Privacy policy

TAKMOON FOOD SUPPLIES LIMITED

Privacy Policy Statement

1. About this Policy

1.1 This Privacy Policy Statement (this "Policy") explains how TAKMOON FOOD SUPPLIES LIMITED (the "Company", "Takmoon", "we", "us", or "our") collects, uses, holds, processes, discloses, transfers, and safeguards Personal Data (as defined below) of users of our Services (as defined in Paragraph 1.3 below), regardless of the channel through which you interact with us, and explains your privacy rights and how the law protects you.

1.2 This Policy is issued pursuant to the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (the "PDPO") in connection with the Company's collection and processing of Personal Data for its business activities, and its compliance with applicable laws, guidelines, codes of practice, and requirements of regulatory or other authorities, including the Privacy Commissioner for Personal Data of Hong Kong (the "PCPD").

1.3 This Policy applies to: (a) our corporate and marketing websites, including landing pages used to record prospective users' interest in our Services ("LP"); (b) our e-commerce websites, mobile applications, and official accounts (including on messaging platforms); and (c) any other online or offline channel through which we collect or process Personal Data in connection with our business (collectively, the "Services").

1.4 This Policy should be read together with any Personal Information Collection Statement ("PICS") provided to you at the specific point of collection of your Personal Data. Where there is any inconsistency between this Policy and a PICS in respect of a specific collection of Personal Data, the PICS shall prevail in respect of that collection.

2. Definition of Personal Data

2.1 "Personal Data" means data, whether true or not, about an individual who can be identified from that data, or from that data together with other information to which the Company has or is likely to have access. This includes, for example: name, date of birth, address, postal code, phone number, email address, payment information (e.g., credit card token or masked card data via our payment provider), government-issued identifiers where permitted and necessary (e.g., for identity verification), account identifiers (e.g., messaging app IDs), and online identifiers (e.g., cookies, device IDs, IP addresses).

3. Personal Data We Collect

To enable your use of the Services, to maintain the Services, and in connection with membership sign-up, testing, newsletters, purchases, or promotional events, the Company may collect the following kinds of Personal Data, depending on how you interact with us (LP or e-commerce):

3.1 Identity and contact data: name, email address, phone number, postal address;

3.2 Account and profile data: account credentials, preferences, dietary preferences or restrictions you choose to provide, order history;

3.3 Transaction and payment data: payment method, masked card details or tokens (processed by our payment processors), billing and delivery information;

3.4 Communications and support data: content of inquiries, feedback, survey responses, and customer support records (including logs of issues and resolutions);

3.5 Marketing and analytics data: cookie identifiers, device and usage information, browsing history on our Services, referral sources, and interaction with emails and advertisements, including traffic data, location data, weblogs and other communication data;

3.6 Demographic and lifestyle data (if you choose to provide it, e.g., family composition, occupation, income range in surveys); and

3.7 Data received from partners: transaction or interaction records received from our advertising, analytics, logistics, or payment partners, where permitted by law and subject to your express consent.

The specific categories of Personal Data collected from you, and whether provision of any particular item is necessary for us to provide the relevant product or service, will be set out in the applicable PICS provided to you at the point of collection; the categories above are not intended to be inconsistent with, but rather a fuller explanation of, the categories referred to in the applicable PICS.

4. How We Collect Personal Data

4.1 Directly from you, for example, when you:

submit an enquiry or registration form on our LP;
register for, or log into, an account on our Services;
place an order or complete a transaction;
contact our customer support team;
participate in a survey, interview, or promotional campaign; or
opt in to receive marketing communications.

4.2 Automatically: via cookies, SDKs, pixels, and similar technologies when you use our Services.

4.3 From third parties: payment processors, analytics and advertising networks, logistics partners, and other service providers or business partners, in accordance with applicable law and your express consent where required.

5. Purposes of Collection, Use and Disclosure

The Personal Data provided by users to the Company, and any documentation created in the course of our relationship with users, will be used for the following purposes. The Company will not use Personal Data in a way that is likely to encourage or induce any illegal or unfair act.

5.1 Service Provision and Operations — to create and manage accounts; provide, operate, and improve the Services; process and deliver orders; notify users of delivery, service changes, or security updates; provide customer support and handle inquiries and complaints; perform identity verification where needed; process payments and prevent fraud, chargebacks, and misuse; and send service-related messages.

