Privacy Policy

Protolyn Limited · Effective date: 25 August 2026

1. Who we are

Protolyn Limited ("Protolyn", "we", "us", "our") is a company incorporated in the Hong Kong Special Administrative Region with its registered office at No.1 Glenealy, Central, Hong Kong. We design, manufacture and sell consumer hardware products under our own brands.

This Privacy Policy explains how we collect, use, disclose and protect personal data when you visit www.protolyn.com (the "Site"), contact us, or otherwise deal with Protolyn Limited. It also serves as our Personal Information Collection Statement under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO").

Our product brands sell through their own online stores (for example, firstflip.shop). Each store publishes its own privacy policy, which governs purchases and accounts on that store. This Policy covers the Site and your direct dealings with Protolyn Limited.

For the purposes of the PDPO, the EU General Data Protection Regulation ("GDPR") and the UK GDPR, Protolyn Limited is the data user and data controller of the personal data described in this Policy.

2. Personal data we collect

Information you give us

• Contact details — your name, email address, phone number, company and role — when you contact us, request information, apply for a job or internship, or propose a supplier, manufacturing, creator, partnership or investment relationship.
• The content of your messages and any files you send us.
• Your email address and communication preferences if you sign up to receive updates from us.

Information collected automatically

• Technical data: IP address, browser type and version, operating system, device identifiers, language and time-zone settings.
• Usage data: pages viewed, the website that referred you, and the date and time of your visit.

This information is collected through standard server logs kept by our hosting provider. The Site does not currently use cookies. See Section 6.

Information from other sources

• Business contact information from professional networks (such as LinkedIn), business partners, or publicly available sources, where we have a legitimate business reason to contact you.
• Information from our service providers, such as email delivery providers.

We do not intentionally collect sensitive personal data (such as health, biometric or financial account information) through the Site. Please do not send us such data unless we ask for it.

Providing personal data to us is voluntary. If you choose not to provide the data we need, we may be unable to respond to your enquiry or provide what you have requested.

3. How we use personal data

We use personal data for the following purposes. Where the GDPR or UK GDPR applies, the legal basis we rely on is shown for each purpose.

• Responding to you. Answering enquiries, providing information you request, and following up on your messages. Legal basis: legitimate interests; steps taken at your request before entering into a contract.
• Managing business relationships. Communicating with suppliers, manufacturers, creators, partners, advisers and investors, and administering agreements with them. Legal basis: performance of a contract; legitimate interests.
• Recruitment. Assessing applications for roles with us. Legal basis: steps taken at your request before entering into a contract; legitimate interests; legal obligation.
• Sending updates. Sending news, product announcements and other marketing communications, where you have agreed to receive them. Legal basis: consent.
• Operating, securing and improving the Site. Troubleshooting, testing, security monitoring, fraud prevention and understanding how the Site is used. Legal basis: legitimate interests.
• Legal and regulatory compliance. Keeping records required by law, responding to lawful requests from authorities, and meeting the verification, anti-money-laundering, sanctions and tax requirements imposed on us or on the banks and payment providers we work with. Legal basis: legal obligation; legitimate interests.
• Protecting our rights. Enforcing our terms, detecting and preventing misuse, and establishing, exercising or defending legal claims. Legal basis: legitimate interests.
• Corporate transactions. Evaluating or carrying out a financing, merger, acquisition, reorganisation or sale of assets. Legal basis: legitimate interests.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may ask us for more information about that assessment using the contact details in Section 14.

4. Direct marketing

We will only use your name and contact details to send you marketing about our products, brands and activities if you have consented, or, where the law allows, if you have not objected after being told of our intention to do so. You can opt out at any time, free of charge, by using the unsubscribe link in any marketing email or by contacting us. We will not provide your personal data to any third party for that third party's direct marketing without your written consent.

5. How we share personal data

We share personal data only as described below, and we require every recipient to protect it appropriately.

• Service providers acting on our instructions, including providers of website hosting and form processing (currently Netlify, Inc., based in the United States), cloud storage, email and communications, customer relationship management, IT support and security.
• Our brands and affiliates, meaning entities under common ownership or control with Protolyn Limited that operate our product brands, for the purposes described in this Policy.
• Professional advisers, including lawyers, accountants, auditors, bankers and insurers.
• Financial institutions and payment providers, where they require information about our business relationships to satisfy their own legal and regulatory obligations.
• Authorities, regulators and courts, where disclosure is required by law, regulation or legal process, or is necessary to protect the rights, property or safety of Protolyn Limited, our users or others.
• Parties to a corporate transaction, such as prospective or actual buyers, investors or successors, subject to confidentiality protections.

