ENGLISH VERSION
Last Updated: [Aug 19] 2026 Effective Date: [Aug 19] 2026
Cherish Media Company Limited ("we", "us", or "our") operates the InstoreCX merchant web platform that enables brand marketers, retailers, and commercial partners ("Merchant") to manage client relationships, deliver personalised experiences, and access analytics that deepen the brand’s connection with its clientele.
(*Cherish Media Company Limited is a member of the Cherrypicks Group, a subsidiary of Cherrypicks International Holdings Limited.)
This Privacy Policy (“Policy”) describes how we, as data user, collect, hold, use, disclose, and protect the personal data of the Merchants’ authorised personnel who use the Merchant Platform on behalf of the Merchant (“you” or “your”) when you access or use the InstoreCX merchant web platform, including its website, mobile interface and related features and services (collectively, the "Merchant Platform").
This Policy also describes how we, as data processor, may process certain Members’ personal data on the Merchant’s behalf. For the avoidance of doubt, the processing of Members’ personal data by us as data processor is governed by Section 5 of this Policy and the Data Processing Agreement ("DPA") entered into between InstoreCX and the relevant Merchant, and the handling of Members’ personal data collected by us as data user through the InstoreCX Member web platform is governed by the InstoreCX Member Privacy Policy.
This Policy is issued in compliance with the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") of the Hong Kong Special Administrative Region and reflects the six Data Protection Principles ("DPPs") that govern all personal data handling. By accessing the Merchant Platform, you acknowledge that you have read and understood this Policy.
For the avoidance of doubt, when we refer to “personal data” in this Policy, we are referring to information which (i) relates directly or indirectly to a living individual; (ii) can be used to identify such individual; and (iii) is in a form in which access to or processing of such information is practicable.
By registering, accessing and/or otherwise using the Merchant Platform (or any part thereof), you consent to our collection and use of your personal data in accordance with this Policy.
If you do not agree to this Policy, please do not provide your personal data to us when requested, and you should refrain from using the Merchant Platform.
We are the data user responsible for your personal data collected through the Merchant Platform. Our registered office is located in Hong Kong. For data privacy enquiries, please contact our Data Protection Officer ("DPO") at the details set out in Section 13.
We collect personal data about you that is necessary, adequate, and not excessive for the purposes described in this Policy (DPP1). The categories of personal data we may collect are set out in the table below.
| Category | Examples |
|---|---|
| Professional Identity Data | Full name, job title, department, employee or representative ID |
| Professional Contact Data | Corporate email address, business phone number, office address |
| Account and Authentication Data | Username, encrypted password, multi-factor authentication credentials, access logs, session history |
| Platform Usage Data | Campaign configurations, client journey settings, brand signature customisations, analytics dashboard interactions, report generation history |
| Communication Data | Records of correspondence with us regarding Merchant Platform support, account management, or other Merchants via the Merchant Platform |
| Technical Data | IP address, browser type and version, device identifiers (model, system version and device type), operating system, time zone, cookie identifiers |
| Contractual and Billing Data | Authorised signatory details, billing contact information, subscription tier, invoice records |
We collect personal data directly from you during account registration, Merchant Platform onboarding, support interactions, and ongoing use of the Merchant Platform. We also collect certain technical data automatically through cookies and similar technologies (see Section 9).
You may decline to provide us with the requested personal data, but in such case, we will be unable to provide you with access and/or us of the Merchant Platform.
We do not knowingly collect personal data from individuals under the age of 18 without verifiable parental or guardian consent.
Your personal data is collected and used for the following purposes, which are directly related to our functions and activities (DPP1, DPP3):
4.1 Account Provisioning and Access Management To create, manage, and secure your account, authenticate your identity as the relevant Merchant’s authorised user, assign role-based permissions, and maintain audit logs of platform access and activity.
4.2 Platform Services Delivery To provide you with the tools necessary to build brand desirability, preserve the relevant Merchant’s brand’s aura, and maintain direct relationships with such Merchant’s clients. This includes enabling the configuration of personalised client journeys, controlled distribution of offers, and the collection of valuable data on member preferences and behaviours to enable hyper-personalized experiences for such Merchant’s clients.
4.3 Account Management and Client Support To manage the commercial relationship with you and the Merchant, provide technical support, merchant support and account administration, respond to service requests, and communicate platform updates, maintenance notices, and security alerts to you.
4.4 Direct Marketing to Merchants (with consent) To send you information about the Merchant Platform’s or our new features, product updates, industry insights, and events relevant to retail and client experience management. We will only do so with explicit consent or an indication of no objection from you, and you may opt out at any time (see Section 8).
4.5 Platform Analytics and Service Improvement To analyse aggregated and anonymised platform usage data to improve the Merchant Platform’s functionality, performance, and the quality of services we provide to brands.
