Privacy Policy | One Small Step

Respecting and protecting our customers’ privacy and personal data is important to Ethel Chow Limited and its related companies (including all subsidiary and affiliate companies) (collectively, we or us). This Privacy Policy will help you understand how we collect, use and safeguard your personal data in our interactions with you.

It also describes your data protection rights, including a right to object to some of the processing which we carry out. More information about your rights, and how to exercise them, is set out in the section.

What information do we collect?

We collect and process personal data about you when you:

visit and/or register on any websites owned and operated by us (including onesmallstep.hk) (collectively, our Site);
place an order with us as a guest or as a registered user on our Site;
use a third-party service offered by service providers such as analytics companies, advertising networks and cooperatives, demographic companies, and any other third party service providers that we choose to collaborate or work with, and we obtain your personal data from those third parties;
provide us with your personal data via: our physical stores, Wi-Fi, mobile devices, social media platforms/

networks or telephone enquiries, your application for or use of our services or loyalty programmes.

visit our physical stores or any other of our locations and your image is captured by our security CCTV (please refer to our Closed-Circuit Television ("CCTV") Policy); and
visit our physical stores or any other of our locations, and our data analytics cameras carry out real-time data analyses based on your image for statistical research purposes on an anonymous and aggregated basis as set out in our Data Analytics Policy. The only personal data that will be collected and processed and used to analyse pathways throughout the store will be your facial bio-metric template derived from your facial image (i.e. numeric information describing different facial features).

In this Privacy Policy, your personal data means: your name, email address, contact number, MAC address, IP address, credit/debit card and other payment information, gender, date of birth, age, interests, geographical location, Site usage (including browsing behaviour / activities), shopping and purchasing behaviour, your physiological data in images captured by our analytics cameras (which data will be anonymized and aggregated before usage) and security CCTV, and other personal data you provide.

How do we use this information and what is the legal basis for this use?

We process personal data for the following purposes:

To conduct our business and pursue legitimate interests, in particular:

To provide our services to you, including: responding to any questions you may have, providing you with recommendations on products in our stores or on our Site; maintaining your shopping cart on our Site; assessing your applications with us for any of our services or loyalty programmes; fulfilling any orders you may make with us (including verification and security checks of your details, processing of your payments, shipping products that you have ordered to you, and processing returns or exchanges of products you have purchased); providing free Wi-Fi services to you at our physical stores; personalizing our services to you and enhancing your experience in using our services; and
We monitor use of our Site and our services (both online and offline), and use your information to help us monitor, improve and protect our products, content, services and websites, both online and offline;
To analyse trends, usage, browsing and shopping behaviour with us (whether on an individualized or anonymized and aggregated basis), which helps us better understand how you and our collective customer base access and use our Site, stores and services, for the purposes of:
- improving our services;
- to respond to customer desires and preferences;
- measuring the effectiveness of our marketing campaigns;
- conducting marketing activities targeted at external, potential customers (on an aggregated and anonymized basis only); and
- crowdsource data analytics and hackathon activities (on an aggregated and anonymized basis only).

When you give us consent (if required):

To provide you with direct marketing communications in relation to products, services, events, offers or promotions under the categories stated below, provided by: (a) us or our related companies (including our affiliate and subsidiary companies), (b) business partners, and (c) other third party providers. Such marketing communications may be in various forms, including advertisements, special events notifications or newsletters, and delivered via various methods in accordance with the personal data that you provide to us, such as by email, SMS, Whatsapp messages, smartphone app push notifications, notifications on your social media pages, in–app messaging or postal mail.
Such marketing communications may market or offer products or services (including special events and promotions) in the following categories: Dining, food and beverages, sports, music, film, television and other entertainment, clothing and accessories, jewellery, luggage and bags, cosmetics, personal health and hygiene, electronics, home furnishings, and housewares, automobiles, transport and travel, hotels, financial services, loyalty and reward programs, media services, entertainment services, social networking services, payment services, on-line advertising services, other e-commerce, information and communications and services, concierge services, and other products and services related to any of the foregoing, which we think may be relevant to you based on information you provide to us (for instance, via your participation in our surveys); and
To allow you to register for and participate in our events and promotions, including verifying your identity at those events and promotions.

