英国华福隐私协议
版本号:1.0
生效日期:2026年9月1日
英国华福尊重并重视您的隐私。本隐私协议说明我们在您访问、注册、登录或使用英国华福网站及相关服务时,如何收集、使用、保存、共享和保护您的个人信息,以及您依法享有的权利。
本协议依据英国《通用数据保护条例》(UK GDPR)、英国《2018年数据保护法》(Data Protection Act 2018)以及适用的《隐私与电子通信条例》(PECR)制定。如果您不同意本协议,请不要提交个人信息或继续使用需要账户的服务。
一、数据控制者
法定名称:UK Hua Fu
商业名称:英国华福
电话或 WhatsApp:07778139777
微信:H07778139777
本协议中的“英国华福”“平台”“我们”或“我们的”,均指上述数据控制者。如对个人信息处理有疑问或希望行使权利,请联系我们。
二、本协议适用范围
本协议适用于浏览店铺和商业信息;手机号、邮箱或Google账户注册和登录;买家账户及买家中心;店铺资料提交、管理和推广;收藏、浏览记录、咨询、预约或看店请求;会员、推广、订单和付款;客服、投诉、安全及账户管理。本协议不适用于第三方独立运营的网站、店铺或服务。
三、我们收集哪些个人信息
1. 账户与身份信息
我们可能收集姓名或显示名称、邮箱、英国手机号及其统一格式、验证状态和时间、密码散列、账户角色、语言和地区偏好、最后登录时间、账户状态及安全记录。我们不以明文保存登录密码。
2. Google登录信息
选择Google登录时,我们可能从Google收到唯一标识、姓名、邮箱、头像及经您授权的基础资料。我们不会收到或保存您的Google密码,Google自身的处理适用其隐私政策和条款。
3. 手机验证信息
首次注册、设置或找回密码时,我们可能处理英国手机号、验证码请求时间、验证结果、状态和时间,以及防止滥用所需的请求次数、IP地址或安全记录。Twilio Verify协助发送和验证短信。我们不会通过聊天、客服截图或公开渠道索取验证码。
4. 店铺和商业资料
提交、管理或推广店铺时,我们可能收集店铺名称、经营者或联系人、电话、邮箱、社交媒体、地址、服务地区、营业时间、类别、服务内容、图片、标志、菜单、价格、推广资料、公司登记、执照、保险、专业资质、订单、会员、推广以及审核、修改和投诉记录。未经授权不得提交他人的资料。
5. 买家活动信息
可能包括收藏、浏览记录、咨询、预约、看店请求、提醒、评价、反馈、举报、会员或VIP状态和客服通信。
6. 付款与交易信息
如启用付款,我们可能处理订单号、金额、币种、付款及退款状态、账单联系人、支付服务商交易标识及会计、税务、防欺诈和争议所需记录。付款可能由Stripe或页面注明的其他服务商处理;除非明确说明,我们不保存完整卡号或安全码。
7. 技术和安全信息
可能自动收集IP地址、浏览器、设备、操作系统、访问时间、请求和来源页面、登录退出和验证活动、错误日志、安全事件、会话标识以及防欺诈、限流和反自动化攻击信息。我们目前不会因访问网站而读取通讯录、短信内容、SIM卡IMSI、IMEI、应用列表或精确位置,除非未来新增功能并事先说明及取得必要许可。
8. 您主动提供的信息
客服、投诉、侵权举报或争议处理中,我们会处理您主动提交的信息和证据。请勿通过普通聊天、微信截图或公开渠道发送密码、验证码、数据库连接信息、银行卡安全码、不必要的身份证件或无关敏感信息。
四、信息来源
信息可能来自您直接提交、您使用功能时自动产生、经授权的Google账户、Twilio等验证服务、支付服务商、店铺申请人或授权代表、依法公开的公司或专业登记,以及其他用户的咨询、投诉或举报。并非直接从您处取得时,我们会在法律要求的期限和方式内提供相关隐私信息。
五、我们为什么使用个人信息
1. 履行合同或订立合同前的措施
用于创建和管理账户、提供登录与验证、买家中心、收藏、咨询和提醒、店铺资料管理、会员推广、订单付款、退款、客服及账户关闭。
2. 履行法律义务
用于税务、会计和消费者保护;响应法院、监管或执法机关;处理数据权利请求;保存法定交易记录;调查欺诈、侵权或违法内容;履行安全和泄露通知义务。
3. 合法利益
在不会不合理损害您的权利时,用于安全、防欺诈和垃圾信息、故障诊断、改善性能和体验、维护资料质量、处理投诉和索赔、生成不直接识别个人的统计及保护合法权益。您可基于自身情况反对。
4. 同意
法律要求时,我们会为非必要Cookie、需要同意的电子营销、可选信息或未来设备权限取得明确同意。您可随时撤回,且不影响撤回前处理的合法性。
5. 法律索赔与重大利益
必要时,我们可为提出、行使或抗辩法律索赔,或保护个人重大利益而处理信息。
六、协议勾选与同意记录
注册或登录时可能要求勾选用户协议和隐私协议。用户协议的接受主要构成合同安排;隐私协议用于说明处理方式,并不意味着所有处理均以同意为依据。我们可能记录协议名称和版本、接受时间、账户及防欺诈或证明接受行为所需的技术记录。重大修改时可能要求重新确认。
七、Cookie、本地存储和类似技术
严格必要技术用于登录会话、安全、防止跨站请求伪造、保存语言或隐私选择及提供明确请求的功能,通常无需事先同意。我们也可能保存语言和界面偏好。如未来使用非必要分析、广告、跨站跟踪或营销Cookie,会先说明并在法律要求时取得同意。拒绝非必要Cookie不会妨碍基本功能;删除必要会话Cookie可能导致退出。
八、我们与谁共享信息
我们不会出售您的个人信息。为运营服务,必要时可能与以下接收方共享:
- DigitalOcean等云托管、PostgreSQL数据库、Valkey/Redis、对象存储及备份提供商;
- Twilio Verify等短信验证提供商;
- 您选择使用的Google身份登录提供商;
- Stripe或页面注明的支付服务商;
- 电子邮件、客服或通知服务商;
- 律师、会计师、审计人员、保险机构等专业顾问;
- 依法有权的法院、监管、执法或税务机关;
- 在合并、重组、融资、资产出售或业务转让中采取适当保密措施后的潜在或实际承接方。
