Last Updated: November 5, 2024

1. Introduction and Jurisdiction

This Privacy Policy ("Policy") is issued by Trove Limited, a company incorporated under the laws of Hong Kong with its registered office at 510 Wayson Commercial Building, 28 Connaught Road West, Sheung Wan, Hong Kong ("Company," "we," "our," or "us"). This Policy governs our collection, processing, and use of personal information through our software-as-a-service database and enterprise resource management application ("Service").

While we are headquartered in Hong Kong and primarily subject to Hong Kong laws, we acknowledge that:

(a) Our Service may be accessed globally; (b) Data processing may occur in multiple jurisdictions; (c) Various international privacy laws may apply to our operations; (d) Data storage and processing may be conducted through third-party providers in different jurisdictions.

2. Legal Basis and Jurisdictional Considerations

2.1 Primary Jurisdiction

Our primary place of business is Hong Kong, and this Policy is governed by Hong Kong law. However, we strive to comply with applicable data protection requirements in other jurisdictions where our users are located.

2.2 International Data Processing and Storage

We process and store personal information in multiple jurisdictions to ensure optimal service delivery and comply with various regional requirements. While we are headquartered in Hong Kong, our Service utilizes data centers and service providers located in multiple jurisdictions, including but not limited to:

(a) Hong Kong SAR (b) Singapore (c) United States of America (d) Canada (e) United Kingdom (f) European Union member states (g) Other jurisdictions as required for service delivery

By using our Service, you explicitly acknowledge and consent to:

(a) The transfer, storage, and processing of your personal information in and to Hong Kong and any of the above-listed jurisdictions;

(b) The transfer of your personal information between these jurisdictions as necessary for service delivery and optimization;

(c) The processing and storage of your information in jurisdictions that may have different data protection rules than your country of residence;

(d) The transfer of your personal information to third-party service providers in these jurisdictions as necessary to provide the Service;

(e) The possibility that your data may be subject to multiple data protection regimes simultaneously.

We implement appropriate safeguards for all international data transfers, including:

(a) Standard contractual clauses approved by relevant authorities; (b) Data processing agreements with service providers; (c) Regional data residency arrangements where required by law; (d) Privacy Shield certification where applicable; (e) Other legally recognized transfer mechanisms as appropriate.

3. Information Collection and Use

3.1 Categories of Information

We collect and process the following categories of personal information:

3.1.1 Account Information

Business contact details
User authentication credentials
Account preferences and settings
Professional and employment information
Organization details

3.1.2 Service Usage Data

Log files and usage statistics
Device and browser information
IP addresses and location data
Access timestamps
Session information

3.1.3 Business Data

Customer databases
Transaction records
Financial information
Employee records
Business operations data

3.2 Collection Methods

We collect information through:

(a) Direct user input and submission; (b) Automated systems and logging; (c) Third-party integrations and APIs; (d) Cookies and similar technologies; (e) Business operations and communications.

4. Use of Information

4.1 Primary Purposes

We process personal information for the following primary purposes:

(a) Providing and maintaining the Service; (b) Processing transactions and billing; (c) User authentication and security; (d) Technical support and customer service; (e) Service optimization and performance monitoring; (f) Legal compliance and auditing; (g) Communication about Service updates and changes; (h) Analytics and service improvement.

4.2 Legal Basis for Processing

Our processing of personal information is based on one or more of the following legal grounds:

(a) Performance of a contract; (b) Legitimate business interests; (c) Legal obligations; (d) User consent where required by law.

5. Data Storage and Security

5.1 Storage Location and Duration

Our company is based in Hong Kong, and we maintain a global network of data storage and processing facilities, including infrastructure in Hong Kong SAR, Singapore, the United States, Canada, the United Kingdom, and European Union member states. This distributed infrastructure enables us to provide optimal service delivery while meeting various regional compliance requirements. We retain personal information for as long as necessary to:

(a) Provide the Service; (b) Comply with legal obligations; (c) Resolve disputes; (d) Enforce agreements; (e) Support legitimate business purposes.

5.2 Security Measures

We implement reasonable security measures to protect personal information, including:

(a) Encryption in transit and at rest; (b) Access controls and authentication; (c) Monitoring and logging; (d) Regular security assessments; (e) Employee training and compliance.

5.3 Security Disclaimers

While we implement industry-standard security measures, you acknowledge and agree that:

(a) No security measures are perfect or impenetrable; (b) We cannot guarantee the absolute security of data; (c) Transmission of data over the internet is inherently insecure; (d) We are not liable for unauthorized access, disclosure, or data breaches unless directly caused by our gross negligence.

