Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how HK OPTENTRA CO., LIMITED, a company incorporated in the Hong Kong Special Administrative Region, collects, uses, stores, shares and protects personal data when you visit our website at youyuance.com, when you contact us, when you use our business support services, and when you download or use our mobile management application distributed through the Apple App Store and Google Play.

This Policy applies to our website, our mobile applications (including our OPTENTRA mobile management app available on the Apple App Store and Google Play), our related APIs, our email communications and any related sales or support activity. It does not apply to third-party websites, products or services that we do not control, including the advertising networks listed in Section 9 and the app stores through which our applications are distributed.

We are the data controller for the personal data described in this Policy. Where we process personal data on behalf of a client in the course of our management consultancy, brand advisory, general trading or e-commerce consultation services, the relevant client acts as the controller and we act as a processor, governed by a separate written agreement.

2. Information We Collect

We collect information from the following sources:

2.1 Information you provide to us

• Account and contact information — name, company, business email address, telephone number, job title, and any correspondence you send us.
• Enquiry and support content — the messages, documents, business requirements and specifications you submit through our contact forms, or by email to our business support or key accounts addresses.
• Commercial information — order and trading records, invoice details, supplier and channel documentation, and project investment planning inputs, where you use our general trading, supply chain management or e-commerce consultation services.
• Brand advisory and consulting materials — brand assets, positioning work, market research inputs and business information consulting data that you choose to share with us.
• Registration information — if you create an account in our mobile management application, we store your name, email address, company name, role and account preferences.

2.2 Information collected automatically from your device

• Device information — device model, operating system and version, screen resolution, language and locale settings, time zone, manufacturer, and the build identifier of the application.
• Usage information — screens viewed, features used, search terms, timestamps, session duration, in-app navigation paths, crash and error logs, and approximate interaction patterns.
• Network information — IP address (which may be truncated or anonymised), carrier, Wi-Fi or cellular connection type, and the approximate location derived from the network.
• Approximate location — when you enable location services for a market-specific feature such as regional pricing, we may collect coarse location data. Precise location is collected only if you explicitly grant it and it is necessary for a feature you use.
• Advertising identifiers — the Apple Identifier for Advertisers (IDFA) and the Google Advertising ID (AAID / GAID), along with related advertising metadata, where permitted and where you have not opted out.
• Advertising and attribution data — impressions, clicks, conversions, campaign identifiers, referrer information, and aggregated engagement statistics collected by our advertising partners.
• Cookie and similar technology data — as further described in Section 11.

2.3 Information from third parties

• App store data — when you download our application, the Apple App Store or Google Play provides us with information such as your device identifier, language, region and an anonymised installation identifier.
• Advertising partners — the advertising networks listed in Section 9 may provide aggregated audience insights, campaign performance data and, where permitted and consented to, identifiers that allow us to measure campaign effectiveness.
• Business counterparties — in the course of general trading and international trade, we may receive information about counterparties, suppliers, logistics providers and customs authorities, which we process for legitimate business and compliance purposes.
• Publicly available sources — publicly available company and market information used in business information consulting and market analysis.

3. How We Use Your Information

We use personal data for the following purposes:

1. To provide, maintain, operate and improve our website and our mobile applications.
2. To create, authenticate and manage your user account and to deliver business support to you.
3. To respond to your enquiries, prepare proposals and deliver our business strategy planning, management consultancy, brand advisory, general trading and e-commerce consultation services.
4. To process orders, manage inventory, track supply chain shipments and administer wholesale and retail channel activity.
5. To manage project investment planning scenarios and to share reporting outputs with authorised stakeholders.
6. To monitor, secure and troubleshoot the services, including via crash and error analytics.
7. To send service updates, product announcements and app release notes where you have consented or where the communication is strictly necessary to deliver a service you have requested.
8. To personalise your experience, including interface preferences, market defaults and content relevance.
9. To display advertising and measure its performance, as described in Section 9.
10. To detect, investigate and prevent fraud, abuse, security incidents and violations of our Terms of Service.
11. To comply with legal, regulatory, tax, customs and trade control obligations.
12. To establish, exercise or defend legal claims, and to enforce our agreements with you, our partners and our suppliers.

