$1,845.07

Effective Date: 22 June 2026

Emperio Gold and Silver Coins (Hong Kong) Limited (the “Company”, “we”, “us” or “Emperio”) respects and values the privacy of our customers’ personal data and is committed to complying with the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (the “PDPO”) and applicable guidelines issued by the Office of the Privacy Commissioner for Personal Data. This privacy policy (this “Policy”) explains how we collect, use, disclose, transfer and retain personal data and forms part of the agreement between you and the Company; in case of any inconsistency, this Policy shall prevail.

 

1. Scope of application

This Policy applies to:

• all visitors and registered customers of our website at www.emperiogoldcoins.com;
• existing and prospective customers of the Company (including individual and corporate / institutional customers); and
• personal data collected by the Company through our shops, by telephone, email, WhatsApp, online forms, event registration or any other channels.

Unless otherwise specified, references to “customer” in this Policy also include former customers whose relationship with us has ended, to the extent that we continue to hold their personal data in accordance with applicable laws and this Policy.

 

2. Types of personal data collected

Depending on the nature of the products / services requested and regulatory requirements, we may collect and hold the following categories of personal data.

2.1 Identity data

• full name, gender and date of birth;
• identification document type and number (such as Hong Kong Identity Card or passport);
• nationality, place of residence and, where relevant, tax residency status.

2.2 Contact data

• residential and correspondence address;
• contact telephone number and mobile number;
• email address;
• WhatsApp and other instant messaging account details;
• language preference and communication preferences (where applicable).

2.3 Transaction and account data

• purchase records, product preferences and payment records;
• buy‑back records and related item details (including barcode, product code, weight, fineness, etc.);
• member account profile, points records, cash points balance and related transactional activities.

2.4 Payment and financial data

• bank account details used for refunds and buy‑back payments;
• partial credit card / UnionPay card information (such as last four digits of card number, cardholder name and expiry date; we do not store full card numbers or card security codes);
• details of counterpart financial institutions and relevant account identifiers for settlement or reconciliation.

2.5 Compliance and due diligence data

To comply with applicable laws and regulations (including the Anti‑Money Laundering and Counter‑Terrorist Financing Ordinance) and regulatory guidance, we may collect:

• copies of identification documents;
• address proof (such as utility bills or bank statements);
• information on source of funds and source of wealth (depending on the nature and risk level of the transaction);
• description of the purpose and nature of transactions;
• information relating to ultimate beneficial owners (UBOs), directors and authorised persons where the customer is a company or legal entity.

2.6 Technical and usage data

• IP address, device information, operating system and browser type;
• access dates and times, browsing history and click records;
• information collected via cookies and similar technologies (see Section 12 below).

2.7 Customer service and security data

• records of customer interactions (including but not limited to call recordings, email correspondence, WhatsApp conversations and online enquiries);
• CCTV footage taken at our shops for security, incident investigation and dispute resolution purposes.

Where certain data is indicated as “mandatory” at the time of collection, failure to provide such data may result in our inability to open or maintain an account for you, process your request, complete a transaction or provide the relevant services.

 

3. Purposes of use of personal data

We will use personal data in a lawful, fair and transparent manner for one or more of the following purposes:

• providing, operating and managing our day‑to‑day products and services, including processing orders, reservations, delivery and buy‑back arrangements;
• verifying customer identity and establishing, maintaining and administering customer accounts and profiles;
• processing payments, refunds, buy‑back and other settlement transactions;
• providing customer services, handling enquiries, feedback and complaints, and managing disputes;
• assessing and managing credit risks, debt recovery, restructuring or set‑off;
• complying with legal, regulatory, anti‑money laundering, tax and compliance obligations (see Section 5 below);
• conducting audit, compliance review and internal risk management;
• designing, improving and tailoring our products, services and promotions based on customer needs and preferences;
• subject to your prior express consent, using your personal data for direct marketing (see Section 4 below);
• conducting market research, data analytics and statistical analysis to enhance customer experience and operational efficiency, where reasonably practicable on an anonymised or aggregated basis;
• detecting, investigating and preventing fraud, misuse, security incidents and other unlawful or improper activities;
• carrying out due diligence and transition arrangements in connection with any business transfer, merger, reorganisation or sale (where permitted by law);
• for online FPS payments, verify the payer’s identity and the order information.
• other purposes directly related to any of the above.

