Privacy policy
Privacy Policy

1. Who We Are (Data Controller)

This website is operated by PERSON.TEES (Hong Kong Business Registration Number: [REDACTED — please refer to the business registration in the website footer]). We are the "Data Controller" of your personal data. When you contact us through the website, submit a custom enquiry, or subscribe to our content, we process your data in accordance with this policy.

2. What We Collect

We collect the following categories of personal data:

(a) Contact information: Name, email address, phone number, company name (if applicable).

(b) Order information: product specifications, quantity, sizes, printed artwork, delivery address (if the customer chooses delivery service).

(c) Technical data: IP address, browser type, device information, browsing history (via cookies and similar technologies).

(d) Communication Content: Your conversations with our account managers via WhatsApp / email / forms.

3. How We Use Your Data

We will only use your personal data for the following purposes:

(a) To respond to your enquiry and provide a quote — legal basis: performance of a contract / your request prior to entering a contract (pre-contractual).

(b) Processing Orders & Delivering Products — Legal Basis: Performance of a Contract.

(c) Improving the website experience and analyzing trends — Legal basis: legitimate interest.

(d) Sending product updates or industry information (only with your explicit consent) — Legal basis: consent.

We will never use your data for automated decision-making or profiling that has legal effects on you.

4. Data Sharing

We do not sell or rent your personal data. We only share your data in the following circumstances:

(a) With our suppliers and logistics partners (only to the extent necessary to process your order).

(b) with our customer management system (HubSpot CRM) and cloud service providers (Cloudflare Pages + KV + Workers).

(c) Comply with legal obligations or respond to lawful requests from government authorities.

(d) To protect our or others' rights, property or safety.

All third-party processors have signed a Data Processing Agreement (DPA) with us and are contractually bound to protect your data.

5. Data Retention

We retain your personal data only for as long as necessary:

(a) Customer data: 7 years after order completion (meets Hong Kong tax retention requirements).

(b) Enquiry data (not converted to an order): Automatically deleted after 12 months.

(c) Cookie Data: See Section 8, Cookie Policy for details.

(d) Accounting and invoice records: 7 years.

After the retention period expires, we will securely destroy or anonymize your data.

6. Your Rights

Under applicable data protection laws, you have the following rights:

(a) Right of access: You have the right to ask whether we hold your personal data and to request a copy.

(b) Right to correction: You have the right to request that we correct inaccurate data.

(c) Right to erasure: In certain circumstances, you have the right to request that we delete your data (the 'right to be forgotten').

(d) Right to restrict processing: You have the right to request that we restrict the processing of your data.

(e) Right to data portability: You have the right to obtain your data in a structured, commonly used format.

(f) Right to Object: You have the right to object to our processing based on legitimate interests.

(g) Right to Withdraw Consent: If processing is based on your consent, you may withdraw it at any time.

To exercise any of the above rights, please contact us using the details in Section 14. We will respond within 30 calendar days.

7. Data Security

We implement multiple layers of security to protect your data:

(a) Encryption in Transit: Site-Wide HTTPS / TLS 1.2+ · HSTS preload.

(b) Cloudflare WAF + DDoS Protection + Turnstile CAPTCHA.

(c) CSP Content Security Policy + X-Frame-Options + Permissions-Policy.

(d) Employee access controls (least privilege principle) + regular access audits.

(e) Regular penetration testing and vulnerability scanning (squirrelscan 240+ rules).

However, no system can guarantee 100% security. In the event of a data breach, we will notify you and the relevant regulators within 72 hours.

8. Cookie Usage (Cookies)

This website uses cookies and similar technologies. Our cookies are categorized as:

(a) Necessary Cookies: Keep the website running (e.g. shopping cart, login status) — consent not required.

(b) Analytics cookies: Cloudflare Analytics (anonymous statistics) — enabled by default; can be disabled in your browser settings.

(c) Third-party cookies: user-initiated embeds (e.g. YouTube videos) — consent required before loading.

You can manage or delete cookies through your browser settings. For details, please refer to .

9. AI Agents

This website uses an AI sourcing assistant (the “AI Assistant”) to help you look up product information and obtain quotes. The AI Assistant processes your enquiries through a large language model (LLM). We take the following measures to protect your privacy:

(a) Your enquiry is used solely for immediate responses and will not be used for AI model training.

(b) The AI assistant cannot access your order history or personal data; it only answers product-knowledge questions.

(c) Conversations with LLM providers are governed by an enterprise-grade DPA, with data automatically deleted within 30 days.

You can switch off the AI assistant at any time and have a human account manager follow up (response time: 1 business day).

