1. About this Privacy Notice
This Privacy Notice explains how FlipNames Limited (“FlipNames”, “we”, “us” or “our”) collects, holds, processes, uses and discloses personal data when you:
- visit https://flipnames.net (the “Website”);
- contact us through the Website, by email, telephone or other communication channels;
- request information about our domain-related services; or
- otherwise communicate with us in connection with the Website.
FlipNames Limited is the data user responsible for the personal data described in this Privacy Notice for the purposes of the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”).
Our contact details are:
FlipNames Limited
Rm 7B, One Capital Place
18 Luard Road
Wan Chai, Hong Kong
Email: info@heysms.com
This Privacy Notice applies only to the public Website and enquiries made through or in connection with it. Different or additional privacy terms may apply where you enter into a contract with us, use another service operated by us or apply for a position with us.
2. Personal data we collect
Depending on how you interact with us, we may collect the following categories of personal data.
2.1 Contact and identification information
This may include:
- your name;
- telephone number;
- email address;
- job title;
- company or organisation name; and
- other contact details you provide.
2.2 Enquiry and communication information
This may include:
- the subject and content of your enquiry;
- information included in your message;
- your domain name requirements or preferences;
- information about your business, project, brand or intended use of a domain;
- records of our communications with you; and
- any documents or other information you voluntarily provide.
Please do not provide personal data that is not necessary for us to respond to your enquiry.
2.3 Website and technical information
When you visit the Website, we or our website service providers may automatically collect limited technical information, such as:
- IP address;
- browser type and version;
- device type;
- operating system;
- date and time of access;
- pages visited;
- referring website;
- language and general location settings; and
- website error, security and performance information.
Whether this information constitutes personal data depends on whether it can reasonably be linked to an identifiable individual.
3. Personal Information Collection Statement (PICS) for the contact form
When you submit the Website contact form, providing your personal data is generally voluntary.
However, we need sufficient information to identify your enquiry and communicate with you. If you do not provide your name, contact details or the substance of your enquiry, we may be unable to respond or provide the requested information or assistance.
We collect contact-form information for the following purposes:
- receiving, reviewing and responding to your enquiry;
- communicating with you about our services;
- understanding your requirements;
- preparing an offer, quotation or proposed terms;
- arranging consultations or follow-up communications;
- maintaining records of enquiries and communications;
- complying with applicable legal and regulatory requirements.
Your personal data may be disclosed to the following classes of persons where reasonably necessary for these purposes:
- our employees, personnel and authorised representatives;
- companies or persons providing administrative, technical or operational support to us;
- website hosting, email, communications and IT service providers;
- professional advisers, including legal, accounting and compliance advisers;
- domain registrars, registry operators or other domain-related service providers where necessary to deal with your request and after appropriate arrangements have been made;
- regulators, law-enforcement authorities, courts and other public authorities where disclosure is required or permitted by law.
You have the right to request access to and correction of your personal data, subject to the PDPO. Information about how to exercise these rights is provided in section 11 below.
4. How we use personal data
We may use personal data for the following purposes:
4.1 Operating the Website
We may use technical and usage information to:
- operate and maintain the Website;
- ensure that Website content is displayed correctly;
- investigate technical problems;
- maintain security;
- prevent fraud, abuse and unauthorised access; and
- understand and improve Website performance.
4.2 Responding to enquiries
We use the information you provide to:
- respond to questions and requests;
- communicate with you;
- provide information about our services;
- understand your requirements;
- arrange consultations; and
- take steps requested by you before entering into a contract.
4.3 Providing services
Where an enquiry develops into a business relationship, we may use relevant information to:
- identify suitable domain names;
- provide domain-related consultation;
- conduct domain or market analysis;
- support domain acquisition or registration;
- provide setup guidance;
- prepare and administer a contract; and
- provide support relating to our services.
Additional privacy information may be provided where necessary in connection with a particular service or business relationship.
4.4 Legal, security and administrative purposes
We may use personal data to:
- maintain appropriate business records;
- protect our Website, systems, business and legal rights;
- investigate suspected fraud, misuse or unlawful activity;
- resolve complaints and disputes;
- obtain professional advice;
- comply with legal obligations; and
- respond to lawful requests from courts, regulators and public authorities.
We will not use personal data for a new purpose that is unrelated to the original purpose of collection unless we have obtained the prescribed consent or the use is otherwise permitted under the PDPO.