5.2 Marketing, Personalisation, and Analytics — to conduct surveys, interviews, and market research; to send rewards or gifts related to campaigns; to personalise content, recommendations, and offers; and to measure and analyse usage, service performance, marketing effectiveness, and audience insights. Where any of the foregoing, or the sending of information on new features, updates, promotions, and campaigns, constitutes direct marketing under Part 6A of the PDPO, it will only be carried out (and, where applicable, Personal Data will only be provided to our business partner for its own direct marketing use) in accordance with Section 7 (Direct Marketing) below.

5.3 Product Development and Improvement — to improve the functionality, quality, and user experience of the Services, including the services of our business partner; and to plan, research, and develop new products or services, including in connection with the Company's testing and market-trial activities conducted for the benefit of our business partner.

5.4 Legal, Compliance, and Business Purposes — to enforce our terms and policies; to prevent, detect, and investigate fraud, abuse, or security incidents; to comply with laws, regulations, court orders, and lawful requests of public authorities; for corporate transactions (e.g., mergers, acquisitions, business transfers) and associated due diligence; where necessary for the Company's or a third party's legitimate interests, provided such interests are not overridden by the user's interests and fundamental rights; and to maintain records in compliance with applicable Hong Kong ordinances and subsidiary legislation, and other applicable laws, rules, and regulations of regulators and authorities in Hong Kong and overseas.

5.5 The Company will notify users of any additional purposes at or before collection and will obtain express consent where required. If the Company intends to use Personal Data for a new purpose not reasonably related to the original purpose, it will provide further notification and obtain express consent where required under the PDPO.

5.6 In connection with the purposes described above, the Company may disclose Personal Data to the following classes of persons, each of whom is subject to a duty of confidentiality to the Company:

5.6.1 our business partner — the developer and operator of the products and services being tested and offered by the Company in Hong Kong. This business partner is not a member of the Company's corporate group. Personal Data collected by the Company in Hong Kong is provided to this business partner for the purposes described above, in particular service provision and operation, marketing and analysis, and product development and improvement;

5.6.2 service providers and data intermediaries — payment processors, cloud hosting providers, analytics providers, advertising networks, email/SMS providers, customer support tool providers, logistics partners, and other vendors engaged to perform services on the Company's behalf. The Company will use reasonable endeavours, where practicable, to put in place contractual or other arrangements requiring such service providers and data intermediaries to protect Personal Data to a standard comparable to that required under the PDPO and to use it only for the purposes for which it was engaged;

5.6.3 other commercial partners — where the user has given express consent or as otherwise permitted by law, for co-marketing, promotions, or integrated services;

5.6.4 professional advisors — auditors, lawyers, and consultants, for compliance and risk-management purposes;

5.6.5 corporate transaction counterparties — in connection with mergers, acquisitions, business transfers, or reorganisation, subject to confidentiality obligations and applicable law; and

5.6.6 authorities — to comply with applicable laws, regulations, legal process, or lawful requests of government or regulatory authorities.

5.7 The Company does not sell Personal Data.

The specific purposes and classes of transferees applicable to a particular collection of your Personal Data will be confirmed in the applicable PICS provided to you at the point of collection; where a PICS refers to "other purposes set out in Section 5" of this Policy, this Section 5 shall apply.

6. Voluntary Nature of Providing Personal Data; Legal Basis and Express Consent

6.1 Providing your Personal Data to us is voluntary. However, if you choose not to provide the Personal Data that is necessary for a particular product, service, or enquiry (for example, your name, contact details, and, where applicable, payment information), we may not be able to provide you with the relevant product, service, or response to your enquiry.

6.2 The Company collects, uses, and discloses Personal Data with the user's express consent, and/or where permitted or required by the PDPO without express consent (e.g., to respond to an emergency, for investigations or legal proceedings, or where an applicable exemption under Hong Kong law applies).

6.3 By providing Personal Data to the Company, using the Services, or otherwise indicating express consent (e.g., by ticking a consent box), the user consents to the Company's collection, use, and disclosure of the user's Personal Data for the purposes stated in this Policy and any applicable PICS.

6.4 Users may withdraw express consent at any time (see Paragraph 14). Where consent is withdrawn in respect of Personal Data necessary for the provision of the Services, the Company may be unable to continue providing the relevant Services.

7. Direct Marketing

7.1 The Company may wish to use a user's name, telephone number, email address, and postal address to send the user information about, or otherwise promote, the Company's food and grocery subscription products, services, promotions, offers, and events, including products and services developed by its business partner (the "Marketing Subjects"). Such communications will be sent by the Company itself.

