Privacy Policy

Last updated: February 10, 2026

Ashsta ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you visit our website ashsta.com (the "Site"), make a purchase, contact us, or interact with us on social media (collectively, the "Services").

By using our Site or Services, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use our Site or provide us with your personal data.

Information We Collect

We may collect the following types of personal data:

Information you provide directly

Name, email address, shipping/billing address, phone number
Payment information (handled securely by our payment processors — we do not store full card details)
Order details and preferences
Messages or communications you send us (e.g., via email or Instagram DM)

Information collected automatically

Device information (IP address, browser type, operating system)
Usage data (pages visited, time spent, referring site)
Cookies and similar technologies (for site functionality, analytics, and marketing — see our Cookie section below)

We collect only the personal data necessary for the purposes described in this policy.

How We Use Your Personal Data

We use your personal data for the following purposes:

To process and fulfill your orders, including shipping and payment
To communicate with you about your order, returns, or inquiries
To provide customer support
To improve our Site and Services (analytics)
To send marketing emails or promotions (only if you opt in)
To comply with legal obligations (e.g., tax, accounting, fraud prevention)

We will only use your data for the purposes for which it was collected, or for compatible purposes, unless we obtain your consent for other uses.

Sharing Your Personal Data

We may share your personal data with:

Service providers (e.g., Shopify, payment processors like Stripe/PayPal, shipping carriers such as SF Express or DHL, email service providers) — they are contractually required to protect your data
Legal authorities if required by law, court order, or to protect our rights/safety
Business partners in the event of a merger, acquisition, or sale of assets (with notice where required)

We do not sell your personal data to third parties.

Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience, analyze usage, and deliver personalized content/ads.

Essential cookies: Required for the Site to function (e.g., cart, login)
Analytics cookies: Help us understand how visitors use the Site (e.g., Google Analytics)
Marketing cookies: For targeted ads (if enabled)

You can manage cookies via your browser settings or our cookie banner (if implemented). Note: Disabling essential cookies may affect Site functionality.

Data Storage and Security

Your data is stored on secure servers (primarily via Shopify in secure data centers).
We implement reasonable technical and organizational measures to protect your personal data from unauthorized access, loss, or misuse.
Data is retained only as long as necessary for the purposes outlined, or as required by law (typically 6–7 years for order/tax records).

Your Rights Under Hong Kong Law

Under the Personal Data (Privacy) Ordinance (PDPO), you have the right to:

Access your personal data held by us
Request correction of inaccurate data
Request us to stop using your data for direct marketing
Withdraw consent for certain processing activities (where consent was the basis)

To exercise these rights, email us at info@ashsta.com. We will respond within 40 days (as required by law) and may charge a reasonable fee for access requests if permitted.

International Transfers

If you are located outside Hong Kong, your data may be transferred to and processed in Hong Kong or other jurisdictions where our service providers are located. We ensure appropriate safeguards are in place for such transfers.

Children's Privacy

Our Site and Services are not directed at children under 18. We do not knowingly collect personal data from children under 18. If we become aware of such collection, we will delete the data.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Site after changes constitutes acceptance.