Privacy Policy
How we handle personal data belonging to client contacts and to the individual recipients of a gifting program.
1. Who this applies to
This policy covers personal data ELP Holding Limited processes about (a) our client contacts — the people at a client company who instruct us, and (b) gift recipients — the customers or staff a client asks us to deliver a gift to. Recipients do not create an account with us directly for a physical gifting program; their data reaches us through the client that engaged us, and is used only to fulfil that engagement.
2. What we collect
- Client contact data — name, company, email, phone, and any billing details, submitted through our contact form, by email, or via our partner portal.
- Recipient data — names, delivery addresses, and where needed for delivery coordination, phone numbers or email addresses, provided to us by the client for the purpose of a specific gifting program.
- Portal account data — for clients and recipients who use our partner or customer portal, account credentials (stored as a salted hash, never in plain text), session activity, and — where a prepaid card or stored-value product is issued — the balance and transaction history associated with that card.
3. Why we use it
We use personal data to: fulfil a gifting order (sourcing, branding, and delivery to the recipients you specify); operate portal accounts and authenticate sign-in; process payment through our payment partners; respond to inquiries; and meet legal, tax, and accounting obligations. We do not use recipient data for marketing, and we do not sell personal data to third parties.
4. Who we share it with
We share the minimum data needed with:
- Courier and logistics partners — recipient name and delivery address, to fulfil delivery.
- Payment and card-issuing partners (including Airwallex) — client billing details, and where a prepaid card program is used, the data required to issue and manage that card.
- Hosting and infrastructure providers — data stored on our behalf under standard hosting agreements.
We do not use third-party advertising or analytics trackers on this website — our site loads no third-party scripts or tracking cookies.
5. Data retention
We retain client and recipient data for as long as needed to fulfil an active program, plus a reasonable period afterward for accounting, tax, and dispute-handling purposes (typically up to 7 years for financial records, in line with standard Hong Kong recordkeeping practice), after which it is deleted or anonymized.
6. Security
Account passwords are stored as salted hashes, not plain text. Portal sessions use HttpOnly, secure cookies over HTTPS. Access to client and recipient data is limited to the people who need it to deliver a program.
7. Your rights
You may ask us to access, correct, or delete personal data we hold about you, or ask what we hold and why. If you are a gift recipient and were not the one who gave us your details, you can still contact us directly — we will identify the relevant record via the client program and respond. Email hello@elpholding.com with your request; we will respond within 30 days.
8. International transfer
ELP Holding Limited is registered in Hong Kong and works with clients and delivery partners across the region; personal data may be processed in Hong Kong, Vietnam, or another jurisdiction where our service providers operate, under contractual safeguards consistent with this policy.
9. Changes to this policy
We may update this policy as our services change. The "Last updated" date at the top of this page reflects the most recent revision.
10. Contact
ELP Holding Limited · Suite C, Level 7, World Trust Tower, 50 Stanley Street, Central, Hong Kong · hello@elpholding.com