6.1 Service Providers

We may share personal information with third-party service providers who assist us in:

(a) Hosting and infrastructure; (b) Payment processing; (c) Analytics and monitoring; (d) Customer support; (e) Security and compliance.

6.2 Legal Requirements

We may disclose personal information if required by:

(a) Applicable laws or regulations; (b) Legal process or government request; (c) Protection of rights and safety; (d) Investigation of potential violations; (e) Prevention of fraud or abuse.

7. International Data Transfers

7.1 Cross-Border Transfers and Data Storage Infrastructure

As a Hong Kong-based company operating a global service, we maintain and utilize data storage and processing infrastructure in multiple jurisdictions to ensure efficient service delivery and compliance with regional requirements.

7.1.1 Primary Data Storage Locations

Our primary data storage and processing locations include:

(a) Hong Kong SAR

Primary business operations
Core infrastructure
Business continuity systems

(b) Singapore

Regional data center operations
Backup and redundancy systems
Asia-Pacific service delivery

(c) United States

North American service delivery
Analytics and processing systems
Content delivery networks

(d) Canada

Regional data processing
Backup infrastructure
Compliance systems

(e) United Kingdom

European service delivery
Regional compliance operations
Data processing systems

(f) European Union

Regional data centers
GDPR compliance infrastructure
Service optimization systems

7.1.2 Data Transfer Mechanisms

For all international data transfers, we implement appropriate safeguards including:

(a) Standard Contractual Clauses (SCCs) approved by:

European Commission
UK Information Commissioner's Office
Other relevant authorities

(b) Binding Corporate Rules where applicable

(c) Data Processing Agreements with service providers that include:

Security requirements
Confidentiality obligations
Data protection standards
Audit rights

(d) Regional data residency arrangements where required by law

(e) Privacy Shield certification where applicable

7.1.3 Service Provider Selection

Our third-party service providers are selected based on:

(a) Compliance with applicable data protection laws (b) Implementation of appropriate security measures (c) Transparency in data processing practices (d) Ability to maintain service levels (e) Commitment to data protection principles

7.1.4 Data Transfer Impact

You acknowledge that cross-border data transfers may result in:

(a) Application of multiple data protection regimes (b) Varying levels of regulatory oversight (c) Different legal rights and remedies (d) Complex compliance obligations

7.2 Regional Requirements

For users in the EU/UK, we comply with GDPR requirements through:

(a) Appropriate legal bases for processing; (b) Data protection agreements; (c) Standard contractual clauses; (d) Data subject rights procedures.

7.2.2 California (CCPA/CPRA)

For California residents, we provide rights under CCPA/CPRA, including:

(a) Right to know what personal information is collected; (b) Right to delete personal information; (c) Right to opt-out of personal information sales; (d) Right to non-discrimination.

7.2.3 Other Jurisdictions

We strive to comply with local data protection requirements while maintaining our primary obligations under Hong Kong law.

8. User Rights and Choices

8.1 Access and Control

Subject to applicable law, you may have rights to:

(a) Access your personal information; (b) Correct inaccurate data; (c) Request deletion of data; (d) Export your data; (e) Restrict processing; (f) Object to processing; (g) Withdraw consent.

8.2 Limitations

Your rights may be limited by:

(a) Legal requirements; (b) Technical limitations; (c) Legitimate business needs; (d) Other users' rights; (e) Security considerations.

9. Cookies, Local Storage, and Client-Side Data

9.1 Types of Client-Side Storage

9.1.1 Cookies

We utilize various types of cookies:

(a) Essential Cookies (Strictly Necessary)

Authentication and security
Session management
Load balancing
User interface customization
These cookies are necessary for the Service to function and cannot be disabled

(b) Functional Cookies

Language preferences
Region settings
Personalized features
User interface customization
Last-visited settings

(c) Performance and Analytics Cookies

Usage patterns
Traffic sources
Error monitoring
Performance metrics
Feature usage statistics

(d) Third-Party Cookies

Analytics services
Monitoring tools
Content delivery networks
External integrations
Payment processors

9.1.2 Local Storage

We utilize browser local storage for:

(a) Application State

User preferences
Interface settings
Feature flags
Cached configurations
Performance optimizations

(b) Offline Functionality

Cached data
Offline-first features
Local data synchronization
Temporary storage
Draft content

9.1.3 Session Storage

We utilize session storage for:

(a) Temporary Data

Current session state
Form data
User activity
Navigation history
Temporary preferences

(b) Security Features

Authentication tokens
Session identifiers
Security checks
Rate limiting data
Fraud prevention

9.1.4 IndexedDB and Web SQL

We may utilize client-side databases for:

(a) Offline Applications

Local data caching
Offline-first features
Large dataset storage
Binary data storage
File caching

