PRIVACY POLICY

PRIVACY STATEMENT

Thank you for reading this privacy policy (“Privacy Policy”) of R&J Co. For the purposes of this Privacy Policy, R&J Co. comprises A-One Enterprises Limited and its subsidiaries (collectively, we or us). Respecting and protecting our customers’ privacy and personal data is important to us. This Privacy Policy will help you understand how we collect, use and safeguard your personal data in our interactions with you.

It also describes your data protection rights, including a right to object to some of the processing which we carry out.

More information about your rights, and how to exercise them, is set out in the section What rights do I have?.

If you reside in the European Economic Area, the State of California or Mainland China, additional country-specific notices apply in addition to the main body of this Privacy Policy. Please see the relevant notice at the end of this Privacy Policy.

In this Privacy Policy, we use the following terms from applicable laws, which we’ve defined below for your ease of reference:

• ‘Data controller’: refers to any organisation or individual that independently determines the purpose and method of processing personal data.
• ‘Data processor': refers to any organisation or individual that processes personal data on behalf of and under the instruction of another organisation or individual.
• ‘Process/processing of data’: refers to the collection, storage, use, processing, transmission, provision, disclosure, and deletion of personal data.

WHAT INFORMATION DO WE COLLECT?

We collect and process personal data about you when you:

• visit and/or register on any website owned and operated by us (collectively our “Site”), including www.rnjhk.com;
• place an order with us as a guest or as a registered user on our Site;
• use a third-party service offered by service providers such as analytics companies, advertising networks and cooperatives, demographic companies, and any other third-party service providers that we choose to collaborate or work with, and we obtain your personal data from those third parties;
• provide us with your personal data via: our physical stores, Wi-Fi, mobile devices, social media platforms/networks or telephone enquiries or your application for or use of our services or loyalty programmes (such as our Privilege Cards or private sales);
• visit our physical stores or any other of our locations and your image is captured by our in-location CCTV (Closed-Circuit Television) security system (please refer to our CCTV Policy below); or
• visit our physical stores or any other of our locations and our data analytics cameras carry out real-time data analyses based on your image for statistical research purposes (such as demographics analysis and traffic flow analysis) on an anonymous and aggregated basis, as set out in our Data Analytics Policy. We use personal data in this respect solely to analyse pathways throughout the relevant store or other location; the only personal data that will be collected, processed and used for this purpose will be your facial biometric template derived from your facial image -- (i.e. numeric information describing different facial features). This data is anonymised before any such analytics use and is used only as part of an aggregated pool of data.

In this Privacy Policy, your “personal data” means: your name, email address, telephone number, MAC address, IP address, credit/debit card and other payment information, gender, date of birth, age, interests, geographical location, Site usage (including browsing activities), shopping and purchasing activities, your physiological data in images captured by our analytics cameras (which data is anonymised and aggregated before any analytics use) or CCTV, and any other personal data you provide to us.

 

HOW DO WE USE THIS INFORMATION, AND WHAT IS THE LEGAL BASIS FOR THIS USE?

We process personal data for the following purposes:

• To conduct our business and pursue legitimate interests -- in particular, to:
• Provide our services to you, including: responding to any questions you may have of us; providing you with recommendations on products in our stores or on our Site; maintaining your shopping cart on our Site; assessing your applications with us for any of our services or loyalty programmes; providing our Privilege Card to you; fulfilling any orders you may make with us (including verification and security checks of your details, performing appropriate anti-fraud checks such as credit / identity checks, processing of your payments, shipping to you the products that you have ordered from us, and processing your returns or exchanges of our products); providing free Wi-Fi services to you at our physical stores; providing mobile application services to you; personalising our services to you and enhancing your experience in using our services;
• Monitor the use of our Site and our services (both online and offline), and use your information to help us monitor, improve and protect our products, content, services (both online and offline) and our Site;
• Analyse trends, usage, browsing and shopping behaviour with us (whether on an individualised or anonymised and aggregated basis), which helps us better understand how you and our collective customer base access and use our Site, stores and services, for the purposes of:
• improving our services;
• responding to customer needs and preferences;
• measuring the effectiveness of our marketing campaigns;
• conducting marketing activities targeted at potential customers (on an anonymised and aggregated basis only); and
• crowdsourcing data analytics and hackathon activities (on an aggregated and anonymised basis only).
• When you give us consent (if required):
• To allow you to register for and participate in our events and promotions, including verifying your identity at those events and promotions; and
• To provide you with direct marketing communications in relation to products, services, events, offers or promotions under the categories stated below, provided by: (i) us or our related companies (including our affiliate and subsidiary companies), (ii) business partners, and/or (iii) other third-party providers.
• These marketing communications may:
• be in various forms, including advertisements, newsletters and special events notifications
• be delivered by various methods, such as email, SMS, WeChat messages, smartphone app push notifications, notifications on your social media pages, in-app messaging and postal mail; and
• promote or offer products or services (including special events and promotions) in the following categories: dining, food and beverage, sports, music, film, clothing and accessories, jewellery, luggage and bags, cosmetics, personal health and hygiene, electronics, home furnishings and other homeware, automobiles, transport and travel, hotels, financial services, loyalty and reward programmes, media services, television and other entertainment services and products, social networking services, payment services, on-line advertising services, other e-commerce, information and communications services, concierge services, and other products and services related to any of the above that we think may be relevant to you based on information you have provided to us (for instance, via your participation in our surveys).
• For purposes that are required by law, such as in response to lawful requests by government or law enforcement authorities conducting an investigation.

 

WITHDRAWING CONSENT OR OTHERWISE OBJECTING TO DIRECT MARKETING

Whenever we are required to obtain your consent to the processing of your personal data under applicable law, you will always be able to withdraw any consent you provide to us. We will then stop using your personal data for the purpose in respect of which you have withdrawn your consent, but we may still use, process, store and transfer your personal data for other purposes if applicable law allows us to do so.

You can withdraw your consent by:

• amending your preferences in the logged-in area of our Site; and/or
• contacting our Data Privacy Officer at rnj.coffee.hk@gmail.com; and/or
• in the case of direct marketing emails, by clicking the unsubscribe link at the bottom of such emails

 

WHO WILL WE SHARE THIS DATA WITH, WHERE AND WHEN?

We may share your personal data with the related companies of A-One Enterprises Limited and its subsidiaries located within or outside Hong Kong for the purposes set out in the section “How do we use this information, and what is the legal basis for this use?” above.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes set out in the section “How do we use this information and what is the legal basis for this use?” above, when mandated by law and in compliance with Hong Kong’s Personal Data (Privacy) Ordinance (the “Ordinance”) or other applicable laws.

Personal data will also be shared with those third party service providers located within or outside Hong Kong who we need to process it on our behalf for the purposes identified in this Privacy Policy. Amongst others, we use the following third-party providers:

• Courier and other goods delivery services;
• Email, SMS and other digital notification services;
• Telecom companies (e.g. for providing in-store Wi-Fi services);
• Data storage and cloud service providers (e.g. for storing personal data and hosting applications that process personal data for the purposes identified in this Privacy Policy);
• Google, Facebook and other advertising networks (for the matching of your personal data with their database in order to send you our direct marketing materials through, e.g., your Google and/or Facebook account(s));
• Marketing (including digital marketing) and website analytic agencies for display of advertising materials on our Site and other websites that you may visit, as well as analysis of your online behaviour and usage of our Site – we note that these agencies use cookies; please refer to our separate Cookies Policy for details;
• credit reference and fraud-prevention agencies (e.g. for performing appropriate anti-fraud checks, such as credit / identity checks); and
• Data analytics and hackathon service providers and agencies (for the purposes stated in the section “How do we use this information, and what is the legal basis for this use?” above), to whom we will only send anonymised data and then only for the purposes in the section “How do we use this information, and what is the legal basis for this use” above.