We do not sell personal data, and we do not share personal data with third parties for their own marketing purposes.

6. Cookies and similar technologies

The Site does not currently set cookies, and we do not use analytics, advertising or tracking technologies on the Site. Our hosting provider keeps standard server logs (including IP addresses) for security and operational purposes, as described in Section 2.

If we introduce cookies or analytics in the future, we will update this Policy and, where the law requires it, ask for your consent before setting non-essential cookies. Where required by applicable law, we honour opt-out preference signals such as Global Privacy Control.

7. International transfers

We are based in Hong Kong. The service providers we use may process personal data in other countries, including the United States and countries in the European Economic Area, and personal data may be accessed by our team while travelling or working outside Hong Kong.

When we transfer personal data out of the EEA or the United Kingdom, we rely on an adequacy decision, standard contractual clauses approved by the European Commission or the UK Information Commissioner, or another lawful transfer mechanism. For personal data collected in Hong Kong, we take steps consistent with the PDPO and the guidance of the Privacy Commissioner for Personal Data, including contractual protections with recipients. You may contact us for more information about the safeguards we use.

8. How long we keep personal data

We keep personal data only for as long as needed for the purposes described in this Policy, and then delete or anonymise it. In general:

• enquiries and correspondence are kept for up to 24 months after our last contact with you;
• recruitment records are kept for up to 12 months after the recruitment process ends, unless you join us;
• marketing data is kept until you unsubscribe or until we have had no engagement from you for a reasonable period;
• records required for legal, tax, accounting or regulatory purposes are kept for the period required by law, which in Hong Kong is generally seven years.

We may keep data for longer where necessary to establish, exercise or defend legal claims.

9. Security

We use technical and organisational measures appropriate to the nature of the data to protect personal data against unauthorised access, loss, misuse or alteration, including encrypted connections (HTTPS), access controls and limiting access to staff and providers who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we will notify you and any relevant regulator of a breach where the law requires us to do so.

10. Your rights

If you are in Hong Kong. Under the PDPO you have the right to request access to the personal data we hold about you and to request that we correct it if it is inaccurate. We will respond to a data access or data correction request within 40 days of receiving it. We may charge a reasonable fee to process a data access request. You also have the right to opt out of direct marketing at any time.

If you are in the European Economic Area or the United Kingdom. Under the GDPR or UK GDPR, you have the right to: request access to your personal data; have inaccurate data corrected; have your data erased in certain circumstances; restrict our processing in certain circumstances; receive your data in a portable format; object to processing based on legitimate interests, and to direct marketing at any time; withdraw consent at any time where consent is the legal basis, without affecting processing carried out before withdrawal; and lodge a complaint with a supervisory authority, including the data protection authority in your country of residence or the UK Information Commissioner's Office. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

If you are in the United States. Depending on the state in which you live, you may have rights to know what personal data we collect and how we use it, to access and correct it, to delete it, to opt out of the sale or sharing of personal data or its use for targeted advertising, and not to be discriminated against for exercising your rights. We do not sell personal data or share it for cross-context behavioural advertising.

If you are elsewhere. You may have similar rights under the law of your country. Contact us and we will respond in accordance with the law that applies to you.

How to exercise your rights. Email us at marios@protolyn.com or write to the address in Section 14. We may need to verify your identity before acting on a request, and we may decline requests that are unfounded, excessive or not permitted by law, in which case we will explain why. If you use an authorised agent, we may ask for evidence of their authority.

11. Children

The Site is not directed at children under 18, and we do not knowingly collect personal data from them through the Site. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Third-party websites

The Site contains links to other websites, including our brand stores, retailers and social media platforms. Those sites have their own privacy practices, which we do not control and for which we are not responsible. Please review their policies before providing any personal data.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on the Site with a new effective date and, where the change is material and the law requires it, notify you by other means. Please check this page periodically.

14. Contact us

If you have questions about this Policy or how we handle personal data, or wish to exercise your rights, contact us at:

Protolyn Limited
No.1 Glenealy, Central, Hong Kong
Email: marios@protolyn.com
Attention: Data Protection

You may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk) if you have concerns about our handling of personal data.