PRIVACY POLICY STATEMENT

This Privacy Policy Statement is issued by Whiskey Live Macau as data controller in compliance with the Macau Personal Data Protection Act (Law 8/2005) and applies to personal data processed through the online merchandise platform and related services.

Controller and contacts

Controller: Whiskey Live Macau, email: marketing@whiskylivehkmacau.comData Protection Office (GPDP) complaints: Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau; Tel: +853 2871 6006; Fax: +853 2871 6116.

Statement of practices

Processing is carried out transparently with respect for privacy and fundamental rights, and personal data are collected for specified, explicit, legitimate purposes, kept no longer than necessary, and processed with appropriate accuracy, proportionality, and security (Articles 2 and 5).

Personal data collected

• Identity data: name and identity document number (e.g., passport/Macau ID).
• Contact data: email, mobile number, correspondence address.
• Transaction data: purchase history, order details, payment references (payment card data handled by processors).
• Technical data: IP address, browser/device information, cookies/analytics identifiers.
• Communications: inquiries and support correspondence.

Collection methods and whether data are obligatory

Personal data are collected via account registration, purchases, customer support, site usage and cookies, and marketing preference tools, and certain items are obligatory to fulfil orders or comply with law; failure to provide required data may prevent order processing and related services (Article 10(1)(3)(ii)).

Purposes and legal bases

Data are processed to fulfil orders and provide services, verify identity for collection, provide customer support, prevent fraud and ensure security, comply with legal obligations, enforce terms, and conduct direct marketing where permitted, relying on Article 6 bases including contract performance, legal obligations, legitimate interests, vital interests, public interest or unambiguous consent where applicable.

Direct marketing

Subject to prior informed indication and applicable consent practices, personal data may be used for merchandise, event products, and promotional offers, with a free right to object at any time and to be informed before first disclosure to third parties for their marketing (Article 12(2)).

Opt‑out via account preferences, unsubscribe links, or marketing@whiskylivehkmacau.com at no charge, and no direct marketing occurs without meeting PDPA information requirements for informed consent and objections.

Disclosure to recipients

Categories include service providers acting under contract as processors, event partners/venues for order collection, payment processors, professional advisers, law enforcement when legally required, and business successors, limited to purposes stated and with processor obligations per Articles 15–17.

Cross‑border transfers

Data may be transferred outside Macau for cloud hosting, global fulfilment, and group operations; international transfers comply with Article 19 adequacy rules and, where a destination does not ensure adequate protection, proceed only with notification under Article 20(1) and either unambiguous consent, a listed derogation, or prior authorisation by GPDP with adequate safeguards (e.g., contractual clauses) under Article 20(2).

Where required by law, transfers will be notified to or authorised by GPDP before execution, and data subjects will be informed of recipients/categories and transfer contexts (Articles 10, 19–20).

Retention

Data are retained no longer than necessary for stated purposes and legal requirements, including order/accounting records for up to seven years, marketing data until objection/withdrawal, account data until closure plus a limited period, and technical logs for a limited period aligned to security and operations (Article 5(1)(5)).

Security

Appropriate technical and organisational measures protect against unlawful or unauthorised access, loss, alteration, or disclosure, with encryption, access controls, assessments, and staff training; processor contracts require processing only on controller instructions and PDPA‑level safeguards (Articles 15–17).

Sensitive data

Sensitive data are not routinely collected, and where necessary will only be processed under Article 7 conditions (e.g., explicit consent, legal authorisation, vital interests) with special security measures and, where applicable, notification/authorisation.

Data subject rights and how to exercise

Cookies and open networks

Cookies and similar technologies are used as described in the Cookies Policy, and despite safeguards, data sent over open networks may be at risk of unauthorised access as required to be disclosed by Article 10(4).

Notifications and prior checks

Processing subject to Article 21 notification will be notified to GPDP within eight days after initiation of automatic processing, and activities requiring prior authorisation (e.g., certain sensitive‑data uses, credit/solvency processing, new incompatible purposes, combinations) will undergo prior checking under Article 22.

Updates

This Statement may be updated, and material changes will be announced through the website or direct communications in accordance with transparency obligations.

Language

In the event of discrepancies between language versions, the English version will prevail for interpretation of this Statement; corresponding Traditional and Simplified Chinese versions should be aligned to the same PDPA provisions.

Governing law

This Statement is governed by the laws of the Macao Special Administrative Region.