4.6 Billing and Contract Administration To process subscription fees, issue invoices, manage contract renewals, and maintain financial records in accordance with applicable laws.
4.7 Legal and Compliance Obligations To comply with applicable laws, regulations, court orders, and requests from regulatory or law enforcement authorities, including record-keeping obligations under Hong Kong law.
4.8 Security and Fraud Prevention To detect, investigate, and prevent fraudulent transactions, unauthorised access, data breaches, security incidents and other illegal activities affecting the Merchant Platform.
(*Cherish Media Company Limited is a member of the Cherrypicks Group, a subsidiary of Cherrypicks International Holdings Limited.)
When Merchants use the Merchant Platform to collect, store, or process personal data relating to their members and end customers, the following data roles apply under the PDPO:
| Party | Role | Responsibility |
|---|---|---|
| Merchant | Data User | Determines the purposes and means of processing member personal data; responsible for ensuring lawful basis for collection and use under the applicable data protection laws |
| Cherish Media Company Limited / (*Cherish Media Company Limited is a member of the Cherrypicks Group, a subsidiary of Cherrypicks International Holdings Limited.) | Data Processor | Processes members’ personal data solely on the Merchant’s instructions and for the purpose of providing the Merchant Platform services to the Merchant |
To the extent that we are acting as a data processor on behalf of Merchants, we will process the members’ personal data only in accordance with the relevant Merchant’s documented instructions and the terms of the DPA, and comply with the requirements under the applicable data protection laws, including the PDPO and DPPs. Where reasonably practicable, we will assist the relevant Merchant in fulfilling its obligations under the PDPO.
Merchants are reminded that, as data users, they are fully responsible for ensuring that they themselves meet the requirements of the applicable data protection laws, including but not limited to having a lawful basis under the PDPO to collect and use member personal data, and providing members with adequate notice of such collection and use.
We do not sell your personal data to any third party. We may from time to time disclose your personal data to the following classes of recipients whether within or outside of Hong Kong, strictly for the purposes described in this Policy (DPP3):
| Recipient | Purpose |
|---|---|
| Third Party Service Providers (Data Processors) | To process data on our behalf for administrative, telecommunications, computer, payment, data storage, cybersecurity, data analytics, customer relationship management, IT, cloud and/or other services in connection with the operation of our business. Such third party service providers are under strict data processing agreements with us. |
| Professional Advisers (including but not limited to lawyers, auditors and consultants) | For our legal, compliance and/or business advisory purposes. |
| Legal and Regulatory Authorities | Where required by law, court order, or to protect the rights, property, or safety of us, our users, or the public. |
| Business Successors | In connection with a merger, acquisition, or sale of assets, subject to the acquirer assuming the obligations of this Policy. |
When transferring personal data to parties outside Hong Kong, we take all practicable steps to ensure that the recipient provides a standard of protection at least comparable to that under the PDPO.
We implement appropriate technical and organisational security measures to protect your personal data against unauthorised or accidental access, processing, erasure, loss, or use (DPP4). These measures include:
We encourage Merchants to implement their own internal access controls, including promptly deactivating accounts of personnel who no longer require access to the Merchant Platform.
While we take all reasonable and practicable steps to safeguard your personal data, you acknowledge that no method of electronic transmission, storage and/or security measures are entirely secure and effective. We encourage you to use a strong, unique password for your account and to notify us immediately if you suspect any unauthorised use. If you find that your personal data has been compromised, in particular, due to the unauthorised access and use of your account, please contact our Data Protection Officer at the email address below immediately so that we can take the appropriate measures.
We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations (DPP2). In general:
| Data Category | Retention Period |
|---|---|
| Account and Authentication Data | Duration of the Merchant account plus 7 years (to comply with Hong Kong commercial record-keeping requirements) |
| Platform Usage and Configuration Data | Duration of the Merchant account plus 3 years |
| Billing and Contractual Data | Duration of the contract plus 7 years (to comply with Hong Kong tax and accounting requirements) |
| Communication Records | Up to 5 years from the date of communication |
| Technical and Log Data | Up to 12 months |
Upon expiry of the applicable retention period, we will take all practicable steps to erase or anonymise your personal data, unless retention is required or permitted by law.
You have the following rights in relation to your personal data (DPP6):
9.1 Right of Access You may request confirmation of whether we hold personal data about you and, if so, a copy of that data. We will aim to respond to your data access request within 40 days of receipt of your request. That said, if we are unable to respond to your request in whole or in part within the 40-day reply period, we will inform you in writing of our reasons for this and provide you with an estimated timeframe for response. In such cases, we will provide our response to your request as soon as reasonably practicable after the expiry of the initial 40-day reply period. A reasonable fee may be charged for processing access requests.
