Privacy Policy

Ronda Plus Trading Limited (company number 80115693), of Unit 18, 8/F, Peter Leung Industrial Building, 103 Wai Yip Street, Kwun Tong, Kowloon, Hong Kong SAR, is the data user responsible for personal data collected through RondaShip.

Where a shipment is handled in mainland China, shipment and document data is also processed by our affiliate 佛山宏泰荣达国际物流有限公司 (Foshan Hongtai Rongda International Logistics Co., Ltd.), unified social credit code 91440605MAE5TCDN99, which carries out international freight forwarding, customs declaration, and warehousing on our behalf. It acts on our instructions and under the same obligations set out in this policy.

We handle personal data in line with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486).

Account information — name, business name, email address, phone number, role, and the approval status of your account.

Shipment and product information — product descriptions, HS codes, quantities, weights, dimensions, supplier names, origin and destination addresses, and shipment status history.

Documents — commercial invoices, packing lists, bills of lading, certificates and other trade documents you upload, along with data extracted from them.

Warehouse records — photographs of goods received, barcode scans, and recorded measurements.

Payment information — invoice records and payment status. Card details are entered directly with Stripe and are never received or stored by us.

Technical information — sign-in events, IP address, and audit records of actions taken in the platform.

• To create and verify your account, and to authenticate you at sign-in
• To arrange, track and document shipments
• To prepare customs and trade documentation
• To issue invoices and collect payment
• To send operational notifications about your shipments, documents and invoices
• To maintain an audit trail, meet legal and customs record-keeping duties, and prevent fraud
• To diagnose faults and improve the service

We do not sell personal data, and we do not use your shipment or document data to build advertising profiles.

To reduce manual data entry, documents you upload and product names you enter may be processed by a third-party AI service to extract fields, suggest customs descriptions and propose HS codes.

This processing is used to produce a draft for a human to review. No decision affecting you is made solely by automated means — an administrator reviews and confirms extracted customs data before it is used. Data sent for this purpose is not used by the provider to train their models.

We share personal data only where it is needed to deliver the service:

• Carriers, agents and warehouses — shipment and contact details needed to move and receive the goods
• Customs authorities and brokers — declarations and supporting documents required for clearance
• Stripe — payment processing. Stripe acts as its own controller for payment data under its privacy policy
• Supabase — database, authentication and encrypted file storage
• Vercel — application hosting
• Resend — transactional email such as verification codes and invoice notices
• Meta (WhatsApp Business) — where you have opted in to WhatsApp notifications
• Anthropic — AI processing described in clause 4
• Professional advisers and authorities — where we are required by law

International freight forwarding necessarily involves cross-border data transfer. Our service providers operate in jurisdictions including the European Union, the United States and Singapore. Where data is transferred outside Hong Kong we take reasonable steps to ensure it is protected to a standard comparable to that required under the Personal Data (Privacy) Ordinance.

We keep account and shipment records for as long as your account is active, and afterwards for as long as needed to meet legal, tax, customs and accounting obligations. Trade documents and customs records are typically retained for seven years. Audit logs are retained to support fraud investigation and dispute resolution. Data no longer needed is deleted or anonymised.

• All traffic is encrypted in transit using TLS
• Documents are held in private storage, reachable only through short-lived signed links
• Database access is restricted per account by row-level security policies
• Sign-in is passwordless, using one-time codes rather than stored passwords
• Administrative actions are recorded in an audit log

No system is completely secure. If a breach affects your personal data and creates a real risk of harm, we will notify you and the relevant authority.

Under the Personal Data (Privacy) Ordinance you may:

• Ask whether we hold personal data about you, and request a copy
• Ask us to correct data that is inaccurate
• Ask us to delete data we no longer have a lawful reason to keep
• Withdraw consent to WhatsApp or email notifications at any time in your settings

Send requests to support@rondaship.com. We may need to verify your identity first, and will respond within 40 days as the Ordinance requires. Some data must be retained despite a deletion request where customs or accounting law obliges us to keep it.

We use only the cookies needed to run the service — keeping you signed in and preserving your session. We do not use advertising or third-party tracking cookies. Blocking essential cookies will prevent sign-in from working.

We may update this policy as the service changes. The current version is always published here, with the date shown above. Material changes will be notified through the platform.