We may also sell your personal data to third parties for their own purposes where permitted by applicable laws.

If our business or any part of it is put up for sale, sold or integrated with another business, personal data may be disclosed to our advisers and any prospective purchaser and their advisers and will be passed to the ultimate new owners of the business.

 

WHAT RIGHTS DO I HAVE?

Where permitted by law, you have the right to ask us for a copy of your personal data; to correct, delete or stop any active processing of your personal data, to obtain from us, in a structured, machine-readable format, the personal data you’ve previously provided to us, and to ask us to share this data with another data controller.

In some circumstances, your rights to object to our processing of your personal data may be limited -- for example, where fulfilling your objection request would reveal personal data about another person, where it would infringe our rights or the rights of a third party or if you ask us to delete information which we either are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions in these respects are provided under applicable laws. We will inform you of any exemptions we rely upon when responding to any objection request you make.

To exercise any of these rights, or to obtain other information (such as a copy of a legitimate interests assessment), you can get in touch with us – using the contact details set out in the section “Contact Us”.

 

WHO IS THE DATA CONTROLLER?

The data controllers are R&J Co., A-One Enterprises Limited and its subsidiaries; contact details for them can be found in the section “Contact Us” below.

 

HOW LONG WILL MY DATA BE KEPT?

• Personal data collected during your registration on our Site: we process this personal data for as long as (i) you are an active user of our Site and (ii) it is required for our business and/or legitimate interests or by law or regulation.
• Personal data processed for marketing purposes or with your consent:, we process the personal data for this purpose until you ask us to stop and for a short period after this to allow us to implement your request. We also keep a record of the fact that you have asked us not to send you direct marketing or not to process your data, so that we can respect your request in the future.
• Personal data collected by analytics cameras: we will not keep any images captured by our analytics cameras for longer than is necessary to achieve the purposes for which they are collected, and such images will be anonymised and aggregated before any use of them for the purposes stated in the section “How do we use this information, and what is the legal basis for this use?” above.

 

OUR DATA ANALYTICS POLICY

The purpose of this data analytics policy is to explain the use of data analytics cameras in our stores. Data analytics cameras are used in our stores for statistical research purposes, such as demographics analysis and traffic flow analysis within our stores.

• Collection and use of data: As noted further above in our Privacy Policy the only personal data we collect from these analytics cameras is facial biometric templates derived from a facial image - i.e. numeric information describing different facial features. This numeric information is then processed by the analytics cameras into anonymised and aggregated data for the above research purposes. All analysis conducted on the data by the analytics cameras is done in real time. No video footage, images or other personally identifiable data are stored by the data analytics system; you cannot be identified by them.
• Security and destruction of data: We have security measures in place to prevent unauthorised access to our data analytics system. The facial biometric templates collected using the analytics camera are securely and permanently deleted within 24 hours of being collected, and only the aggregated and anonymised data is retained.
• Notice: We notify customers and other visitors to our stores when data analytics cameras are in use by the conspicuous posting of notices stating “analytics cameras in operation” at both the entrance to any monitored area of the store and inside the area itself. Notices are also posted to alert customers if the analytics cameras themselves are very discreetly located. No analytics cameras are installed in places where people have a reasonable expectation of privacy.

The facial biometric templates collected using the analytics camera are disclosed only to our third-party service providers who operate the analytics cameras for the research purposes stated above.

 

CONSENT, SOCIAL NETWORK CREDENTIALS AND ACCOUNT DELETION

Withdrawing Consent

You may withdraw consent for us to use or otherwise process your personal data at any time by emailing us at rnj.coffee.hk@gmail.com.