(b) Performance Optimization

Frequently accessed data
User-specific content
Application resources
Media caching
Search indexes

9.2 Regulatory Compliance

In compliance with EU regulations, we:

(a) Obtain explicit consent before setting non-essential cookies:

Clear and specific consent requests
Granular cookie category controls
Right to withdraw consent
Regular consent renewal
Cookie preference center

(b) Provide detailed information about:

Cookie purposes
Data collection practices
Storage duration
Third-party recipients
Privacy implications

(c) Implement technical measures:

Cookie consent management
Cookie blocking mechanisms
Consent recording
Audit trails
Preference management

Our cookie consent banner:

(a) Appears on first visit to the Service

(b) Contains:

Clear description of cookie usage
Purpose categories
Accept/Reject options
Link to detailed cookie policy
Third-party disclosure

(c) Allows granular control over:

Functional cookies
Analytics cookies
Advertising cookies
Third-party cookies

(a) Duration and Expiry:

Session cookies expire when browser closes
Persistent cookies have defined expiration dates
Maximum cookie lifetime of 12 months
Regular cookie audit and cleanup
Automatic expiration enforcement

(b) Cookie Refresh:

Consent renewal requirements
Cookie rotation schedules
Security token updates
Preference confirmation
Setting validation

9.3 Control and Choices

9.3.1 User Controls

You may control client-side storage through:

(a) Browser Settings:

Cookie blocking
Third-party cookie controls
Site-specific permissions
Storage clearing
Privacy modes

(b) Service Preferences:

Cookie consent management
Feature-specific settings
Storage optimization
Data retention controls
Synchronization options

(c) Privacy Tools:

Cookie blockers
Privacy extensions
Tracking prevention
Storage limitations
Security enhancements

9.3.2 Implications of Control Choices

(a) Essential Functionality:

Certain features require client-side storage
Service limitations without cookies
Performance impacts
User experience effects
Security implications

(b) Optional Features:

Personalization limitations
Reduced functionality
Alternative methods
Manual settings
Feature availability

9.4 Security Measures

9.4.1 Client-Side Data Protection

We implement security measures for client-side data:

(a) Encryption:

Sensitive data encryption
Secure storage mechanisms
Transport security
Key management
Data isolation

(b) Access Controls:

Origin restrictions
Domain isolation
Script controls
Third-party limitations
Security headers

9.4.2 Data Minimization

We follow data minimization principles:

(a) Storage Limitations:

Minimum necessary data
Regular cleanup
Size restrictions
Expiration enforcement
Redundancy elimination

(b) Purpose Limitation:

Specific use cases
Justified storage
Regular review
Documentation
Audit trails

9.5 Disclaimer of Liability

While we implement reasonable security measures, you acknowledge:

(a) Client-side storage inherently carries risks (b) Browser and device settings may affect functionality (c) Third-party tools may interact with stored data (d) We are not liable for:

Unauthorized access to client-side storage
Data loss due to browser/device settings
Third-party interference
User-initiated data clearing
Technical limitations

9.6 Updates and Changes

We reserve the right to:

(a) Modify client-side storage practices (b) Update security measures (c) Adjust compliance mechanisms (d) Enhance user controls (e) Implement new technologies

Changes will be reflected in this Policy and may require renewed consent.

10. Liability and Disclaimers

10.1 Limitation of Liability

To the maximum extent permitted by law, we disclaim liability for:

(a) Data breaches or unauthorized access; (b) Data loss or corruption; (c) Third-party service provider actions; (d) Force majeure events; (e) User misuse or negligence.

10.2 Jurisdictional Limitations

While we strive to comply with various privacy laws, we:

(a) Make no representations about compliance with laws of any specific jurisdiction; (b) Limit our liability to the maximum extent permitted by Hong Kong law; (c) Process data primarily under Hong Kong law and jurisdiction.

11. Changes to Privacy Policy

11.1 Policy Updates

We may update this Policy by:

(a) Posting revisions on our website; (b) Notifying users of material changes; (c) Obtaining consent where required by law.

11.2 Continued Use

Your continued use of the Service after changes constitutes acceptance of the updated Policy.

12. Contact Information

For privacy-related inquiries:

Data Protection Officer Trove Limited 510 Wayson Commercial Building, 28 Connaught Road West, Sheung Wan, Hong Kong Email: privacy@[company].com Phone: [Hong Kong phone number]

For jurisdictional representatives:

EU Representative: [Details if applicable]
UK Representative: [Details if applicable]
California Privacy Rights: california-privacy@[company].com

13. Data Security, Breaches, and Third-Party Services

13.1 Data Security Overview

The security of your information is important to us, but no method of electronic storage or transmission over the Internet can be guaranteed to be 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security. By using our Service, you acknowledge and accept the inherent risks associated with storing, processing, and transmitting data electronically.

