Privacy policy
Privacy policy
This policy explains what personal information Hengate collects, why, and what happens to it. Hengate is operated by Cankaya Limited, Hong Kong Business Registration Number 81047130, registered office Flat 5, 4/F, Won Hing Building, 74–78 Stanley Street, Central, Hong Kong.
Because we offer goods to individuals in Australia, we treat ourselves as bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we handle your information accordingly.
What we collect
| When you place an order | Name, delivery address, email address, and the phone number the carrier needs for delivery. Payment is processed by Shopify — we receive confirmation that payment succeeded and the last four digits of the card, never the full card number. |
|---|---|
| When you contact us | Your name, email address and whatever you choose to tell us in your message. |
| When you browse | IP address, device and browser type, pages viewed, and the source that brought you here. Collected through cookies and similar technology. |
We do not collect sensitive information as defined in the Privacy Act, and we do not ask for it. Please do not send us health, biometric, political or similar information.
Why we collect it
- To fulfil your order — take payment, ship the goods, keep you updated, handle returns and warranty claims. Without this information we cannot sell to you.
- To meet our legal obligations — accounting and tax records, and responding to lawful requests.
- To improve the store and measure advertising — understanding which pages work and which advertisements lead to orders.
Who we share it with
- Shopify Inc. — the platform this store runs on, and our payment processor. Data is held on Shopify's infrastructure.
- Our supply partner and the carriers — your name, delivery address and phone number are passed to the warehouse that packs your order and to the carriers that move it, because there is no other way to get the parcel to you.
- Google — where you have consented to analytics and advertising cookies, measurement data is shared with Google Analytics and Google Ads. This does not include your name or address.
We do not sell your personal information. We do not share it with data brokers. We do not send you marketing email unless you have asked us to, and every marketing email carries a one-click unsubscribe.
Your information leaves Australia
We are open about this. Fulfilling your order requires disclosing your name and delivery address to our supply partner in the People's Republic of China, and the company that runs this store is established in Hong Kong SAR. Shopify's infrastructure is located in the United States and other countries.
Before disclosing your information overseas we take steps that are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles, in line with APP 8. By placing an order you understand that these overseas disclosures are necessary for us to deliver to you.
Cookies
Strictly necessary cookies — the ones that keep your cart working and the checkout secure — are always active, because the store cannot function without them. We also use analytics and advertising cookies to measure how the store performs and which advertisements lead to orders. Australia does not require a cookie consent banner and we do not display one, so we do not ask you to accept or decline cookies. You can block or delete cookies at any time in your browser settings, and you can turn off personalised Google advertising in your Google account settings. Blocking strictly necessary cookies will stop the cart and the checkout from working.
How long we keep it
Order and transaction records are kept for seven years, which is what accounting and tax rules require of us. Contact correspondence is kept for two years after the matter is closed. Analytics data is retained according to the settings of the analytics provider, and no longer than 26 months. After that, records are deleted or irreversibly anonymised.
Your rights
You may ask us to:
- tell you what personal information we hold about you, and give you access to it;
- correct anything that is inaccurate, out of date, incomplete or misleading;
- delete information we no longer need to keep;
- stop sending you marketing.
Email contact@hengate.com. We respond within 30 days. We do not charge for access requests. If we refuse access or correction, we will tell you why in writing.
Security
The site runs over HTTPS. Payment card data is handled by Shopify's PCI-DSS compliant systems and never touches our own records. Access to order data is limited to the people who need it to run the store.
If you are unhappy with how we handled your information
Tell us first, at contact@hengate.com, and we will investigate. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au), which can investigate the handling of personal information by businesses that offer goods to individuals in Australia.
Changes
If we change this policy we will update the date below. Material changes will be brought to your attention on the site.
Last updated: 27 August 2026.