 

4. Direct marketing

4.1 Types of data to be used

Upon obtaining your prior written express consent (which may include an indication of no objection), we may use the following personal data for direct marketing purposes:

• name;
• contact telephone and mobile number;
• email address;
• correspondence address;
• language and product preferences;
• past purchase records and participation in promotions / events.

4.2 Classes of marketing subjects

The Company and its group / affiliated companies (including without limitation Emperio Gold and Silver Coins , Emperio Precious Metals, Emperio Gold Bullion, Emperio Consulting, Emperio Credit and Emperio Securities And Assets Management) may market the following classes of products and services to you:

• gold, silver, platinum and other precious metals products;
• collectible coins, commemorative coins, limited‑mintage issues and related collectibles;
• precious metals investment and wealth preservation related products or schemes;
• buy‑back, storage, custody, gold savings plans and similar services;
• membership programmes, exclusive offers, promotions, events, workshops and market information;
• other products or services relating to precious metals, financial services or wealth management offered by us or our affiliates.

4.3 Direct marketing channels

We may contact you for direct marketing through one or more of the following channels:

• email;
• SMS or text messages;
• WhatsApp and other instant messaging tools;
• telephone calls;
• postal mail;
• personalised messages or notifications via our website, mobile applications or other platforms operated by us;
• any other communication channels we may lawfully adopt from time to time.

4.4 Consent requirement

We will not use your personal data for direct marketing, nor provide your personal data to others for their direct marketing purposes, without first obtaining your written express consent (including an indication of no objection) as required under the PDPO. You may provide, vary or withdraw your consent:

• when registering an account or making your first transaction with us;
• when participating in any promotion / event or completing any form; or
• at any time thereafter by written or electronic means as specified by us from time to time.

4.5 Provision of data to affiliates for direct marketing

Subject to your separate, specific written consent, we may provide your personal data to our group / affiliated companies for their use in direct marketing the classes of products and services set out in Section 4.2 above; such provision does not involve any monetary gain on our part.

4.6 No sale of personal data

We do not sell customers’ personal data to any third party under any circumstances.

4.7 Right to opt‑out and withdraw consent

You may at any time, without charge, request us to cease using your personal data for direct marketing or withdraw your consent previously given, by:

• sending an email to [email protected];
• writing to our Data Protection Officer at our correspondence address;
• following the unsubscribe or “stop” instructions contained in any direct marketing communications; or
• calling our customer service department.

Upon receipt of your opt‑out or withdrawal request, we will process it within a reasonable period (normally not exceeding 14 days) and will cease the relevant direct marketing activities accordingly.

 

5. Processing of personal data for legal and compliance purposes

5.1 Legal and regulatory background

The Company is a precious metals dealer registered with the Hong Kong Customs and Excise Department and is subject to various laws, regulations and regulatory guidelines, including anti‑money laundering and counter‑terrorist financing requirements and the PDPO.

5.2 Collection and retention of compliance data

We may collect and retain compliance‑related data in the following circumstances:

• where transactions involve large amounts or are assessed as higher risk;
• where we consider it necessary, based on risk assessment, to further understand the customer or transaction background;
• where required by law, regulation or requests from regulators or law enforcement agencies;
• in other circumstances where we reasonably consider that enhanced customer due diligence is necessary.

5.3 Disclosure to law enforcement and regulatory bodies

To the extent permitted or required by law, we may disclose personal data to:

• Hong Kong Customs and Excise Department;
• Hong Kong Police Force and other law enforcement agencies;
• Inland Revenue Department;
• financial intelligence and anti‑money laundering authorities;
• any authorities or persons having the right to require disclosure under applicable laws, regulations or court orders.

5.4 Suspicious transaction reports

Where we are required by applicable laws to file suspicious transaction reports (for example to the Joint Financial Intelligence Unit), such reports are typically subject to statutory secrecy provisions and we will not, and are not obliged to, inform you whether or not such a report has been made.