We do not sell your personal data. We do not share it for money consideration with third parties who would then use it for their own purposes. We do share it with the advertising networks listed in Section 9 so that they can deliver and measure advertising on our behalf, and they act as independent controllers for that processing.

4. Legal Bases for Processing

Depending on your location and the nature of our relationship, we process personal data under one or more of the following legal bases.

5. Sharing and Processors

We share personal data only with the categories of recipients listed below, and only to the extent necessary for the purposes described in this Policy.

• Service providers and processors — hosting and cloud infrastructure, content delivery, customer relationship management, email delivery, analytics, crash reporting, customer support and payment processing providers, engaged under written data processing agreements.
• Advertising partners — the advertising networks and mediation platforms listed in Section 9, which act as independent controllers for the processing they carry out.
• Professional advisers — legal, accounting, audit, insurance and compliance advisers, subject to professional confidentiality duties.
• Group companies and business partners — entities within our corporate group and carefully selected partners in the delivery of advisory or trading services, where necessary and lawful.
• Authorities and regulators — government bodies, courts, customs authorities, tax authorities and law enforcement where disclosure is required by law or necessary to protect our rights.
• Buyers and investors — in the context of a corporate reorganisation, financing or sale of assets, subject to appropriate confidentiality safeguards.

We do not sell or rent personal data to third parties for their own marketing purposes. We do not disclose the personal data of clients to advertisers for the purpose of targeted advertising without an appropriate lawful basis and, where required, your consent.

6. International Transfers

We are headquartered in Hong Kong and serve clients across Asia and Europe. As a result, personal data may be transferred to, processed in, or accessed from countries other than your own, including the Hong Kong Special Administrative Region, the European Economic Area, the United Kingdom, the United States, Mainland China, Singapore, Japan, South Korea and India.

Where personal data is transferred out of the EEA or the United Kingdom, we rely on an applicable transfer mechanism, which may include an adequacy decision, the Standard Contractual Clauses issued by the European Commission, the UK International Data Transfer Addendum, or another mechanism recognised by the relevant supervisory authority. For transfers subject to GDPR Article 46, we conduct a transfer impact assessment and apply supplementary measures where they are appropriate, including encryption in transit and at rest, and access controls.

We also observe applicable data localisation requirements. Where a particular market requires personal data to remain within its jurisdiction, we configure our processing accordingly.

7. Retention Periods

We retain personal data only for as long as it is necessary for the purposes for which it was collected.

8. Security

We apply security measures appropriate to the nature of the data, including encryption in transit using TLS and encryption at rest, role-based access controls, multi-factor authentication for administrative access, least-privilege permissions, logging and monitoring of access to personal data, regular vulnerability assessment, staff training, and periodic third-party security review.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within the statutory deadline (72 hours where GDPR or UK GDPR applies) and notify affected users where the law requires it.

9. Advertising and Monetisation

Our website and mobile applications are supported by advertising. We integrate third-party advertising SDKs that may display advertising on and around our content. These SDKs may collect device identifiers, advertising identifiers, usage data and coarse location information for the purpose of delivering, personalising and measuring advertising.

Some of our advertising partners are independent controllers and determine the means and purposes of their own processing. Where they act as processors on our behalf, we do so under written data processing agreements that impose GDPR and equivalent obligations.

9.1 Advertising platforms, purposes and opt-out routes

9.2 Personalised and non-personalised advertising

• Personalised advertising — served using information such as your advertising identifier (IDFA / AAID), inferred interests, prior interactions, approximate location and device characteristics, to build an audience profile. This is subject to consent where required, including the EU/UK consent requirement and the US state opt-out regimes.
• Non-personalised and contextual advertising — served using only the content of the page or app screen you are viewing, your approximate region and your device type, without building a cross-site or cross-app profile. You may be shown more generic advertising if you opt out of personalisation.
• Frequency capping and measurement — we limit the number of times the same advertisement is shown to you, and use aggregated measurement to understand campaign performance.