Once we receive and confirm your withdrawal of consent, we aim to process that consent withdrawal within 30 working days. You may still receive marketing communication from us for up to two weeks from the day you request to delete your account. Once we have processed that withdrawal, however, we will cease to use or otherwise process your personal data, including ceasing to send you any information or direct marketing about our latest products and promotions.

Using and Revoking Social Network Credentials

Users may use their social network accounts (including, for example, Facebook or WeChat) on the R&J Co. application to access their accounts. This allows for an easier and more convenient log-in process. You might not need to enter a password if you are already logged in to your social media account on the device you are using to access the R&J Co. application. Using social network credentials is completely optional, and users can instead decide to use their email address or mobile number to log in to the R&J Co. application.

When you use your social media credentials to log into the R&J Co. application or your R&J Co. account, we may collect an anonymous user ID. Any personal data in your social media profile is encrypted.

By logging into your R&J Co. account using your social media credentials, you grant us permission to obtain certain types of information and content from these social media accounts. What information we collect will depend on your settings for that social media account and will be subject to those privacy policies.

If you wish to revoke your permission for the R&J Co. application to use your social network credentials, you simply need to turn the permission off. When you revoke that permission, your personal data associated to your social media account will be deleted from the R&J Co. system.

Deleting your Member account

You may delete your member account any time by contacting rnj.coffee.hk@gmail.com to request that deletion.

After receiving your account deletion request, R&J Co. may contact you via email or phone within the following 30 working days to verify your identity, in order to prevent any fraudulent activity or requests made by mistake. You may also receive an automated email from R&J Co. when you submit your deletion request. If you receive such email but did not make a deletion request, please contact us immediately.

When you request the deletion of your R&J Co. account, you may be asked to provide reasons why you wish to delete account and/or to share more details about your user experience with us.

You may also be asked to re-confirm that you wish to delete the member account. You must answer “yes” in order to initiate the account deletion process. This is to avoid unintended account deletions. At this point, we may suggest deletion options to users, such as only disabling notifications from us or withdrawing consent, but not deleting the entire account.

For security purposes and to ensure it is the account owner who is requesting for the account deletion, R&J Co. may also ask for the user’s proof of identity before deleting the account.

When the user’s deletion request and identity have been successfully matched, and the deletion decision confirmed and verified, R&J Co. will proceed with account deletion from its server and system in 60 working days. 

All the account information including personal data will be permanently deleted and/or anonymised such that the information cannot be reverse engineered, and the deletion process will then be irrevocable. Users will no longer be able to retrieve their personal data, information, or past purchasing records. All privilege points will also be deleted. Please carefully consider whether you actually wish to have all this information deleted.

 

LANGUAGE

This Privacy Policy has been prepared in English and Chinese. If there is any discrepancy between the English and Chinese versions of it, the English version of it will prevail.

 

CONTACT US

We hope that we have been able to satisfy any queries you have about the way we collect and process your personal data. However, if you have any unresolved questions or concerns about the topics we’ve discussed in this Privacy Policy, or you would like to opt out of direct marketing from us, please contact us at rnj.coffee.hk@gmail.com.

 

CHANGES TO THE PRIVACY POLICY

We may change the Privacy Policy in order to comply with the evolving regulatory environment or, provided that the Privacy Policy continues to comply with applicable law, the needs of our business. Subject to any applicable legal requirements to provide additional notice, any changes to this Privacy Policy will be communicated through our Site and our mobile applications. We will obtain your consent to such changes where required to do so by applicable laws.

 

MEMERSHIP

By signing in the Membership form, or logging in as our subscriber, or registering as our member, or continuing your browsing of R&J Co. Websites, you agree to comply with the Statement set out above.

This Statement shall be governed by and construed in accordance with the laws of China-Hong Kong. Where R&J Co. operations are subject to privacy legislation other than that of China-Hong Kong, then this Statement shall be applied so far as practicable and consistent with such local legislation.

 

Last Updated: October 2nd, 2023

 

R&J Co.
rnj.coffee.hk@gmail.com