Privacy Policy

1. Introduction and scope

This Privacy Policy explains how HK OSVERIR CO., LIMITED ("OSVERIR", "we", "us" or "our") handles personal information in connection with our corporate website at ruihengt.com (the "Website") and our mobile applications published on the Apple App Store and Google Play (together, the "Apps" and each an "OSVERIR Service").

OSVERIR is a Hong Kong company engaged in enterprise management consultation, project planning, cross-border trade, import and export of goods, wholesale and retail of mechanical equipment, building materials and consumer goods, business agency, exhibition service and technical information consultation. Because we operate across jurisdictions, we apply a single global privacy standard that satisfies the strictest applicable requirements, while also honouring the additional rights that individual regions provide.

This Policy applies to personal information we collect through the Website, the Apps, our customer and supplier onboarding processes, business correspondence, and any other channel described in section 2. It does not apply to information that is wholly controlled by a third party, such as an app store, a payment processor or an advertising network that operates independently of our instructions, except to the extent we are responsible for it.

2. Information we collect

We collect the following categories of personal information. Not every category applies to every interaction; the categories below describe the full scope of what we may hold.

2.1 Account and registration information

• Name, business or company name, job title, and role within your organisation.
• Business email address, telephone number, and postal address, including our office address for correspondence.
• Account credentials, including your username, password hash, device tokens and app identifiers used to keep your account secure and your session active.
• Company registration details, tax identification numbers, and bank information, where a trade, distribution or agency engagement requires verification or invoicing.
• Identity verification records, where required for sanctions screening, customs documentation or regulated transactions.

2.2 Device and technical information

• Device type, model, manufacturer, operating system and version, app version, and browser type.
• IP address, which may be treated as personal information where local law so provides.
• Screen resolution, language and locale settings, time zone, and region settings.
• Crash logs, diagnostic information, performance data, and interaction records such as taps, scrolls and screen-view events.
• Unique device identifiers, including the Apple Advertising Identifier (IDFA) and the Android Advertising Identifier (AAID), together with any vendor or app-scoped identifiers generated by our advertising and analytics partners.

2.3 Usage and interaction information

• Pages visited, features used, search terms entered, and the content of your activity within the Apps, such as orders viewed, inventory searches and shipment tracking requests.
• Approximate location inferred from your IP address at the city or regional level, used to present local pricing, local regulatory notices and suitable content.
• Advertising interaction data, including impressions, clicks, installs, conversions and attribution events, along with the advertising identifiers associated with them.
• Subscription status, notification preferences, and communication preferences.

2.4 Optional location information

Where you grant location permission, we may collect precise or approximate location to support warehouse check-in, delivery verification, on-site exhibition support and regional content personalisation. Location collection is strictly optional. If you decline the permission, the Apps continue to operate, and we simply rely on the city-level estimate described above.

2.5 Advertising identifiers

We and our advertising partners may collect or receive advertising identifiers such as the IDFA, the AAID, cookie identifiers, and vendor-specific IDs. These identifiers are used to measure the effectiveness of advertising, to limit the number of times you see the same advertisement, and to build an audience for relevant promotions, as further described in section 9.

2.6 Communications and support records

• Emails, messages, call notes and meeting minutes exchanged with our business support and key accounts teams.
• Enquiry, quotation and order records, including documentation you submit for customs, import, export and agency purposes.
• Records of your use of the support channels within the Apps or by email to support@ruihengt.com or pengliang@ruihengt.com.

3. How we use information

We use personal information for the following purposes:

• Providing and operating the OSVERIR Services — creating and securing your account, processing orders, managing inventory, tracking supply chain milestones, and delivering real-time order, inventory, supply chain tracking, consulting dashboard, investment planning and wholesale and retail management features.
• Performing our business commitments — carrying out cross-border trade, import and export of goods, wholesale and retail distribution, business agency and exhibition service, and the advisory and planning work described in our services.
• Verifying and documenting transactions — including sanctions and restricted-party screening, customs documentation and quality inspection records.
• Communicating with you — service notices, shipment updates, invoices, quotations, and product or service announcements that you have asked to receive.
• Personalised advertising — as described in section 9, subject to the consent and opt-out controls set out in sections 9 and 12.
• Analytics and improvement — understanding which features are used, resolving faults, and improving the design and performance of the Website and Apps.
• Legal and security obligations — complying with applicable law, enforcing our agreements, and detecting and preventing fraud, abuse and security incidents.
• Aggregated reporting — producing statistical business and market reports in which individual identifiers are not reasonably identifiable.

We do not sell your personal information for money. We do not use the content of your messages, documents or uploads for training machine learning models.

4. Legal bases for processing

Depending on your location, we rely on the following legal bases when processing personal information.

