Privacy Policy
Newfound Digital Limited · Last updated 20 October 2026 · This Policy is also our Personal Information Collection Statement under the Personal Data (Privacy) Ordinance (Cap. 486).
1. Who we are
Newfound Digital Limited, Business Registration No. (BRN/UBI) 81391290, registered office Unit B, 11/F, Yam Tze Commercial Building, 23 Thomson Road, Wan Chai, Hong Kong, is the data user responsible for personal data collected through this store. Contact our Data Protection Officer at privacy@newfoundhk.com or by post at the address above.
The operator of Maps.me (identified in the Maps.me Privacy Policy) separately controls the personal data it holds about you as a Maps.me user; that policy applies to the Maps.me app and service.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email address, billing country, the Maps.me account identifier you give us (phone number, email or user ID) | You |
| Order and payment | Products bought, prices, currency, order dates, payment method type, last four digits of the card, payment-provider token and transaction ID, refund and chargeback history | You, our payment provider |
| Device and usage | IP address, device type, browser, operating system, language, pages visited, referring site, cookies (see the Cookie Policy) | Automatically |
| eSIM delivery | Device eligibility, profile and package status, activation dates | You, Maps.me |
| Support | Messages you send us and our replies | You |
| Fraud and compliance | Risk scores, sanctions-screening results, 3-D Secure outcome | Our payment provider and screening vendors |
We do not collect full card numbers or security codes; our payment provider holds those. Providing identity, contact and payment data is required to complete a purchase; without it we cannot sell to you.
3. Why we use it
- To take your order, process payment, deliver the product and bill subscription renewals.
- To provide customer support and handle refunds, disputes and chargebacks.
- To prevent fraud, meet sanctions and export rules, and comply with tax, accounting and other legal duties.
- To run, secure and improve the store, including analytics in aggregated form.
- To send you service messages: order confirmations, receipts, renewal reminders, cancellation confirmations and changes to terms.
- To send marketing emails about Maps.me products only if you opt in; you can opt out at any time free of charge using the link in any such email or by writing to us, and we will stop within 10 business days.
4. Who we share it with
| Recipient | Purpose |
|---|---|
| The operator of Maps.me (see the Maps.me Privacy Policy) | To activate Maps.me Pro, provision eSIM packages, revoke products on refund, and handle product support |
| Maps.me's eSIM platform partner and partner mobile networks (via Maps.me) | To deliver the eSIM profile and data service |
| Our payment provider and acquiring bank, card schemes and local payment schemes | To process payments, renewals, refunds and chargebacks |
| Fraud-prevention and sanctions-screening vendors | To assess transaction risk |
| Hosting, email, analytics and customer-support software providers | To run the store, under contracts that limit use to our instructions |
| Accountants, auditors, lawyers and insurers | Professional services |
| Courts, regulators, tax authorities and law enforcement | Where the law requires |
| A buyer of our business | If the business is sold, on the same terms as this Policy |
We do not sell personal data.
5. International transfers
Your data is processed in Hong Kong and transferred to the operator of Maps.me in Switzerland, to our hosting providers in [●], and to our payment provider in [●]. Where a recipient is outside Hong Kong we use contracts that require protection equivalent to this Policy and the PDPO.
6. How long we keep it
Order, payment and tax records: 7 years after the transaction, as required by Hong Kong tax and accounting law. Subscription data: for the life of the subscription plus 7 years. Support messages: 3 years. Marketing preferences: until you opt out, then a suppression record. Device and usage logs: 13 months. Fraud records: up to 5 years where needed to prevent repeat fraud.
7. Security
We use encryption in transit, access controls, logging and a payment provider certified to PCI DSS. No system is completely secure; tell us at once at privacy@newfoundhk.com if you suspect misuse of your account.
8. Your rights
Under the PDPO you may ask to access the personal data we hold about you and to correct it. We respond within 40 days and may charge a reasonable fee for access requests. You may also ask us to stop direct marketing, to delete data we no longer need, and to explain any automated fraud decision. If you live in a country whose law gives you further rights (for example to portability or objection) you may exercise them with us. You may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk) or to the data-protection authority where you live.
9. Children
The store is for adults. We do not knowingly collect personal data from anyone under 18 and will delete it if we learn we have.
10. Cookies
See our Cookie Policy.
11. Changes
We may update this Policy. Material changes will be announced on the store or by email before they take effect.