7.2 The Company will not use a user's Personal Data for the purpose described in Paragraph 7.1 unless the user has given consent. The specific mechanism for giving or withdrawing such consent (including the classes of Personal Data and Marketing Subjects concerned) is set out in the applicable PICS provided to the user at the point of collection.

7.3 The Company does not currently provide users' Personal Data to its business partner or any other third party for that party's own use in direct marketing. If this changes, the Company will first obtain the user's separate written consent, as required under the PDPO, before doing so.

7.4 A user may withdraw consent to direct marketing at any time, free of charge, by using the opt-out or unsubscribe function provided in the relevant communication, or by contacting the Data Protection Officer. Where a user has not given consent, or has withdrawn consent, the Company will not use that user's Personal Data for direct marketing.

8. Cookies and Similar Technologies

8.1 The Company uses cookies, pixels, SDKs, and similar technologies to enable core functionality of the Services, remember preferences, analyse traffic and performance, customise content, and, where applicable, measure the performance of the Services.

8.2 Users may manage cookies through their browser or device settings. Blocking certain cookies may affect the functionality of some features of the Services.

9. Cross-Border Data Transfers

9.1 As described in Paragraph 5.6.1, the Company transfers Personal Data to its business partner outside Hong Kong, and may also transfer and store Personal Data outside Hong Kong where our other service providers' servers or operations are located. Section 33 of the PDPO (which would impose statutory restrictions on cross-border transfers of Personal Data) has not yet been brought into force. Nonetheless, the Company will have regard to the PCPD's published guidance on cross-border data transfers (including the Recommended Model Contractual Clauses) and will take reasonable steps to ensure that any recipient of Personal Data outside Hong Kong is bound by contractual or other enforceable obligations to provide a standard of protection comparable to that required under the PDPO.

9.2 By providing Personal Data to the Company, the user consents to the Company's transfer of such Personal Data to any party to whom the Company is authorised to disclose it under this Policy, notwithstanding that such party's principal place of business is outside Hong Kong, or that the Personal Data will, following disclosure, be collected, held, processed, or used outside Hong Kong.

10. Data Accuracy

10.1 The Company will, from time to time, take reasonable steps to verify the accuracy of Personal Data provided by users and may request supporting documentation (e.g., identification documents or proof of address) before certain Personal Data is used. The Company makes reasonable efforts to ensure Personal Data likely to be used to make a decision affecting a user, or to be disclosed to another organisation, is accurate and complete.

10.2 Users should keep their account information up to date and notify the Company of any changes.

11. Data Security

11.1 The Company implements reasonable security measures to protect Personal Data in its possession or under its control from unauthorised or accidental access, processing, erasure, loss, or use, including access controls, encryption in transit and at rest where appropriate, and secure development and operational practices. Access to Personal Data is granted strictly on a "need to know" basis.

11.2 No method of transmission or storage is completely secure, and the Company cannot guarantee absolute security.

12. Data Retention

12.1 The Company retains Personal Data only for as long as necessary to fulfil the purpose(s) for which it was collected, or as required or permitted by law. Personal Data will be securely deleted or anonymised, or the Company will otherwise cease to retain it, once retention is no longer necessary.

12.2 For illustration, order and transaction data may be retained for the duration of the contractual relationship and thereafter for the period necessary to satisfy tax, accounting, legal, and compliance obligations.

12.3 The Company may retain Personal Data for a longer period where there is a complaint or a reasonable prospect of litigation concerning its relationship with the user.

13. Access and Correction Requests

13.1 The Company complies with the data access and correction requirements under the PDPO. Users may request access to their Personal Data held by the Company, information about how it has been used, and correction of any Personal Data believed to be inaccurate or incomplete.

13.2 The Company may charge a reasonable fee for processing a data access request, of which the user will be informed in advance, as permitted under the PDPO.

13.3 The Company will respond to access and correction requests as soon as reasonably practicable, and in any event within 40 days of receipt, in accordance with the PDPO. The Company may refuse a request where permitted by law (e.g., where compliance would unreasonably reveal Personal Data of another individual).

14. Withdrawal of Consent and Data Breach Notification

14.1 Users may ask the Company to withdraw consent to the collection, use, or disclosure of their Personal Data, or to delete or erase their Personal Data, at any time by contacting the Data Protection Officer identified in Paragraph 19, unless the Company has good reason to continue processing the same. The Company will process such requests within a reasonable time and will inform the user of the likely consequences of withdrawal. The Company may not always be able to give effect to an erasure request for specific legal reasons, which will be notified to the user where applicable.