5. Sharing and processing of personal information

We share personal information only with the categories of recipients listed below, and only to the extent needed for the stated purpose:

• Service providers and processors — cloud hosting, content delivery, email delivery, customer support, CRM, payment processing, and IT security providers, each bound by a written contract that limits their use of your information.
• Advertising and analytics partners — as described in section 9, including the networks listed in that section, who act as our processors or as independent controllers for the identifiers they collect directly from your device.
• App store operators — the Apple App Store and Google Play, which process account, payment and diagnostic data under their own terms and privacy policies, including their handling of the Apple ATT prompt and purchase validation.
• Trading, logistics and inspection partners — carriers, freight forwarders, customs brokers, third-party inspection bodies and suppliers, to the extent required to complete a shipment you have requested.
• Professional advisers and authorities — auditors, accountants, lawyers, and regulators or law enforcement, where disclosure is required or permitted by law.
• Corporate transactions — a buyer, investor or successor in a merger, reorganisation or sale of assets, subject to confidentiality obligations.
• With your direction — where you ask us to share information with a specific third party, for example when introducing us to a supplier.

We do not share personal information for money with third parties for their own independent marketing purposes, and we do not disclose information to data brokers.

6. International transfers

We are established in Hong Kong and operate internationally. As a result, personal information may be transferred to, and processed in, other countries — including the Hong Kong SAR, the People's Republic of China, Singapore, the United States, the United Kingdom and the European Economic Area — by our group companies and the service providers listed in section 5.

Where a transfer is subject to the GDPR, the UK GDPR, the LGPD, PIPEDA, the PDPA, the PDPB Act, APPI, PIPA or comparable rules, we use a lawful transfer mechanism. These may include an adequacy decision, the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, an agreement containing equivalent protection clauses, or consent where that is the only available mechanism. Where local law requires consent, we seek it.

We conduct a transfer impact assessment before a new transfer arrangement is put in place, and we apply supplementary safeguards where they are necessary — including encryption of data in transit and at rest, access restrictions, and pseudonymisation of identifiers where the workflow allows it.

7. Retention

We keep personal information only for as long as we need it for the purposes described in this Policy, and for as long as the law requires. Typical retention periods are:

• Account and contact records — for the duration of the relationship and for up to 7 years after the last interaction, to meet contractual, tax and record-keeping obligations.
• Order, shipment and customs documentation — generally 7 years, or longer where a destination jurisdiction requires it, to satisfy customs, tax and trade-compliance record-keeping rules.
• Advertising and analytics event data — typically 13 to 24 months, after which it is aggregated or deleted.
• Server and security logs — up to 24 months, for the investigation of incidents and the detection of abuse.
• Support correspondence — up to 3 years after the case is closed.
• Consent records — for the duration of the consent plus 5 years, so that we can demonstrate that consent was given and was informed.

Where information is no longer required, we delete it or anonymise it so that it can no longer be attributed to an individual.

8. Security

We apply a layered security programme appropriate to the sensitivity of the information we hold, including:

• Encryption in transit using TLS, and encryption at rest for stored customer records.
• Role-based access control, least-privilege administration, and multi-factor authentication for staff and production systems.
• Separation of development, testing and production environments, with production data excluded from test environments wherever possible.
• Logging, monitoring and alerting around authentication, administrative actions and data export.
• Vendor assessment before a processor is engaged, and periodic review of that relationship.
• Incident response procedures, including notification to affected users and to supervisory authorities where the applicable law requires it.
• Staff training on data protection, confidentiality and secure handling, refreshed at least annually.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information and is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay and, where required, within 72 hours of becoming aware.

9. Advertising and monetisation

Our Apps are supported by advertising and may include an optional subscription tier. We and our third-party advertising partners use advertising identifiers and related technologies to serve advertising, to measure its performance and to limit repetition. Certain partners act as our processors on our instructions; others act as independent controllers and collect information directly from your device under their own privacy policies.

9.1 Advertising platforms we work with

The following table lists the advertising platforms that may be integrated with the Apps or the Website, the purpose of each integration, and the link where you can manage your preferences or opt out of that partner's use of your data.

9.2 Personalised and non-personalised advertising

Where the law requires consent, we and our partners serve personalised advertising based on your advertising identifier, app activity, approximate location and inferred interests. Where consent has been declined, we serve non-personalised advertising that is not based on your personal information — it may reflect the general device type, operating system, language, coarse region and the content of the screen you are viewing.