 

6. Categories of data transferees

Subject to the PDPO and applicable guidelines, we will treat personal data in strict confidence and will only disclose such data to the following categories of transferees on a need‑to‑know basis:

• agents, contractors and third‑party service providers who provide business support services to us, including but not limited to:
  • courier and logistics providers;
  • payment and settlement service providers;
  • cloud hosting, systems hosting and other IT service providers;
  • email and communication service providers;
  • data analytics, customer relationship management (CRM) and marketing automation service providers;
  • legal, accounting, tax and other professional advisers;
• our parent company, subsidiaries and other group / affiliated companies;
• any person under a duty of confidentiality and who has undertaken to keep such information confidential and use it only for the specified purposes;
• banks, financial institutions or payment institutions with whom the customer has or proposes to have dealings, for the purposes of transaction confirmation, settlement or compliance;
• any actual or proposed assignee, participant, sub‑participant or transferee of our rights in respect of our customers;
• any person or authority to whom disclosure is required by applicable laws, regulations or court orders, or where we reasonably consider it necessary to protect our rights, property or safety or that of our customers;
• any third party with your express consent.

Where we engage data processors or service providers, we will, by contract or other means, require them to comply with applicable data protection laws and adopt appropriate security measures.

 

7. Processing of payment data

7.1 Credit card and UnionPay card payments

Transactions made by credit card or UnionPay card are processed by compliant payment service providers, and we do not store full card numbers or card security codes (CVV / CVC). We generally only receive and retain transaction authorisation results and partial card data (such as the last four digits of the card number) for verification and accounting purposes, which are subject to the security standards and measures imposed by the relevant payment networks and service providers.

7.2 Bank transfers, FPS and other e‑payments

For bank transfers, FPS or other electronic payment methods, we may collect and use the following data to confirm and reconcile payments:

• payer’s name;
• transaction reference number;
• amount, date and time of payment;
• details of the relevant bank or payment institution.

7.3 Fraud prevention and risk monitoring

For anti‑fraud, risk management and compliance purposes, we may record IP addresses, device information and technical data associated with transactions, and share such data with payment service providers or relevant institutions where necessary to detect and prevent suspicious transactions or unlawful activities.

 

8. Cross‑border data transfers

Given the cross‑border nature of our precious metals business, we may transfer personal data to locations outside Hong Kong for the purposes set out in Section 3, including without limitation:

• placing orders with overseas mints, suppliers or business partners;
• arranging international logistics and shipment;
• using cloud services or IT systems hosted outside Hong Kong;
• engaging overseas legal, accounting, tax, compliance and other professional advisers;
• executing cross‑border transactions and services requested by customers.

 

Before effecting any cross‑border transfer, we will take reasonably practicable steps to ensure an appropriate level of protection, including:

• entering into binding data processing agreements with data recipients;
• where reasonably practicable, ensuring that the data protection regime of the recipient provides a level of protection comparable to that under Hong Kong law;
• limiting the personal data transferred to what is necessary to achieve the relevant purposes;
• applying encryption or other security technologies when transmitting sensitive data.

Customers may contact our Data Protection Officer for further details about the locations to which their personal data may be transferred.

 

9. Data retention

We will not keep personal data longer than is necessary for fulfilling the purposes for which the data was collected or for any directly related purposes, subject to applicable legal or regulatory requirements. In general:

• Account duration: while your account remains active, we will retain all data necessary to operate your account and provide services.
• Legal and compliance data: identity and transaction records and related documents will normally be retained for at least 5 years after termination of the customer relationship or the last transaction, in order to comply with anti‑money laundering and other legal requirements, or for such longer period as required by law.
• Financial and tax records: financial and tax‑related transaction records will generally be retained for 7 years or such longer period as may be required under applicable accounting and tax laws.
• General customer data: where the data is no longer required for any legal, regulatory, dispute resolution or operational purposes, we will generally delete or anonymise such data within 2 years after account closure.
• Direct marketing consent and opt‑out records: records of consents and subsequent withdrawals will normally be retained for at least 2 years after withdrawal of consent or account closure, for the purpose of demonstrating our compliance with direct marketing requirements.
• CCTV footage: CCTV recordings are normally retained for around 30 to 90 days, unless a longer retention period is required for security incident investigation, dispute resolution or legal proceedings.