5. Direct marketing
We do not use personal data submitted through the Website contact form for direct marketing unless we have:
- informed you of our intention to use the data for direct marketing;
- identified the kinds of personal data that would be used;
- identified the classes of products or services that would be marketed; and
- obtained your consent or indication of no objection as required under the PDPO.
Where you have agreed to receive marketing communications, you may ask us to stop using your personal data for direct marketing at any time and without charge by contacting us using the details in section 12.
Administrative, service-related and enquiry-related communications are not direct marketing communications.
7. Disclosure and service providers
We do not sell personal data.
We may engage service providers to support the operation of the Website and our business, including providers of:
- website hosting and maintenance;
- cloud infrastructure;
- email and communications services;
- cybersecurity and fraud prevention;
- professional advice;
- document management; and
- administrative support.
These service providers may process personal data only to the extent reasonably necessary to perform their services or comply with applicable law.
We take reasonably practicable steps to select appropriate service providers and require them, through contractual or other means, to protect the confidentiality and security of personal data.
8. Data transfers
Some of our personnel or service providers may be located outside Hong Kong. As a result, personal data may be accessed, stored or processed in another jurisdiction.
Where personal data is transferred or made accessible outside Hong Kong, we take reasonably practicable steps to protect it. These steps may include:
- conducting appropriate checks on service providers;
- limiting access to authorised persons;
- imposing confidentiality and data-protection obligations;
- using appropriate security measures; and
- restricting the use of personal data to specified purposes.
The data-protection laws of another jurisdiction may differ from those applicable in Hong Kong.
9. Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected or a directly related purpose.
The applicable retention period depends on factors such as:
- the nature of the enquiry or relationship;
- whether the enquiry develops into a business relationship;
- the need to maintain business and communication records;
- applicable contractual requirements;
- legal, regulatory and accounting obligations;
- limitation periods; and
- the need to establish, exercise or defend legal claims.
When personal data is no longer required, we will take reasonably practicable steps to securely delete, destroy or anonymise it.
10. Security
We take reasonably practicable technical and organisational measures to protect personal data against unauthorised or accidental access, processing, erasure, loss, disclosure or use.
Depending on the nature of the information and the associated risks, these measures may include:
- access restrictions;
- authentication controls;
- confidentiality obligations;
- secure hosting and communications arrangements;
- malware and security monitoring;
- backup and recovery procedures;
- limiting access to persons who need the information for their work; and
- procedures for responding to security incidents.
No system or method of transmission over the Internet can be guaranteed to be completely secure. You should therefore avoid sending unnecessary or highly sensitive personal data through the Website contact form.
11. Your privacy rights
Subject to the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”), you have the right to:
- request confirmation as to whether we hold personal data about you;
- request access to, and obtain a copy of, personal data we hold about you;
- request correction of your personal data where it is inaccurate; and
- request that we cease using your personal data for direct marketing, where applicable, at any time and without charge.
Where we rely on your prescribed consent for a use of personal data, you may withdraw that consent by written notice. Withdrawal does not affect any use of the personal data made before the withdrawal became effective.
Data access requests
A request to access personal data should be made in accordance with the requirements of the PDPO. You may use the Data Access Request Form specified by the Privacy Commissioner for Personal Data, Hong Kong.
We will normally respond to a valid data access request within 40 days after receiving it, subject to the circumstances and exemptions provided under the PDPO.
We may charge a fee for complying with a data access request, but any such fee will not be excessive.
Data correction requests
If personal data supplied to you in response to a data access request is inaccurate, you may request correction of that data in accordance with the PDPO.
Where we are satisfied that the personal data is inaccurate, we will make the necessary correction and provide you with a copy of the corrected data within the period required by the PDPO, subject to any applicable exceptions.
Requests
Requests for access to or correction of personal data should be addressed to:
“Privacy Contact” via info@heysms.com
or
FlipNames Limited
Rm 7B, One Capital Place
18 Luard Road
Wan Chai, Hong Kong
We may request information reasonably necessary to verify your identity before processing your request.
We may refuse a request where the PDPO requires or permits us to do so. Where required by the PDPO, we will inform you of the refusal and the reasons for it.
12. Questions and complaints
If you have concerns about how we handle your personal data, please contact us first. If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).
13. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in:
- the Website; or
- applicable legal or regulatory requirements.
The updated version will be published on the Website with a revised “Last updated” date. Material changes may also be communicated through another appropriate channel.