14.2 Where the Company assesses that a data breach has occurred that is likely to result in significant harm to affected individuals, it may notify the PCPD and affected individuals in accordance with the PCPD's guidance and applicable legal requirements then in force.

15. Children's Data

The Services are not directed to children under the age of 18. The Company does not knowingly collect Personal Data from children under 18 without verifiable parental consent. Parents or guardians who believe their child has provided Personal Data to the Company without consent should contact the Data Protection Officer to arrange deletion.

16. Third-Party Sites and Services

The Services may contain links to, or integrations with, third-party websites, applications, or services. The Company is not responsible for the privacy practices of such third parties, and users should review the relevant third party's privacy policy.

17. Updates to this Policy

The Company may update this Policy from time to time. Any updated Policy will be posted, together with its effective date, on the Company's website or application, and users will be notified by reasonable means of any material change. Where required by law, the Company will obtain express consent to material changes before they take effect.

18. Governing Law

This Policy is governed by the laws of Hong Kong. Nothing in this Policy limits any right a user may have under the PDPO.

19. Enquiries and Contact — Data Protection Officer

If you have any question, request (including for access, correction, or withdrawal of consent), or complaint regarding your Personal Data, please contact our Data Protection Officer:

Data Protection Officer
TAKMOON FOOD SUPPLIES LIMITED
Email: cs@hk-o-makase.jp
Postal Address: FLAT/RM 09-10 BLK 1 15/F EVER GAIN PLAZA 88 CONTAINER PORT ROAD KWAI CHUNG, Hong Kong

The Company will normally require proof of identity before responding to a request under this Paragraph, and will respond as soon as reasonably practicable and, in any event, within 40 days of the request, in accordance with the PDPO.

Users will not be charged a fee to access their Personal Data or to exercise other rights under the PDPO, save that the Company may charge a reasonable fee, or decline to comply, where a request is manifestly unfounded, repetitive, or excessive.

Effective Date: 3rd August 2026

This Policy Statement should be read together with the Personal Information Collection Statement(s) provided to you at the point personal data is collected from you.

TAKMOON FOOD SUPPLIES LIMITED

Personal Information Collection Statement (PICS)

To be provided to individuals at the point their personal data is collected (e.g., on registration/order forms, sign-up pages, or landing pages), in accordance with Data Protection Principle 1(3) of the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO").

This Personal Information Collection Statement ("PICS") explains why TAKMOON FOOD SUPPLIES LIMITED (the "Company", "we", "us", or "our") is collecting your personal data ("Personal Data") at this point, how we will use it, and your related rights. Please read this PICS before submitting your Personal Data to us. This PICS should be read together with our Privacy Policy Statement, available above on this page, which contains further details of our personal data practices.

1. Personal Data Collected

Depending on the channel through which you interact with us, we may collect the following Personal Data from you:

1.1 name, address, postal code, telephone number, and email address;

1.2 payment information (e.g., credit card token or masked card details processed via our payment provider);

1.3 online identifiers (e.g., cookies, device ID, and IP address); and

1.4 such other Personal Data as is indicated as being collected on the specific form or channel through which you are providing your Personal Data (see Annex A and Annex B).

2. Purposes of Collection and Use

We collect and use your Personal Data for the following purposes:

2.1 to provide, operate, and improve our products and services, including processing and delivering your orders and providing customer support;

2.2 for marketing and analysis, including sending you information about products, promotions, and offers (where you have given consent), and analysing usage of our services;

2.3 for product development and improvement, including of products and services developed by our business partner; and

2.4 for the other purposes set out in Section 5 of our Privacy Policy Statement.

3. Voluntary Nature of Providing Personal Data

3.1 Providing your Personal Data to us is voluntary. However, if you choose not to provide the Personal Data that is necessary for a particular product, service, or enquiry (for example, your name, contact details, and, where applicable, payment information), we may not be able to provide you with the relevant product, service, or response to your enquiry.