After the expiry of the relevant retention periods, we will take reasonably practicable steps to erase, anonymise or otherwise handle personal data, unless retention is required by law or justified on public interest grounds.

 

10. Data security measures

We maintain appropriate technical, organisational and physical security measures to protect personal data against unauthorised or accidental access, processing, erasure, loss or use.

10.1 Technical measures

• use of encryption technologies (such as SSL / TLS) to protect data transmission between our website and servers;
• access control and role‑based permissions for our databases and systems;
• deployment of firewalls, intrusion detection and other security monitoring tools;
• regular security updates, vulnerability scans and penetration testing;
• processing of payment data by compliant payment service providers, without storage of full card numbers or card security codes on our systems.

10.2 Organisational measures

• confidentiality undertakings and adherence to information security and privacy policies by our staff;
• granting access to personal data strictly on a “need‑to‑know” basis;
• regular staff training on privacy, data protection and security awareness;
• appointment of a Data Protection Officer to oversee our personal data governance and compliance framework;
• implementation of written security policies, incident reporting and response procedures.

10.3 Physical measures

• storage of hard copy documents in locked cabinets or safes with access control;
• use of access control systems, surveillance devices and visitor registration at our offices and shops;
• restricting unauthorised access to areas where personal data is processed or stored.

10.4 Handling of data breach incidents

In the event of an actual or suspected data breach, we will follow our internal procedures to investigate, assess the impact and, where appropriate and practicable, notify affected individuals and / or relevant authorities in accordance with applicable requirements and best practices.

 

11. Your rights

Subject to applicable legal requirements and exemptions, you have the following rights under the PDPO:

• Right of access: to enquire whether we hold your personal data and, if so, to request a copy of such data (or a reasonably intelligible summary);
• Right of correction: to request the correction of any inaccurate or incomplete personal data held by us;
• Right to information: to enquire about our policies and practices in relation to personal data and the kinds of personal data held by us;
• Right to withdraw consent: to withdraw your consent for direct marketing or other purposes where consent can lawfully be withdrawn;
• Right to lodge complaints: to lodge a complaint with us and, where appropriate, with the Office of the Privacy Commissioner for Personal Data, Hong Kong.

We may charge a reasonable fee to cover the administrative cost of processing data access requests, in accordance with the PDPO.

 

12. Cookies and similar technologies

Our website uses cookies and similar technologies to enhance user experience, analyse site usage and improve our services. These include:

• strictly necessary cookies: required for basic site functions (such as shopping cart and login sessions), which cannot generally be disabled without affecting the operation of the site;
• functional cookies: used to remember your preferences, such as language, currency and regional settings;
• analytics cookies: used to collect anonymised statistical information about site usage for performance and design improvements;
• marketing cookies: used to deliver personalised content, advertising and remarketing.

You may manage or delete cookies via your browser settings, and you may also manage certain preferences through any cookie settings page provided on our website (excluding strictly necessary cookies). However, disabling some cookies may affect the functionality and performance of the website.

 

13. Personal data of minors

Our products and services are primarily intended for persons aged 18 or above, and we do not knowingly target minors. If a parent or guardian becomes aware that a minor has provided personal data to us without their consent, they should contact our Data Protection Officer as soon as possible; upon verification, we will take appropriate steps (including deletion or restriction of use of such data), unless retention is required by law.

 

14. Updates to this Policy

We may from time to time amend or update this Policy to reflect changes in our business operations, technologies, legal or regulatory requirements or best practices. Updated versions will be published on our website with the effective date indicated, and material changes may be highlighted on our website or notified to you through other appropriate channels. You are encouraged to review this Policy periodically to stay informed of our latest practices.

 

15. Contact us

If you wish to exercise any of your rights, make enquiries about this Policy, provide feedback or lodge a complaint, or contact us on any privacy‑related matters, please reach us via:

 

Data Protection Officer
Emperio Gold and Silver Coins (Hong Kong) Limited
Address: 21/F, AT Tower, 180 Electric Road, North Point, Hong Kong
Email: [email protected]
Website: www.emperiogoldcoins.com

We will respond to your requests or enquiries within a reasonable period of time.