9.2 Right of Correction If you believe that any personal data we hold about you is inaccurate, you may request that we correct it. We will respond to your data correction request within 40 days of receipt of your request. That said, if we are unable to respond to your request in whole or in part within the 40-day reply period, we will inform you in writing of our reasons for this and provide you with an estimated timeframe for response. In such cases, we will provide our response to your request as soon as reasonably practicable after the expiry of the initial 40-day reply period.
9.3 Right to Opt Out of Direct Marketing You may, at any time and free of charge, instruct us to cease using your personal data for direct marketing purposes by contacting our DPO or clicking the "unsubscribe" link in any of our marketing communications.
9.4 Right to Withdraw Consent Where we rely on your consent to process your personal data, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.
To exercise any of the above rights, please submit a written request to our DPO (see Section 12). We may ask you to provide certain details about yourself so that we can verify your identity as the relevant data subject before processing your request.
We use, and may also engage third parties to use, cookies and similar tracking technologies (“Cookies”) on the Merchant Platform to maintain session security, remember your settings, and analyse platform usage. Cookies are small data files placed on your device when you use the Merchant Platform. Various types of Cookies may be used to enable us to provide certain features and functionalities and they are placed on the Merchant Platform either by us or by other third parties permitted by us.
We, and where applicable, third parties engaged by us, may combine information collected from Cookies with other personal data that we collect from you, or such third parties, to better serve you and/or maintain your information across multiple pages within or across one or more sessions.
For more information on cookies, please refer to the following website: http://www.allaboutcookies.org.
The types of Cookies used on the Merchant Platform include:
| Cookie Type | Purpose |
|---|---|
| Strictly Necessary | Essential for administration and operation of the Merchant Platform (e.g., to facilitate session management, ensure platform security, and perform authentication) |
| Functional | To remember your platform settings, preferences, and configurations, and provide enhanced functionality and personalization of the Merchant Platform |
| Analytical / Performance | To collect anonymised data on how users interact with the Merchant Platform (e.g., site count visits and traffic sources) to improve platform performance and user experience |
| Third Party | To gather relevant tracking information used to measure and improve the operation and performance of the Member Platform and your browsing experience (subject to your decision to opt-out of such third party cookies) |
The browser setting of your device is usually programmed by default to accept Cookies. If you do not agree to the use of Cookies, you can easily change this by customizing and amending the settings for your browser to disable cookies at any time. More information about cookies setting is available at https://allaboutcookies.org/how-to-manage-cookies
Please note that disabling Cookies may affect some of the services and/or functionalities of the Merchant Platform.
The Merchant Platform employs AI and ML technologies (“AI Technologies”) in the following features, for the following purposes and with regards to the following types of data:
The Merchant Platform may allow you to upload information or data provided by you in the permitted formats and technical requirements in connection with your use of the AI Technologies (“User Content”) and obtain outputs generated by AI Technologies based on your uploaded User Content (“AI Content”).
You understand and agree that:
You are fully responsible for any personal data that is incorporated in your uploaded User Content or incorporated into AI Content as a result of your uploaded User Content;
AI Content may not always be accurate or complete and should not be relied upon as a sole source of factual information or as a substitute for professional advice;
You are responsible for evaluating AI Content for accuracy, legality, and appropriateness for their specific use case before using or sharing it; and
The AI and ML features of the Merchant Platform may provide incomplete, incorrect or offensive AI Content that does not represent our views. Any AI Content that references third‑party products or services does not imply any endorsement, sponsorship, or affiliation by such third parties or by us.
Please review the Terms of Use for Merchants for the specific terms governing Merchants and their authorised representatives’ use of AI Technologies on the Merchant Platform.
[You acknowledge that we may use your User Content and AI Content to provide, maintain, develop, and improve the Merchant Platform, to monitor and mitigate bias, and to ensure security and integrity of our AI Technologies. If you do not wish your AI Content to be used to train our underlying AI Technologies, you may opt out by notifying us in writing. However, you acknowledge that opting out may limit the ability of certain AI or ML-powered features to optimise the Merchant Platform for your specific use cases.]
We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by email and by posting the updated Policy on the Merchant Platform and, where appropriate, by email. The "Last Updated" date at the top of this Policy indicates when it was last revised. Continued use of the Merchant Platform after any changes constitutes acceptance of the revised Policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact our Data Protection Officer:
InstoreCX — Data Protection Officer Email: support@InstoreCX.com Address: 18/F, 10 Knutsford Terrace, Tsimshatsui
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD): Website: www.pcpd.org.hk Hotline: +852 2827 2827
In case of discrepancies between the English and Chinese versions of this Policy, the English version shall apply and prevail.