For purposes which are required by law:

In response to requests by government or law enforcement authorities conducting an investigation.

Relying on our legitimate interest:

We have carried out an assessment on all the data processing activities described above in order to weigh up any privacy implications against our legitimate business interests. You can obtain information on any of our assessments by contacting us using the details set out later in this policy.

Withdrawing consent or otherwise objecting to direct marketing:

Wherever we require your consent under applicable law, you will always be able to withdraw any consent provided to us. We shall cease to use your personal data for the purpose in respect of which you have withdrawn your consent, but we may still use, process, store and transfer your data for other purposes, such as those set out above. Specifically, in the case of customers from the European Economic Area (EEA), we are able to send you direct marketing without your consent, where we rely on our business or legitimate interests. Irrespective of the legal basis on which we rely to send you direct marketing, you have an absolute right to opt-out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by: (a) contacting us at info@onesmallstep.hk or sending your request by post to; Privacy Officer, One Small Step, 9/F, Chau's Commercial Cetnre, 282-284 Sha Tsui Road, Tsuen Wan, Hong Kong SAR, or (b) in the case of direct marketing emails, by replying us on email you wish to unsubscribe.

Who will we share this data with, where and when?

We will share your personal data with the related companies of Ethel Chow Limited for the purposes set out in How do we use this information, and what is the legal basis for this use? section above.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes set out in How do we use this information, and what is the legal basis for this use? section above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on our behalf for the purposes identified in this Privacy Policy. In particular, we use the following third party providers:

Courier services;
E-mail/SMS/MMS/WeChat blasting services;
Telecom companies (for providing in-store Wi-Fi services);
Data storage and cloud service providers (for storage of your personal data and hosting of applications that process your personal data for the purposes identified in this policy);
Google, Facebook and other advertising networks (for matching of your personal data with their database in order to send you our direct marketing materials through your Google and/or Facebook account(s));
Marketing (including digital marketing) and website analytic agencies (for display of advertising materials on our Site and other websites that you may visit, and analysis of your online behaviour and usage of our Site – these agencies use cookies; please refer to our separate Cookies Policy for details); and
Data analytics and hackathon service providers and agencies (for the purposes stated in Clause How do we use this information, and what is the legal basis for this use? section above, in which only anonymized data will be sent to service providers for those purposes in Subclauses How do we use this information, and what is the legal basis for this use? section above)

Your data, in an anonymous form such that your identity cannot be ascertained, may also be sold to third parties for their own purposes.

In the event that our business or any part of it is sold or integrated with another business, your details will be disclosed to our advisers and any prospective purchaser’s adviser and will be passed to the new owners of the business.

If you are located in the EEA, where information is transferred outside the EEA, and where this is to a business partner or third party service provider in a country that is not subject to an adequacy decision by the EU Commission, data will be adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or third party or business partner’s Processor Binding Corporate Rules. A copy of the relevant mechanism can be provided for your review on request to the contact mentioned in the section How do I get in touch with you below. Your personal data may be transferred to Hong Kong and Macao Special Administrative Regions, Mainland China, Taiwan Region, Singapore, Australia, United States, Canada, United Kingdom and Japan.

What rights do I have?

Where permitted by law, you have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us in a structured, machine readable format, and to ask us to share (port) this data to another controller.

In addition, if you are located in the EEA you can object to the processing of your personal data in some circumstances (in particular, where we do not have to process the data for business or other legitimate interests, purposes for which consent has been given (including direct marketing) or other legal requirements).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are available under applicable laws. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests assessment, you can get in touch with us – or our privacy officer – using the details set out below. (Applicable only if you are located in EEA: If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred.)