10. Third-party processors (Sub-processors)

We use the following third-party service providers to process your data:

(a) Cloudflare (CDN + Pages + Workers + KV) — Global content delivery and edge computing.

(b) HubSpot (CRM) — customer management and sales pipeline.

(c) Resend / Cloudflare Email (transactional email) — order confirmations and enquiry replies.

(d) Google Fonts (CSS requests only) — font loading does not track users.

All suppliers are based in the EU/US/Hong Kong and bound by GDPR / PDPO / PIPL. We have signed DPAs with each supplier.

11. Cross-border transfers (International Data Transfers)

Your data may be transferred to locations outside Hong Kong (e.g. the CDN nodes we use). We take the following measures to ensure cross-border transfer compliance:

(a) Transferred only to regions covered by an EU adequacy decision.

(b) Using Standard Contractual Clauses (SCC) or other transfer mechanisms recognised under GDPR Article 46.

(c) Encrypt data in transit and at rest.

(d) Regular audits of cross-border transfer records.

12. Children's Privacy

This website is not directed at children under 16. We do not knowingly collect children’s personal data. If you find that we have unintentionally collected children’s data, please contact us to request deletion.

13. Policy Updates

We may update this policy from time to time. We will notify you of any material changes via website announcements or email. The latest version will be published on this page with a 'Last Updated' date. We encourage you to review it regularly.

14. Contact Us

If you have any questions about this policy, or wish to exercise your rights, please contact us via:

Email: hello@persontees.com (Subject: Privacy Request)

Phone: Please book by email; we will reply within 1 business day.

Mailing address: Kowloon, Hong Kong [REDACTED — please refer to the footer for the full address]

15. Effective Date & Change Log

Policy effective date: 2026-08-29

Change log:

· 2026-08-29: Initial publication. Covers the three legal frameworks PDPO + GDPR + PIPL, with a new section specific to third parties.

16. Data Protection Officer (DPO)

If you need to formally exercise your rights under GDPR / PDPO, or have compliance concerns about this policy, please contact our Data Protection Officer:

Email: dpo@persontees.com

The DPO will formally respond within 30 calendar days (GDPR Article 12 requirement).

17. Complaints & Supervisory Authority

If you are unhappy with our handling, you have the right to lodge a complaint with the following supervisory authority:

(a) Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD): www.pcpd.org.hk

(b) EU: the data protection authority (DPA) in your country of residence.

(c) People's Republic of China: Cyberspace Administration of China (CAC).

Before making a complaint, we encourage you to contact us first so we can address your concerns directly.

18. Business Continuity and Disaster Recovery

We take the following measures to ensure continuity of our data processing services:

(a) Cloudflare global CDN (200+ nodes) — automatic failover.

(b) Daily data backup (KV namespace + Git version control).

(c) RTO (Recovery Time Objective): Service restored within 4 hours.

(d) RPO (Recovery Point Objective): data integrity within 24 hours.

19. Automated Decision-Making

We do not use your personal data for automated decision-making or profiling unless you have given explicit consent and been informed:

(a) Logic and foreseeable consequences.

(b) You have the right to request human intervention.

(c) You have the right to object.

The AI procurement assistant is for product knowledge Q&A only and does not take part in order decisions. Order approvals and quotes are handled by a human account manager.

20. Consent Statement

By continuing to browse and use this website (www.persontees.com), you expressly agree to the following:

(a) You have read, understood and accepted all terms of this Privacy Policy.

(b) You agree to our processing of your personal data within the scope and for the purposes set out in this policy.

(c) You confirm that the information provided is accurate and complete, and accept the consequences of any inaccuracy.

(d) You understand that this policy may be updated from time to time, and you are responsible for reviewing it periodically.

(e) You consent to the use of cookies and similar technologies (see Section 8).

If you are a minor (under 16), your legal guardian must give consent on your behalf. We do not knowingly collect personal data from minors.

This consent statement applies to all interactions you have with us through this website, WhatsApp, email, phone or other channels.

21. Governing Law & Jurisdiction

This policy is governed by the laws of the Hong Kong Special Administrative Region. Both parties agree to submit to the non-exclusive jurisdiction of the Hong Kong courts, provided that the parts of this policy relating to GDPR / PIPL compliance shall be governed by those laws.

If any provision of this policy is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect. If there is any discrepancy between the English version of this policy (if provided separately) and the Chinese version, the Chinese version shall prevail.

This policy constitutes the entire agreement between you and us with respect to privacy matters and supersedes all prior oral or written agreements.