9.3 Consent, Apple ATT and advertising identifiers

• GDPR / UK GDPR consent — where the GDPR or UK GDPR applies, we present a consent interface before non-essential cookies and personalised advertising are set. You may withdraw consent at any time through the "Privacy choices" entry in the app settings or the cookie banner on the Website.
• CCPA / CPRA — we treat advertising identifiers and information they reveal as covered by our "Do Not Sell or Share My Personal Information" commitment, and we honour the Global Privacy Control signal described in section 15.
• Apple App Tracking Transparency (ATT) — on iOS, the system prompt appears when a partner would track you across other companies' apps and websites. If you do not allow tracking, the app serves contextual and non-personalised advertising only. Denying the prompt does not affect any other app function.
• AAID / IDFA — we use the Android Advertising Identifier and the Apple Advertising Identifier only where permitted, and only as described in sections 2.5 and 9. You can reset or limit these identifiers in your device settings.

10. Advertising formats and your controls

Our Apps may display the following advertising formats, each with a clear user control:

We do not use full-screen interstitial ads immediately after a splash screen or at the point of entering a feature, we do not use deceptive close buttons, and we do not design advertising layouts that are mistaken for the app's own interface.

11. Cookies and similar technologies

The Website uses cookies and similar technologies, including local storage, session storage and pixels. We use them to operate the site, to remember your preferences, to keep you signed in, to understand how pages are used and to deliver advertising.

You can control cookies through your browser settings, and you can change your advertising preferences at any time using the opt-out links in the table in section 9.1. Blocking strictly necessary cookies may prevent parts of the site from working.

12. Your rights by region

Depending on where you live, you may hold the rights summarised in the table below. To exercise any of them, email support@ruihengt.com with the subject line "Privacy request". We will verify your identity before acting on a request, and we will not discriminate against you for making one.

We respond to verified requests within the period the applicable law requires — typically 30 days, extendable by a further 60 days where the law permits, in which case we will tell you why. Where we decline a request, we will explain the reason and the route to complain.

13. Children's privacy and age policy

Our Website and Apps are business services intended for business users and are not directed to children. We do not knowingly collect personal information from anyone under the age of 13, and we do not knowingly collect information from users under the age of 16 in a jurisdiction where that is the applicable threshold.

• Where a user is under 13, the parent or guardian must consent to the processing, in line with COPPA in the United States and Article 8 of the GDPR (GDPR-K) in Europe.
• Our Apps carry age ratings in the app stores and are not listed in the children's category. We do not knowingly serve personalised advertising to users we know to be under the applicable age threshold.
• If you believe a child has provided us with personal information, please contact support@ruihengt.com and we will delete it promptly.

14. App store compliance

14.1 Apple App Store

Our Apps are submitted under Apple's App Store Review Guidelines, including the requirements on privacy, the App Privacy Details section and the rules on data collection permitted by the privacy manifest. Where the ATT prompt applies, we explain our purposes before requesting permission and we do not track you if you decline. Apple is an independent controller for the data it processes under its own privacy policy.

14.2 Google Play

Our Apps complete the Google Play Data Safety section, and we declare the categories of data collected, whether the data is shared, whether it is encrypted in transit, and the mechanism by which a user may request deletion. We comply with the Google Play Families policy and do not serve interest-based advertising in apps that are directed at children.

14.3 Deletion of your app account

You can request deletion of your account and associated data at any time by contacting support@ruihengt.com. We will verify the request, then delete or de-identify the data, except where retention is required for legal, tax or customs record-keeping purposes, in which case we will isolate it from further processing.

15. Do Not Track and Global Privacy Control

Some browsers send a "Do Not Track (DNT)" signal and browsers in several US states send a "Global Privacy Control (GPC)" signal. There is no agreed standard for DNT across all browsers, so we treat DNT as one of several signals we consider when deciding whether to serve personalised advertising.

We do honour the Global Privacy Control signal as a legally recognised opt-out mechanism where it applies. When we receive a valid GPC signal, we treat it as a request to opt out of the sale or sharing of personal information and to limit targeted advertising for that browser or device.

16. Changes to this policy

We update this Policy from time to time as our services, partners and legal obligations evolve. We will post the revised version on the Website with an updated "Last updated" date, and where the change is material we will provide a more prominent notice — for example a notice in the app, or by email to registered users — before the change takes effect. We will ask for consent again if a new purpose requires it.

17. How to contact us

If you have a question about this Policy or want to exercise a right, contact us:

Our Data Protection Officer or designated privacy contact will acknowledge your request within a reasonable period and will always respond within the timeframe required by applicable law. You also have the right to complain to your local supervisory authority.

18. Effective date

This Privacy Policy is effective from 1 January 2026 and applies from that date onwards to all processing carried out by HK OSVERIR CO., LIMITED in connection with the Website and the Apps. The "Effective date" field at the top of this document is maintained as the authoritative version date and will be updated whenever this Policy is amended.