How do I get in touch with you?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, or would like to opt out of direct marketing, you can get in touch at info@onesmallstep.hk or by writing to Privacy Officer, One Small Step, 9/F, Chau's Commercial Cetnre, 282-284 Sha Tsui Road, Tsuen Wan, Hong Kong SAR. You may also access, verify or update your personal data by logging into the Site or at one of our stores.

Who is the data controller?

The data controllers are Ethel Chow Limited, and its related companies; contact details can be found in the section How do I get in touch with you above.

How long will my data be kept?

Where we process registration data, we do this for as long as you are an active user of our Site and it is required for business and legitimate interests or legal requirement.

Where we process personal data for marketing purposes or with your consent, we process the data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data so that we can respect your request in the future.

(Applicable if you are located in EEA only) Where we process personal data for site security purposes, we retain it for 7 years after any business and legitimate interests no longer exists, and where we process personal data in connection with performing a contract or for a competition, we keep the data for 7 years from your last interaction with us.

We will not keep the images captured by our analytics cameras for more than 1 day, and such images will be anonymized and aggregated before any use of the same for the purposes stated in How do we use this information, and what is the legal basis for this use? section above.

Photography Policy

We place conspicuous notices in our stores to inform customers we prohibit unauthorised photography, sound and/or video recording for commercial use, private gain, use in press or media, or for promotional purposes in our stores. We reserve the right to remove offenders from our premises.

We permit photography, sound and/or video recording where the images/recordings are solely for personal use and are not published or reproduced in print or electronically for commercial use, private gain, use in press or media, or for promotional purposes.

Permitted photography, sound and/or video recording are subject to the following conditions:

no photographs or video and/or sound footage is taken of staff members or other customers without express permission of the staff member or customer;
flash and tripods are not used without written permission;
customers refrain from taking photographs, and recording sound and/or video footage and/or leave the premises if;
- they are causing concern to any staff member or a nuisance to other customers;
- our staff reasonably believe the customer is causing an obstruction or compromising safety or security in any way;
- our staff reasonably suspect that photography, sound and/or video recording are for commercial use, private gain, use in press or media, or for promotional purposes.

If a customer has queries in relation to the photography policy, he/she may contact the Store Manager.

Closed-Circuit Television ("CCTV") Policy

Policy Statement

This policy outlines the policies and procedures regarding the use of CCTV in One Small Step stores undertaken to comply with the requirements of the Personal Data (Privacy) Ordinance (the Ordinance). CCTV is used to procure reasonable security and safety of the monitored area.

In accordance with the Ordinance and relevant guidelines issued by the Office of the Privacy Commissioner for Personal Data (PCPD):

Data subjects are explicitly informed they are subject to CCTV surveillance by notices reading “CCTV in operation” in areas of surveillance. We place conspicuous notices at the entrance to any monitored area and fixes further notices inside the area.
Notices are also posted if the CCTV cameras themselves are very discreetly located, or in places where a data subject may not expect to be subject to surveillance.
CCTV cameras are not installed in places where people have a reason to expect privacy.

Our Privacy Policy and CCTV notices reflect the usage of CCTV in our stores and reads as follows:

We employ Closed-Circuit Television (CCTV) in our stores. Store premises are subject to CCTV surveillance and activities are recorded by video camera to procure reasonable security and safety of the monitored area.
Information obtained through CCTV monitoring will be used exclusively for safety, security, and law enforcement purposes. Recorded images will be stored in a secure location with access by authorized staff only and will be securely deleted as soon as practicable once the purpose of collection is fulfilled.
If you wish to contact us in relation to privacy of your personal data, please contact our Privacy Officer at info@onesmalstep.hk or by writing to Privacy Officer, One Small Step, 9/F, Chau's Commercial Centre, 282-284 Sha Tsui Road, Tsuen Wan, Hong Kong SAR.

General Procedures

I. Proper Handling of the Recorded Images

(a) The personal data collected is securely deleted from the CCTV as soon as practicable once the purpose of collection is fulfilled. If no incident is reported, the footage will be securely deleted regularly accordingly.