代表我们处理信息的服务商应依合同和合法指示处理并采取适当安全措施。
九、店铺公开信息
店铺名称、地址、联系方式、营业时间、服务介绍、图片和推广资料可能依提交者要求公开。请确认有权公开并避免不必要的私人住址、私人手机号或敏感信息。可通过管理功能或客服申请更改或删除。搜索引擎和第三方缓存的更新可能需要额外时间。
十、国际数据传输
Google、Twilio、DigitalOcean或Stripe等服务商可能在英国境外处理或访问数据。向未获英国充分性认定的地区传输时,我们将采用英国认可的充分性规定、国际数据传输协议、国际数据传输附录、适用认证框架或其他法律保障,并在适用时评估风险。您可联系我们了解保障措施。
十一、保存期限
- 账户资料:账户有效期间及关闭、备份覆盖、欺诈防范和法律义务所需期间;
- 手机号和验证状态:账户有效及提供验证所需期间;
- 临时验证码和找回密码授权:仅在完成验证所需的短期内;
- 登录和安全日志:通常不超过12个月,安全事件、欺诈或争议除外;
- 咨询、预约、投诉和客服记录:通常不超过24个月,未解决争议除外;
- 店铺资料:展示、账户或合同期间,以及争议、授权证明或法律义务所需期限;
- 订单、付款、推广和会计记录:依英国税务、会计和法律要求,通常六年;
- 协议接受记录:账户或合同期间及其后合理的合规和争议期限;
- 数据库备份:在受保护的循环备份中暂存,并在正常周期内覆盖;当前生产数据库可能包含最近七日恢复点。
期限届满后,我们会安全删除、匿名化或以其他合法方式处理。
十二、账户注销和信息删除
您可通过账户功能或客服申请关闭账户。我们可能核实身份。关闭时会删除或匿名化不再需要的信息,但法律、税务、会计、防欺诈、未解决投诉退款争议、保护他人权利或正常循环备份所需的信息可能继续保留。删除权并非绝对;如依法拒绝或限制,我们会说明理由。完成删除后资料可能无法恢复。
十三、您的数据保护权利
视处理依据和具体情况,您可能享有知情权、访问权、更正权、删除权、限制处理权、数据携带权、反对合法利益处理权、撤回同意权、反对直接营销权及自动化决策相关权利。英国华福目前不会仅依赖自动化处理作出产生法律或类似重大影响的决定。
请通过本协议中的联系方式行使权利。我们通常在一个月内回复;复杂或大量请求可依法延长并告知原因。为保护信息可能需要合理身份核验。一般无需付费,但明显无理或重复请求可能依法收取合理费用或拒绝。
十四、信息安全
我们采取与风险相适应的措施,包括密码安全散列、敏感环境变量加密、加密网络连接、数据库和后台访问控制、会话和登录安全、验证码有效期和频率限制、备份恢复、安全事件记录调查及最小必要访问。互联网系统无法保证绝对安全。如怀疑未经授权访问,请立即联系我们。发生可能对个人权利和自由造成风险的数据泄露时,我们将依法评估、处理和通知。
十五、儿童信息
账户和商业服务主要面向18周岁以上用户。我们不会有意要求未满18周岁者独立创建账户或提交店铺资料。如认为未成年人未经授权提交了信息,请联系我们。
十六、电子通信和营销
我们可能发送验证码、密码重设、账户安全、订单付款、服务变更及您主动请求的店铺提醒。这些必要服务信息不属于一般营销。需要事先同意的电子营销会先取得适当同意并提供退订方式。您可随时撤回营销同意,且不影响必要的账户和安全通知。
十七、第三方链接
英国华福可能包含第三方店铺网站、地图、社交媒体或其他服务链接。我们不控制第三方处理方式;访问前请阅读其隐私政策。
十八、隐私协议的更新
我们可能因法律、技术、服务或业务变化更新协议,并标明日期和版本。对权利或信息使用方式有重大影响的更新将通过适当方式提前告知;依法需要新同意时会重新征求。
十九、投诉
如果您认为英国华福处理个人信息的方式不当,请先联系我们。您也有权向英国信息专员办公室(Information Commissioner’s Office,ICO)投诉;该权利不受内部投诉程序限制。
二十、联系我们
数据控制者:UK Hua Fu
隐私联系邮箱:[email protected]
电话或 WhatsApp:07778139777
微信:H07778139777
请勿通过微信、WhatsApp或普通聊天发送密码、验证码、完整银行卡信息或不必要的身份证明文件。
UK Hua Fu Privacy Notice
Version 1.0
Effective: 1 September 2026
This Notice explains how UK Hua Fu collects, uses, stores, shares and protects personal data when you visit, register, sign in or use our services, and explains your rights.
It is intended to comply with the UK GDPR, Data Protection Act 2018 and applicable Privacy and Electronic Communications Regulations. If you disagree, do not submit personal data or use services that require an account.
1. Controller
Controller: UK Hua Fu (trading as 英国华福)
Phone/WhatsApp: 07778139777
WeChat: H07778139777
2. Scope
This Notice covers browsing business information; phone, email and Google registration or sign-in; buyer accounts and the Buyer Centre; business submissions and promotions; favourites, views, enquiries, bookings and viewing requests; memberships, orders and payments; support, complaints, security and account administration. Independent third-party services have their own privacy notices.