Our Service operates within a complex ecosystem of third-party providers, including but not limited to cloud infrastructure providers, data center operators, network service providers, security service vendors, and other technology partners. While we exercise reasonable care in selecting and managing these providers, we cannot control and are not responsible for the security measures, actions, or inactions of these third parties.

13.2 Security Measures and Limitations

We implement and maintain reasonable security measures designed to protect your data from unauthorized access, disclosure, alteration, and destruction. These measures are regularly reviewed and updated to reflect current technological capabilities and industry practices. However, you expressly acknowledge and agree that we do not guarantee the effectiveness of these measures against all security threats or breaches.

Our security program includes:

Encryption of data in transit and at rest
Access control and authentication systems
Network security monitoring
Regular security assessments
Employee security training
Incident response procedures

The effectiveness of these measures depends on numerous factors beyond our control, including:

The security of third-party systems and services
The reliability of network infrastructure
The security practices of our users
The evolution of security threats
The limitations of current technology

13.3 Data Breach Response and Notification

13.3.1 Breach Response Protocol

In the event we become aware of a security breach that affects your personal information, we will act in accordance with our incident response plan and applicable legal requirements. However, you acknowledge and agree that the detection, characterization, and notification of security incidents involve complex technical and operational considerations, and the timing and content of any notifications will be determined at our reasonable discretion in accordance with applicable laws.

13.3.2 Third-Party Breach Events

With respect to security breaches or incidents occurring within or affecting third-party systems or services:

We expressly disclaim any responsibility or liability for:

Security breaches occurring within third-party systems
Delays in breach detection by third parties
The adequacy of third-party breach responses
The effectiveness of third-party security measures
The accuracy or completeness of third-party breach notifications

13.4 Third-Party Services and Infrastructure

13.4.1 Service Provider Relationships

Our Service relies on various third-party service providers for critical infrastructure and operational capabilities. While we maintain contractual relationships with these providers that include security and privacy obligations, you expressly acknowledge and agree that we:

(a) Do not control the operations, facilities, networks, or security measures of any third-party provider;

(b) Cannot guarantee the performance, reliability, or security of third-party services;

(c) Are not responsible for any acts, errors, omissions, or failures of any third-party provider;

(d) May change, replace, or discontinue third-party providers at our discretion;

(e) Do not warrant the effectiveness of any third-party security measures.

13.4.2 Infrastructure Provider Exclusions

With respect to cloud infrastructure, hosting, and data center providers, you specifically acknowledge that we:

(a) Rely on the security measures and capabilities provided by these services;

(b) Cannot independently verify or guarantee the effectiveness of their security measures;

(c) Are bound by their operational and technical limitations;

(d) Must accept their standard terms of service and operational procedures;

(e) Cannot control their personnel, policies, or security practices.

13.5 Limitation of Liability for Security Events

Notwithstanding any other provisions of this Policy or any applicable agreements, and to the maximum extent permitted by law, we expressly disclaim and shall not be liable for any damages, losses, expenses, or claims arising from or relating to:

(a) Security breaches or unauthorized access to data, regardless of cause;

(b) Data loss, corruption, or unauthorized disclosure;

(c) Any acts, errors, omissions, or failures of third-party service providers;

(d) Delays in detecting or notifying of security incidents;

(e) The effectiveness or failure of security measures;

(f) Any consequential, incidental, or punitive damages related to security events;

(g) Costs of breach response, mitigation, or remediation;

(h) Regulatory fines or penalties related to security events;

(i) Claims by third parties resulting from security incidents.

13.6 User Responsibilities

While we implement reasonable security measures, the effectiveness of these measures depends in part on user actions and cooperation. You are responsible for:

(a) Maintaining the security of your account credentials;

(b) Implementing appropriate security measures within your organization;

(c) Promptly reporting suspected security incidents;

(d) Cooperating with security investigations when requested;

(e) Complying with our security requirements and recommendations.

13.7 Changes to Security Measures

We reserve the right to modify our security measures at any time based on:

Evolving security threats
Changes in technology
Regulatory requirements
Operational needs
Third-party service provider changes

Such modifications may occur without prior notice, and your continued use of the Service constitutes acceptance of such changes.

13.8 Force Majeure Events

We shall not be liable for any failure or delay in implementing security measures or responding to security incidents resulting from circumstances beyond our reasonable control, including but not limited to:

Natural disasters
Acts of war or terrorism
Cyber attacks
Pandemics
Government actions
Infrastructure failures
Third-party service disruptions

By using our Service, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and disclosure of your personal information as described herein.