4. Persons to Whom Your Personal Data May Be Transferred

We may transfer your Personal Data to the following classes of persons, each of whom is under a duty of confidentiality to us:

4.1 our business partner, which develops and operates the products and services being tested and offered by us in Hong Kong, for use in service provision and operation, marketing and analysis, and product development and improvement;

4.2 our service providers and data intermediaries, including payment processors, cloud hosting providers, logistics partners, and analytics and advertising providers, engaged to perform services on our behalf;

4.3 our other commercial partners, where you have given consent or as otherwise permitted by law, for co-marketing, promotions, or integrated services;

4.4 our professional advisors (e.g., auditors and lawyers);

4.5 corporate transaction counterparties, in connection with mergers, acquisitions, business transfers, or reorganisation, subject to confidentiality obligations and applicable law; and

4.6 government or regulatory authorities, where required or permitted by law.

Personal Data transferred to the persons described in paragraphs 4.1 and 4.2 above may be transferred to, and processed in, jurisdictions outside Hong Kong where such persons operate. We will take reasonable steps to ensure that any such recipient provides a standard of protection for your Personal Data comparable to that required under the PDPO. We do not sell your Personal Data to third parties.

5. Direct Marketing

5.1 We may wish to use your name, telephone number, email address, and postal address to send you information about, or otherwise promote, our food and grocery subscription products, services, promotions, offers, and events, including products and services developed by our business partner (the "Marketing Subjects"). These communications will be sent to you by us; we will not provide your Personal Data to our business partner or any other third party for that party's own use in direct marketing (see paragraph 5.3 below).

5.2 We will not use your Personal Data for the purpose described in paragraph 5.1 above unless you give your consent. Please indicate your choice below:

☐ I consent to receiving direct marketing communications about the Marketing Subjects described in paragraph 5.1 from TAKMOON FOOD SUPPLIES LIMITED.

If you do not tick this box (or otherwise give your consent), we will not use your Personal Data for direct marketing. This will not affect your ability to use our products or services.

5.3 We do not currently provide your Personal Data to our business partner or any other third party for that party's own use in direct marketing. If this changes in the future, we will first obtain your separate written consent, as required under the PDPO, before doing so.

5.4 You may withdraw your consent at any time, free of charge, by using the opt-out/unsubscribe function in our communications or by contacting our Data Protection Officer (see Section 7 below).

6. Your Rights of Access and Correction

Under the PDPO, you have the right to request access to, and correction of, your Personal Data held by us. You may also request information about the kinds of Personal Data we hold and the purposes for which it is used. We may charge a reasonable fee for an access request, of which we will notify you in advance. We will respond to your request as soon as reasonably practicable, and in any event within 40 days.

7. Contact — Data Protection Officer

Requests for access to or correction of your Personal Data, withdrawal of consent, or any queries or complaints about how we handle your Personal Data, should be directed to:

Data Protection Officer
TAKMOON FOOD SUPPLIES LIMITED
Email: cs@hk-o-makase.jp
Postal Address: FLAT/RM 09-10 BLK 1 15/F EVER GAIN PLAZA 88 CONTAINER PORT ROAD KWAI CHUNG, Hong Kong

Annex A — Landing Page (LP) Specific Collection Notice

For our LP used to record prospective users' interest in our products and services:

A.1 Data collected: at minimum, name, email address, and phone number; optionally, area of residence, product/service interest, preferred contact channel, and any other information you choose to submit.

A.2 Purposes: to contact you regarding product availability and launches, to confirm your interest, to invite you to trials or surveys, to send pre-launch updates and, where you have given consent under Section 5 (Direct Marketing) above, marketing communications, and to analyse interest for service-planning purposes.

A.3 Retention: we will retain LP data for as long as needed for pre-launch engagement. If you later register for our e-commerce services, we may transfer this data into your account profile. If you do not proceed to register and request deletion, we will delete or anonymise your data, subject to any legal retention requirements.

Annex B — E-Commerce / Membership Specific Collection Notice

For our full e-commerce services:

B.1 Additional data collected: delivery addresses, order and transaction history, payment tokens, delivery notes, and dietary preferences you choose to provide.

B.2 Purposes: order processing and delivery, customer support, fraud prevention, service maintenance, account management, analytics, personalisation, marketing communications (where you have given consent under Section 5 (Direct Marketing) above), and legal compliance.

B.3 Delivery and logistics: we share necessary delivery details with our logistics partners to fulfil your orders.

B.4 Allergens: while we take care in handling food products, we cannot guarantee that any product is free from all allergens. If you have allergies, please consult a medical professional before using our products and carefully review product information.

By submitting your Personal Data to us, you acknowledge that you have read and understood this PICS.