Terms & Conditions

Privacy Policy
Effective Date: 05 JULY 2025
Xmastree Ltd. – All Rights Reserved

Xmastree Ltd. ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website and use our services. This Policy applies solely to our operations in Hong Kong SAR but is written to also comply with the EU General Data Protection Regulation (GDPR) where applicable.

1. Data Controller

Xmastree Ltd.
Registered in Hong Kong SAR
Email: info@xmastreeonline.hk
Website: https://xmastree.online

2. Types of Personal Data Collected

We collect the following categories of personal data:

  • Identity and Contact Data: Name, email address, phone number, delivery address.

  • Payment Data: Credit card details, billing information, and other payment details.

  • Usage Data: IP address, browser type, referring/exit pages, device information.

  • Cookie Data: Please refer to our [Cookie Policy] for detailed information.

  • Social Media Interaction Data: When you engage with Instagram or Facebook widgets.

3. Legal Basis for Processing (GDPR where applicable)

We process your personal data on the following legal bases:

  • Performance of a contract (e.g., fulfilling orders).

  • Compliance with legal obligations.

  • Legitimate interests (e.g., fraud prevention, website improvement).

  • Consent (e.g., marketing or cookies – where required).

4. Purposes of Data Processing

We use your personal data to:

  • Process and fulfill orders, including payment and delivery.

  • Communicate with you regarding your order or customer service inquiries.

  • Improve our website, services, and marketing.

  • Comply with legal and regulatory obligations.

  • Display content and allow interaction with third-party services (e.g., Instagram, Facebook).

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance user experience and analyze website usage. This includes necessary, performance, and marketing cookies.

Personal Data collected: Cookies.
Place of processing: See our Privacy Policy 
Privacy Shield participant (for applicable services).

See our [Cookie Policy] for full details.

6. Third-Party Services and Platforms

Displaying Content from External Platforms

We integrate third-party platforms that may collect data even if you don’t interact directly.

Instagram Widget (Instagram, Inc.)
Displays image content from Instagram.

  • Personal Data collected: Cookies and Usage Data

  • Place of processing: See our Privacy Policy 

Interaction with External Social Networks

Facebook Like Button and Social Widgets (Facebook, Inc.)
Enables interaction with Facebook directly from our website.

  • Personal Data collected: Cookies and Usage Data

  • Place of processing: See our Privacy Policy 

  • Privacy Shield participant

7. Selling Goods and Services Online

We collect data required to:

  • Process payments (including international credit cards).

  • Arrange product delivery, including drop-shipping through third-party partners.

  • Fulfill customer service obligations.

Payment Information: May include credit card numbers, bank account details, and other payment credentials depending on the method used. We use secure third-party payment processors to handle all transactions. We do not store full card information.

8. International Transfers

While we operate in Hong Kong, data may be processed or stored in other jurisdictions (e.g., the United States) through third-party service providers. Where applicable, we ensure appropriate safeguards such as Standard Contractual Clauses (SCCs) or rely on Privacy Shield-certified vendors (where valid).

9. Data Retention

We retain personal data only as long as necessary to fulfill the purposes stated above or to comply with legal obligations (e.g., tax or accounting requirements).

10. Data Subject Rights

Where GDPR applies, you have the right to:

  • Access your data

  • Correct inaccuracies

  • Erase data (“right to be forgotten”)

  • Restrict or object to processing

  • Data portability

  • Withdraw consent at any time

To exercise your rights, contact us at info@xmastreeonline.hk

11. Security of Personal Data

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, disclosure, or destruction. This includes SSL encryption, access control, and secure payment systems.

12. Children’s Privacy

Our services are not intended for persons under 18. We do not knowingly collect personal data from children without parental consent.

13. Changes to This Policy

We reserve the right to update this Privacy Policy. Changes will be posted on this page with an updated effective date.

14. Contact Us

If you have any questions about this Privacy Policy, please contact:

Xmastree Ltd.
Email: info@xmastreeonline.hk
Address: 1104A, Kai Tak Comm. Bldg., 317-319 Des Voeux Rd Central, Sheung Wan

Last Updated: 22 AUG 2025
© Xmastree Ltd. 2025. All Rights Reserved.