(b) Upon expiry of the applicable retention period, we permanently destroy all personal data: (i) if in hard copy form, by first shredding and then securely disposing of the personal data; and (ii) if in electronic form, by permanently erasing the personal data from our systems. The CCTV footage/images are removed automatically from the system regularly. All authorized users having access to any copy pf the CCTV footage/images shall delete such copy once any reported incident being reported is closed or is no longer active.

(c) If an incident occurs in the store, CCTV footage is preserved in a secure way until such time as the incident is fully investigated and the matter is closed. Usual deletion policies in relation to CCTV footage are suspended for the relevant footage during that period.

(d) Security measures are in place to prevent unauthorized access to the CCTV system. Recorded images are kept in safe custody, subject to and in accordance with the following measures:

(1) A login account and password for access to and storage of footages is available only to authorized users.

(2) Access to locations where the images recorded by the CCTV cameras are viewed, stored or handled are secured and restricted to authorized users only. The authorized users can only view the CCTV footage only when the incident is reported.

(3) CCTV footage is not transferred in digital format through email, mobile or any other device other than to the Legal Department or to authorized users provided that the footage is encrypted and then only as strictly necessary for valid reason and subject to and in accordance with this clause and clause II below.

(e) Proper records of the staff members taking charge of and keeping the recorded images are maintained by authorized users.

(f) Transfer and movements of the recorded images are clearly documented and only made in accordance with clause I(d)(3).

(g) The hard disks or any devices storing the recorded images are securely protected from unauthorized access (e.g. an encryption function is used) and only viewed, retrieved or handled upon proper authorization for the intended purpose (e.g. police investigation). Once there is no valid reason to retain the recorded images, they are securely deleted. Safeguards are in place to protect wireless transmission systems from interception should they be used for transmission of data recorded by CCTV.

II. Transfer of CCTV Records to Third Parties

(a) Personal data is only used for the purposes for which it was collected or a directly related purpose (see How do we use this information, and what is the legal basis for this use? section above, unless the data subject has given their express voluntary consent for any other purpose or when any applicable exemptions under the Ordinance apply.

(b) Disclosure of CCTV records to any third party shall only be in accordance with section Who will we share this data with, where and when? or in accordance with the Ordinance.

(c) If we are requested to provide CCTV records to a law enforcement agency e.g. the Police for criminal investigation purposes, we will cooperate only with a written request provided by the relevant law enforcement agency and if we reasonably believe that an exemption under the Ordinance applies.

III. Misuse or abuse of CCTV system or the recorded images is reported to Legal Department (email: info@onesmallstep.hk.)

IV. Compliance checks and audits are carried out annually to review the effectiveness of the safeguards and procedures of the CCTV system.

Customers Enquiries/Law Enforecemnt Agencies (e.g. Polcie)

I. If a customer has queries in relation to the operation of the CCTV and the purpose or in relation to privacy issues of his/her personal data, he/she may contact our Privacy Officer, One Small Step, 9/F, Chau's Commercial Centre, 282-284 Sha Tsui Road, Tsuen Wan, Hong Kong SAR.

II. We do not accept requests from customers to view of CCTV footage because CCTV footage may contain personal data of other third parties and we may not be allowed to share it with third parties by law.

III. We will accept requests from the police or other enforcement agent to view the CCTV footage and/or have a copy of the same upon receipt of a formal written request, and subject to the application of an exemption under the Ordinance.

Data Analytics Policy

This section outlines the policies and procedures regarding the use of data analytics cameras in our stores. Data analytics cameras are used in our stores to generate anonymous and aggregated data for statistical research purposes, such as demographics analysis and traffic flow analysis within our stores. The anonymised and aggregated data will be used by us to help improve our services.