3. Data we collect
Accounts and identity
Name or display name, email, UK phone number and standardised format, verification status and time, password hash, role, language/region preference, last login, account status and security records. Passwords are not stored in plain text.
Google sign-in
With your authority, Google may provide an identifier, name, email, avatar and basic profile information. We never receive your Google password.
Phone verification
Phone number, code request time, result, verification status/time, attempt counts, IP address and security information. Twilio Verify assists with SMS delivery and verification.
Business data
Business and contact names, phone, email, social media, address/service area, hours, category, services, images, logos, menus, prices, promotions, company registrations, licences, insurance, qualifications, order/membership/promotion records and related review, amendment and complaint communications.
Buyer activity
Favourites, browsing, enquiries, bookings, viewing requests, alerts, reviews, feedback, reports, membership/VIP status and support communications.
Payments
Order reference, amount, currency, payment/refund status, billing contact, provider transaction reference and records needed for accounting, tax, fraud and disputes. Stripe or another named provider may process payment. We do not normally store full card numbers or security codes.
Technical and security data
IP address, browser, device and operating system, access time, requested/referring pages, login/logout/verification activity, errors, security events, session identifiers, fraud controls and rate limits. We do not currently read contacts, SMS content, SIM IMSI, IMEI, installed app lists or precise location merely because you visit the site.
Data you provide
We process information and evidence you send for support, complaints, infringement reports or disputes. Never send passwords, codes, database credentials, card security codes, unnecessary identity documents or unrelated sensitive data through ordinary chat.
4. Sources
Data may come directly from you, arise from your use, come from an authorised Google account, verification and payment providers, business applicants or authorised representatives, lawful public registers, or other users' enquiries and reports. Where required, we provide privacy information when data was not obtained directly from you.
