)

We will not use your personal data for any purpose beyond those stated above unless we have first obtained your prescribed consent or are required to do so by law.

3. Direct Marketing

Under Part VIA of the Ordinance, we must notify you and obtain your consent before using your personal data for direct marketing purposes.

Data intended to be used: name, email address, telephone number (including WhatsApp).

Classes of goods to be marketed: our natural crystal products, display pieces, jewellery and accessories; promotions, discounts, new arrivals and event information.

Channels of communication: email, WhatsApp, SMS, and social media messaging.

If you no longer wish to receive marketing communications, you may notify us at any time through any of the following channels. We will cease using your personal data for direct marketing within a reasonable period, and we will not charge you any fee for doing so:

• Email crystalcava@crystalcava.com.hk
• Send a WhatsApp message to +852 5387 8827
• Click the unsubscribe link in any marketing email

4. Disclosure and Transfer of Data

We do not sell your personal data. We disclose it only to the following classes of third parties, and only to the extent necessary to provide our services:

E-commerce platform provider SHOPLINE, the system provider for this online store, for the storage and processing of order data.

Payment service providers Including but not limited to Faster Payment System (FPS), PayMe, AlipayHK, credit card acquiring banks, Apple Pay and Google Pay, for the processing of payments.

Logistics and courier service providers Including but not limited to SF Express, Hongkong Post, and the corresponding logistics operators in Taiwan, Macau and international destinations. We provide only the information necessary for delivery (recipient name, address and telephone number).

Analytics and advertising service providers Third-party providers that help us measure website usage and the effectiveness of our advertising. Where possible, the information shared with these providers is aggregated or pseudonymised.

Professional advisers and authorities Accountants, legal advisers, regulators or law enforcement agencies, where required by law or where we have reasonable grounds to believe disclosure is necessary.

Cross-border transfer: because we deliver to destinations outside Hong Kong and use service providers whose servers may be located outside Hong Kong, your personal data may be transferred outside Hong Kong. We take reasonable steps to ensure that recipients afford your personal data a level of protection no lower than that required under the Ordinance.

5. Cookies and Similar Technologies

Our website uses cookies and similar technologies for the following purposes:

• Strictly necessary cookies — to maintain your shopping cart, keep you signed in to your member account, and enable core website functions
• Analytics cookies — to help us understand how the website is used so that we can improve it
• Advertising cookies — to measure the performance of our advertising and to show you more relevant advertisements

You may adjust your preferences through the cookie banner on our website, or disable cookies through your browser settings. Disabling strictly necessary cookies may prevent the shopping cart or login functions from working correctly.

6. Data Retention

We retain your personal data for as long as is necessary to fulfil the purposes set out in this Privacy Policy, including maintaining your order history and member account, providing continuing after-sales service, and meeting our accounting, tax and other legal obligations.

Where personal data is no longer required for any of these purposes, we will take reasonably practicable steps to erase it or render it anonymous.

7. Data Security

We apply reasonable physical, technical and administrative measures to protect your personal data, including encrypted transmission on our website (SSL/TLS), restricted staff access, and confidentiality obligations imposed on our service providers.

No method of transmission over the internet can be guaranteed to be completely secure. You are responsible for keeping your member account password confidential.

8. Your Rights

Under sections 18 and 22 and Data Protection Principle 6 of the Ordinance, you have the right to:

• Access the personal data we hold about you
• Correct any inaccurate personal data
• Request erasure of personal data that is no longer necessary
• Withdraw any consent previously given, including consent to direct marketing
• Enquire about our personal data policies and practices

We may need to verify your identity before we can process your request. If you have any concerns about how we handle your personal data, please contact our Privacy Officer in the first instance and we will do our best to resolve the matter; you may also raise the matter with the Office of the Privacy Commissioner for Personal Data, Hong Kong.

9. Third-Party Websites and Platforms

Our website may contain links to third-party websites and platforms (such as Facebook, Instagram, Carousell and payment gateways). Those platforms operate under their own privacy policies, and this Privacy Policy does not apply to them. We are not responsible for the data handling practices of third parties, and we recommend that you read their privacy policies before use.

10. Contact Us

If you have any questions about this Privacy Policy, or wish to exercise any of the rights set out in Section 8, please contact:

Privacy Officer Crystal Cava Limited Email: crystalcava@crystalcava.com.hk WhatsApp: +852 5387 8827 / +852 5528 9888 Website: https://www.crystalcava.com.hk

11. Changes to This Policy

We may revise this Privacy Policy from time to time. Any material change will be notified on our website, and the "Last updated" date at the top of this page will be revised. We recommend that you review this page periodically.

In the event of any discrepancy between the English and Chinese versions of this Privacy Policy, the English version shall prevail.

This Privacy Policy is governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region.