9.3 Consent, ATT, and advertising identifiers

• Apple App Tracking Transparency (ATT) — on our iOS application, the system prompts for permission before we or our partners can track your activity across other companies' apps and websites. If you decline, we will still show advertising, but it will be less relevant and you may see a higher volume of contextual advertising.
• IDFA and AAID — we collect and use the IDFA on Apple platforms and the AAID / GAID on Android only where you have consented, where the platform provides a resettable identifier, or where another lawful basis applies.
• Consent management — where required, our applications and website display a consent interface allowing you to accept, reject or amend your choices, and to withdraw consent at any time.
• Opt-out signals — we honour Global Privacy Control (GPC) and applicable Do Not Sell or Share signals where legally required and technically supported.

10. Advertising Formats and User Controls

Our applications and website may present the following advertising formats:

You can control advertising through the privacy settings on your device, through the opt-out links in Section 9.1, through our in-application preference centre where available, and by contacting us at support@youyuance.com. We do not present behaviourally targeted advertising to users who have opted out where that is legally required.

11. Cookies and Similar Technologies

Our website uses cookies and similar technologies (including local storage, session storage, pixels, SDKs and device identifiers). These fall into the following categories.

Where required by law, non-essential cookies are set only after you provide consent, and you may withdraw consent at any time through your browser settings, our consent interface or by emailing us.

12. Your Rights by Region

Depending on where you live, you may hold the following rights. We respond to verified requests within the period required by the applicable regime, generally within 30 days (or one month) of receipt, extendable by a further two months for complex requests.

If you are dissatisfied with how we handle your request, you may escalate to the relevant supervisory authority. We do not charge a fee for making a request unless it is manifestly unfounded, excessive or repetitive.

13. Children's Privacy and Age Policy

Our services are directed at business users. Our website and mobile management applications are not directed at children, and we do not knowingly collect personal data from children below the age of 13, or below the equivalent minimum age where local law requires a higher threshold (for example, 16 under GDPR where a member state has adopted it).

We comply with the US Children's Online Privacy Protection Act (COPPA) and its 2025 amendments, and with the GDPR rules on the protection of children's personal data (GDPR-K) and the EU Digital Services Act requirements applicable to services likely to be accessed by children. If we learn that we have inadvertently collected personal data from a child below the applicable threshold, we delete it as soon as we become aware.

Our applications are rated accordingly in the Apple App Store and Google Play, and we do not knowingly serve personalised advertising to children. Parents or guardians who believe a child has provided us with personal data may contact us at support@youyuance.com to request deletion.

14. App Store Compliance

14.1 Apple App Store Review Guidelines

Our applications are developed and submitted in line with the Apple App Store Review Guidelines, including the requirements on privacy policy disclosure, data collection and storage, user consent, account deletion, and the treatment of user-generated content.

14.2 Google Play Data Safety

We complete the Google Play Data Safety form for each application, declaring the categories of data collected, whether the data is shared, and whether the processing is encrypted in transit. Where we have made a change to our data practices, we update the Data Safety form before the relevant release is published.

14.3 Families policy and age assurance

We do not design our applications with children as the primary audience. Where a child is nonetheless likely to access a service, we apply the Google Play Families policy requirements, including child-directed treatment, contextual rather than behavioural advertising, and the parental consent flows required by the platform.

15. Do Not Track and Global Privacy Control

Where required by law, we honour the Global Privacy Control (GPC) signal and applicable "Do Not Sell or Share" or "Do Not Track" signals in our browser and application environments. Because there is no uniform standard for Do Not Track across browsers, we treat such signals as a request to limit data sharing and targeted advertising to the extent we can identify them. Disabling cookies or ad blocking in your browser may also prevent us from measuring campaigns, but will not change the content of our advice or services.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, our applications, our advertising partners, or our legal obligations. The "Last updated" date at the top of this Policy indicates when it was most recently revised. Where a change is material — for example, a new purpose for processing or a new category of advertising partner — we will provide additional notice through our applications, by email, or through the consent interface where required. Your continued use of our services after an update constitutes acceptance of the revised Policy where consent is not required.

17. Contact Us

If you have any questions about this Privacy Policy, or wish to exercise a right described in it, please contact us:

We will acknowledge your request as soon as practicable and aim to respond within 30 days, or the shorter period required by the applicable regime.

18. Effective Date

This Privacy Policy takes effect on [Effective date to be inserted] and was last updated on [Last updated date to be inserted].