5. Purposes and lawful bases
Contract: accounts, authentication, Buyer Centre features, submissions, memberships, orders, payments, refunds, support and closure. Legal obligation: tax, accounting, consumer protection, authorities, rights requests, records, unlawful content and security notifications. Legitimate interests: security, fraud and abuse prevention, diagnostics, service improvement, data quality, complaints, claims and anonymous statistics, balanced against your rights. Consent: non-essential cookies, consent-based marketing, optional information and future device permissions. Consent may be withdrawn. We may also process data for legal claims or vital interests where necessary.
6. Agreement records
We may record the agreement name/version, acceptance time, account and reasonable technical evidence. Accepting the Privacy Notice does not mean every processing activity relies on consent. Material changes may require renewed confirmation.
7. Cookies and local storage
Strictly necessary technologies maintain sessions, security, CSRF protection, language/privacy choices and requested functions. Preference storage may remember your interface choices. Non-essential analytics, advertising or marketing technologies will be explained and consent obtained where required. Rejecting non-essential cookies does not prevent basic use; deleting session cookies may sign you out.
8. Recipients
We do not sell personal data. Necessary recipients may include DigitalOcean and infrastructure providers; Twilio Verify; Google; Stripe or another payment provider; email/support/notification providers; lawyers, accountants, auditors and insurers; courts, regulators, law enforcement and tax authorities; and appropriately protected parties to a merger, reorganisation, financing or business transfer. Processors must follow contracts, lawful instructions and suitable security duties.
9. Public business information
Business names, addresses, contacts, hours, descriptions, images and promotions may be public at the submitter's request. Submit only information you are entitled to publish and avoid unnecessary private or sensitive details. Search engine and third-party caches may take time to update after removal.
10. International transfers
Google, Twilio, DigitalOcean, Stripe or their affiliates may process data outside the UK. Where a destination lacks UK adequacy, we use an appropriate UK mechanism such as adequacy regulations, the International Data Transfer Agreement, the UK Addendum, an applicable certification framework or another lawful safeguard, with risk assessment where required.
11. Retention
Account data is kept while active and for closure, backup, fraud and legal needs. Verification data is kept as needed for authentication. Temporary codes expire quickly. Security logs are normally kept no more than 12 months; support and complaint records normally no more than 24 months, subject to incidents or disputes. Business data is kept during display/contract and for reasonable dispute or legal needs. Accounting records are normally retained for six years. Agreement records may be retained for compliance and disputes. Deleted data may remain temporarily in protected rotating backups; current production recovery points may cover the latest seven days. Data is then deleted, anonymised or otherwise lawfully disposed of.
12. Closure and deletion
You may request closure. We may verify identity. Data no longer needed will be deleted or anonymised, while legally required records, limited fraud controls, unresolved claims, third-party rights and rotating backups may remain. The right to erasure is not absolute; we will explain a lawful refusal or restriction. Deletion may be irreversible.
13. Your rights
Depending on the circumstances, you may have rights to information, access, correction, erasure, restriction, portability, objection to legitimate-interest processing, withdrawal of consent, objection to direct marketing and protections concerning solely automated significant decisions. We do not currently make legally or similarly significant decisions solely by automation. Contact us to exercise rights. We normally reply within one month, subject to lawful extensions. Reasonable identity checks may be required. Requests are normally free, although manifestly unfounded or excessive requests may be charged or refused where permitted.
14. Security
Measures include password hashing, encrypted sensitive configuration, encrypted connections, database and backend access controls, session and login controls, verification expiry and rate limits, backups, recovery, incident investigation and least-necessary access. No internet service is absolutely secure. Notify us if you suspect unauthorised access. We will assess and notify qualifying breaches as required by law.
15. Children
Account and commercial services are principally for people aged 18 or over. We do not knowingly invite children to create independent accounts or submit businesses. Contact us if a child has submitted data without appropriate authority.
16. Communications and marketing
We may send necessary codes, password resets, security alerts, order/payment notices, service changes and requested business alerts. These are not general marketing. Consent-based electronic marketing will include a clear unsubscribe route. Withdrawing marketing consent does not stop necessary account or security notices.
17. Third-party links
We do not control the privacy practices of linked businesses, maps, social media or other services. Read their notices before providing data.
18. Updates
We may update this Notice for legal, technical, service or business changes. New versions show their date and version. Material changes will be notified appropriately and fresh consent obtained where legally required.
19. Complaints
Please contact us first so we can investigate. You also have the right to complain to the UK Information Commissioner's Office (ICO), independently of our internal process.
20. Contact
Controller: UK Hua Fu
Email: [email protected]
Phone/WhatsApp: 07778139777
WeChat: H07778139777
Do not send passwords, verification codes, full card details or unnecessary identity documents through WeChat, WhatsApp or ordinary chat.