The sales window is now closed.
Orders placed during the September sales window are scheduled to ship by the end of November. Our next sales window will open on October 3, with orders scheduled to ship in December.

 
•
 
•
 
•
 
•

Privacy policy

Last updated: 26 August 2026

1. Who we are

This website and the Tiny Fox Hole online store are operated by FBAHELP COMPANY LIMITED (ECOMASSIST), Unit 18, 8/F, Peter Leung Industrial Building, 103 Wai Yip Street, Kwun Tong, KL, Hong Kong (“Tiny Fox Hole”, “we”, “us”).

For the purposes of the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), we are the data user responsible for personal data collected through this store. Where the EU GDPR, UK GDPR or another applicable privacy law applies, we act as the controller unless stated otherwise.

Contact: tinyfoxhole.opt@gmail.com.

2. Scope

This policy explains how we collect, use, disclose, retain and protect personal data when you visit the website, contact us, create an account, join an optional product notification list, place an order, request support, receive delivery, or request a cancellation, return or refund.

3. Personal data we collect

Depending on how you use the store, we may collect:

  • identity and contact data, such as your name, email address, telephone number and billing or delivery address;
  • account data, such as your login identifier and account preferences;
  • order data, including products, variants, quantity, price, currency, delivery method, customer notes, returns and refunds;
  • communications with us, including support messages and agreed order corrections;
  • marketing preferences and “love to see this again” requests;
  • technical and security data, such as IP address, device/browser information, timestamps, cookie identifiers and security logs;
  • payment-related references supplied by Stripe, such as payment status, amount, currency, Payment Intent ID and limited payment method details such as card brand and last four digits where available.

We do not receive or store your full card number or CVC. Payment information is entered into and processed by Stripe.

Please do not put card details, identity documents, health information or other unnecessary sensitive information in order notes or support messages.

4. How we collect data and whether it is required

We collect data directly from you when you use a form, account or checkout, and automatically from the website for security and essential operation. We also receive order/payment status from Stripe and delivery status from logistics providers.

Information marked as required at checkout is necessary to process payment, fulfil and deliver the order. If you do not provide it, we may be unable to accept or complete your order. Optional notes, product requests and marketing consent are voluntary.

5. How and why we use personal data

We use personal data to:

  • provide the store, account and requested services;
  • create, confirm, manufacture, pack, deliver, cancel, return and refund orders;
  • process payments through Stripe and reconcile payment records;
  • communicate order information and provide customer support;
  • prevent fraud, abuse, duplicate processing and security incidents;
  • maintain business, accounting and audit records;
  • establish, exercise or defend legal claims and comply with law;
  • improve the store and understand aggregate site performance;
  • send marketing or product notifications only where you have made the required choice or where otherwise permitted by applicable law.

Where applicable, our grounds include performance of a contract, steps requested before a contract, compliance with legal obligations, legitimate interests in running and protecting the store, and consent where required. You may withdraw consent without affecting earlier lawful processing.

6. Payments

Payments are processed by Stripe. Stripe receives payment and transaction information directly and processes it under its own privacy terms. We receive only the information required to confirm, administer, refund and reconcile the payment. You can review Stripe's Privacy Center.

An order is treated as paid only after the store receives and verifies the relevant confirmation from Stripe. A return to our website after checkout is not by itself proof of payment.

7. Who receives personal data

We disclose only the data reasonably necessary for the stated purpose to categories of recipients such as:

  • Stripe and payment-method providers;
  • WooCommerce/WordPress, hosting, backup, security and monitoring providers;
  • Tiny Fox Hole's internal order and workflow system and authorised support/production staff;
  • Gmail or another configured email provider;
  • warehouses, fulfilment partners, postal operators and couriers;
  • accountants, auditors, insurers, legal advisers, regulators and authorities where necessary;
  • a buyer or successor if the business is reorganised or transferred, subject to appropriate safeguards.

Service providers may use personal data only for contracted services or as otherwise stated in their own applicable privacy terms. We do not sell customer personal data. We do not provide it to another person for that person's direct marketing without the consent required by law.

8. International transfers

We operate from Hong Kong and use providers and delivery partners in other countries, including the locations of our hosting, payment, email, technical support, warehouse and delivery services. Your personal data may therefore be processed outside your country and outside Hong Kong.

We take reasonably practicable steps to select reliable providers, limit the data transferred, protect it contractually and apply appropriate safeguards required by applicable law. Where EU/UK transfer rules apply, we use an available lawful transfer mechanism, such as an adequacy decision or approved contractual safeguards, where required.

9. Retention

We keep personal data only for as long as necessary for its purpose, security, disputes and legal obligations. In particular:

  • order, payment, refund and accounting records may be kept for at least seven years as required for Hong Kong business records;
  • active account data is kept while the account is used and for a reasonable period afterwards;
  • support correspondence is normally kept for up to two years after the matter is closed, unless linked to an order, dispute or legal requirement;
  • abandoned checkout data is removed or anonymised according to the configured store schedule;
  • marketing data is kept until you opt out or it is no longer needed;
  • security logs and backups expire under documented operational schedules.

When data is no longer required, we delete or anonymise it unless continued retention is legally required.

10. Security

We use reasonably practicable technical and organisational measures designed to protect personal data against unauthorised or accidental access, processing, loss, erasure or use. These include encrypted connections, access controls, individual staff accounts, multi-factor authentication where supported, restricted roles, software updates, logging, backups and verification of API/webhook messages.

No online service is completely risk-free. If you believe your data or account has been compromised, contact us promptly.

11. Direct marketing and product notifications

Marketing email and optional product notifications are separate from transactional order messages. We will identify the kinds of data and the Tiny Fox Hole products or services to be promoted and obtain the consent or indication of no objection required by Hong Kong law before using personal data for direct marketing.

You may opt out at any time, free of charge, using the unsubscribe method in the message or by emailing tinyfoxhole.opt@gmail.com. We will keep the minimum information needed to respect the opt-out request.

12. Cookies and similar technologies

The store uses essential cookies for functions such as the shopping cart, account login, checkout, security and language/session preferences. Non-essential analytics or marketing cookies, if introduced, will be described in a cookie notice and used only with the choice required by applicable law. Disabling essential cookies may prevent the cart or checkout from working.

13. Your rights

Subject to applicable law, you may ask us to:

  • provide access to personal data we hold about you;
  • correct inaccurate or incomplete data;
  • delete data that is no longer needed, where no legal exception applies;
  • restrict or object to certain processing;
  • provide portable data where that right applies;
  • stop direct marketing at any time;
  • withdraw consent for future processing based on consent.

We may need to verify your identity and may retain information where required for accounting, disputes, fraud prevention or other legal obligations. Hong Kong residents may also contact the Office of the Privacy Commissioner for Personal Data. EEA/UK residents may contact their local data-protection authority where applicable.

14. Children's privacy

Our products are for children, but the store and checkout are intended for adults. Children should not create accounts, place orders or submit personal data without a parent or guardian. Contact us if you believe a child has submitted personal data improperly.

15. Changes to this policy

We may update this policy when our services, providers or legal obligations change. We will publish the updated date and provide additional notice where a material change requires it.

16. Contact and data requests

Send privacy, access, correction, deletion or marketing opt-out requests to:

FBAHELP COMPANY LIMITED (ECOMASSIST)
Unit 18, 8/F, Peter Leung Industrial Building
103 Wai Yip Street, Kwun Tong, KL, Hong Kong
Email: tinyfoxhole.opt@gmail.com