The only personal data we may collect is facial bio-metric templates derived from a facial image captured by the analytics camera (i.e. numeric information describing different facial features), which will be collected and used and processed by the analytics camera for the purposes stated above (namely, to analyse traffic flow within our stores for statistical research purposes). No video footage, images or other personally identifiable data shall be stored. All analysis conducted by the data analytics cameras based on the footage will be done in real time. Security measures are in place to prevent unauthorized access to the data analytics system.

The facial bio-metric templates collected using the analytics camera will be securely deleted within 24 hours of being collected, and only the aggregated and anonymised data will be retained.

Data subjects are explicitly informed that the data analytics cameras are in operation in applicable areas by notices reading “analytics cameras in operation”. We place conspicuous notices at the entrance to any monitored area and fix further notices inside the area. Notices are also posted to alert customers if the analytics cameras themselves are very discreetly located. No analytics cameras are installed in places where people have a reason to expect privacy.

The facial bio-metric templates collected using the analytics camera will only be disclosed to our third party service providers who operate the analytics cameras for the purposes stated above (namely, to analyse traffic flow within our stores in order to generate anonymous and aggregated data for statistical research purposes). All use or transfer of data derived from the analytics cameras will be on an anonymised and aggregated basis, such that you cannot be identified or re-identified.

If a customer has queries in relation to the operation of the data analytics cameras or in relation to privacy issues of his/her personal data, he/she may contact our Privacy Officer, One Small Step, 9/F, Chau's Commercial Centre, 282-284 Sha Tsui Road, Tsuen Wan, Hong Kong SAR.

California Consumer Privacy Act

Notice for California Residents

Last updated: 30 July, 2020

This notice applies solely to all visitors who reside in the State of California and is presented in compliance with the California Consumer Privacy Act of 2018 (“CCPA”).

Information we collect

We are required to disclose to you the categories and sources of personal data we collect within the last 12 months. Please refer to the sections What information do we Collect? and How do we use this information, and what is the legal basis for this use? for details on the personal data we collect.

Sharing personal data/Do not sell my personal data

We may disclose your personal data to third parties for a variety of business purposes. Please refer to the Who will we share this data with, where and when? section for details.

We do not sell your personal data to third parties for their own marketing and advertising or other business purposes.

Your Other California Privacy Rights

Right to Know

You have the right to request us to disclose to you certain information about our collection of your personal data over the past 12 months. Upon receipt and confirmation of your verifiable customer request, we will disclose to you:

The categories of Personal Information we collected about you
The categories of sources from which we collected Personal Information about you
Our business or commercial purpose for collecting or selling such Personal Information
The categories of third parties with whom we share such Personal Information
The specific pieces of Personal Information we collected about you
If we sold or disclosed your Personal Information for a business purpose, two separate lists disclosing the categories of Persona

Information involved in:

- sales, and the category third party to whom the data was sold

- disclosures for a business purpose, and the category of third party to whom the data was disclosed

Right to Request Deletion

You have the right to request us to delete Personal Information we collected from you. Upon receipt and confirmation of your verifiable customer request, we will delete such Personal Information from our records, unless it is necessary for us or our service providers to:

Complete the transaction for which such Personal Information was collected, fulfill the terms of a written warranty or produce recall conducted in accordance with applicable law, provide a good or service you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
Debug products to identify and repair errors that impair existing intended functionality;
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law;
Comply with the California Electronic Communications Privacy Act;
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely render impossible or seriously impair the achievement of such research, if you previously provided informed consent;
Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
Comply with a legal obligation; or
Use such Personal Data, internally, in a lawful manner that is compatible with the context in which you provided such Personal Information.

Right to access Personal Data

You may submit requests to exercise your rights in relation to your personal data to the email address set out in the How do I get in touch with you? section. We will seek to disclose and deliver to you the required information in accordance with the CCPA.

Right not to be discriminated against

We will not discriminate against you because you exercise your California privacy rights, and will not deny you goods or services, charge you a different price or rates for goods or services, or provide a lower quality of goods or services to you due to the exercise of such rights.