Privacy Policy

Who we are and what this policy covers

The Cave Barbershop ("The Cave", "we", "us" or "our") operates cavebarber.net and provides barbering, booking, recruitment, and related services. This policy explains how we collect, use, disclose, retain, and protect personal data in connection with the website, our services, communications, advertising, and recruitment.

For the purposes of the Hong Kong Personal Data (Privacy) Ordinance, we are the data user for personal data that we control. Other providers may separately control personal data they collect through their own services.

Personal data we may collect

We may collect information you provide, including your name, phone number, email address, appointment details, service preferences, correspondence, feedback, transaction records, and any information needed to answer a request or provide a service. Payments may be processed by third-party providers, and we do not normally receive or store full payment card details.

If you apply to work with us, we may collect contact details, availability, work history, qualifications, social profiles, portfolio materials, application answers, interview notes, references, and other information you choose to provide. Recruitment information is used only for recruitment and related business records unless we tell you otherwise.

When you use the website, we and our providers may automatically receive technical and usage information, including your internet protocol address, browser and device type, operating system, approximate location, referring page or campaign, pages viewed, links and buttons used, dates and times, advertising and cookie identifiers, and diagnostic or security information.

We may also receive information from booking, payment, recruitment, analytics, advertising, social media, and communication providers where permitted by their terms and applicable law. You may choose not to provide personal data, but we may then be unable to process a booking, application, request, or service that requires it.

How we use personal data

We may use personal data to provide, confirm, change, and manage appointments and services; process transactions; communicate with you; respond to enquiries; review applications; administer our business; operate, secure, measure, troubleshoot, and improve the website; understand campaign and website performance; personalise and measure advertising; prevent misuse or fraud; comply with legal obligations; enforce our terms; and establish, exercise, or defend legal claims.

Depending on the circumstances and applicable law, we rely on consent, performance of a contract, compliance with legal obligations, and our legitimate interests in operating, securing, promoting, and improving the business. Under Hong Kong law, we may also use personal data for a purpose directly related to the purpose for which it was collected. We will seek consent where required for a new use, advertising technology, or direct marketing.

Meta Pixel and advertising measurement

We use the Meta Pixel, formerly called the Facebook Pixel, through our tag-management setup. The Pixel and related Meta Business Tools may use cookies, pixels, and similar identifiers to record visits and actions on the website. Event data may include the page address, referring page, campaign information, time of visit, actions taken, browser and device information, internet protocol address, and Meta or advertising identifiers.

We use this information to measure advertising results, attribute visits or actions to campaigns, understand audiences, improve campaigns, create advertising audiences, and show or limit relevant advertising on Meta services. Meta may match event data with information it already holds about a person, including whether or not that person is logged in to a Meta account, and processes that information under its own terms and privacy policy.

We do not intentionally configure analytics or advertising tags to receive payment card details, health information, application answers, or the contents of booking and recruitment forms. If enhanced or advanced matching is enabled, contact identifiers may be transformed, such as by hashing, before being sent to Meta for matching. A transformed identifier may still be personal data.

You can learn more in the Meta Privacy Policy and manage advertising choices through your Meta account settings where available.

Cookies, local storage, and analytics

We use cookies, local or session storage, tags, pixels, and similar technologies to operate the site, remember temporary display states, secure services, distinguish visits and sessions, understand how the site is found and used, measure advertising, and improve performance. Some technologies are set by providers such as Meta and Google and may allow those providers to recognise a browser or device across websites and services.

Google services may receive technical, usage, advertising, and approximate location information. You can learn more about how Google uses information from sites that use its services.

You can block or delete cookies through your browser or device settings and can use provider advertising controls where available. Blocking technologies may reduce measurement accuracy and may cause parts of the website or embedded services to work differently. Where applicable law requires a choice before non-essential technologies are used, we will provide or honour that choice as required.

When we disclose personal data

We may disclose personal data to providers that support website hosting, security, tag management, analytics, advertising, bookings, payments, communications, recruitment, storage, and professional advice. These providers may include Meta, Google, Cloudflare, Timely, Airtable, payment providers, and other contractors engaged for legitimate business purposes.

We may also disclose information to authorities, insurers, advisers, counterparties, or other parties where reasonably necessary to comply with law or legal process, investigate misuse, prevent harm, protect rights or safety, recover money owed, enforce agreements, or support a reorganisation, financing, transfer, or sale of all or part of the business.

We do not sell personal data for money. Some laws may define certain advertising disclosures as a sale, sharing, or targeted advertising. Where such laws apply, we will provide the rights and choices they require.

International processing

Some providers and their systems are located outside Hong Kong. Personal data may therefore be processed in places with different privacy laws. Where reasonably appropriate, we take steps to select providers and use contractual or other safeguards, but we cannot control the laws, systems, or independent practices of third parties.

Retention and security

We retain personal data only for as long as reasonably necessary for the purposes in this policy, including providing services, assessing applications, maintaining business and transaction records, meeting legal or regulatory requirements, resolving disputes, and protecting or enforcing our rights. Periods vary according to the information, relationship, provider settings, and reason it is held. We may delete or anonymise information when it is no longer reasonably required.

We use reasonable administrative, technical, and physical safeguards appropriate to the information we control, and we limit access according to business need where reasonably practicable. No website, transmission, provider, or storage system is completely secure. We cannot guarantee absolute security or that an unauthorised person will never defeat safeguards.

Your rights and choices

You may contact us to ask whether we hold your personal data or to request access to or correction of it under Hong Kong law. Depending on where you live, you may also have rights to request deletion, restriction, portability, objection, withdrawal of consent, or information about advertising disclosures.

We may need to verify your identity or authority before acting. We may retain information, redact third-party information, charge a fee permitted by law, or decline a request where permitted or required. A request to us does not automatically control information held independently by Meta, Google, Timely, Airtable, or another provider, and you may need to use that provider's controls.

You can ask us to stop using your personal data for direct marketing at any time. We will not charge you for an opt-out request. Browser cookie controls and advertising preferences may need to be set separately on each browser, device, or provider account.

Children

The website is not directed to children, and we do not knowingly collect personal data online from a child who cannot lawfully provide it without appropriate consent. A parent or guardian should make bookings and provide information for a child where required. Contact us if you believe a child has provided personal data improperly.

Third-party sites and services

The website may link to or display services operated by other parties, including booking, payment, map, social media, music, and media services. A provider may collect information directly when its content loads or when you interact with it. We do not control independent providers, and their own notices, settings, and terms apply.

Changes to this policy

We may update this policy to reflect changes in our business, technology, providers, advertising practices, or legal obligations. The current version will be posted here with an updated date. Where required, we will provide additional notice or seek consent for a materially different use.

Contact

Privacy requests may be sent to The Cave Barbershop, Unit 01, 1/F, Hing Tai Commercial Building, 114 Wing Lok Street, Sheung Wan, Hong Kong. Phone 5540 0921. Please describe your request clearly and provide enough information for us to identify the relevant records.