Privacy notice

Last updated: 15 November 2026

This notice explains what personal data Blooming Notes collects, why, who handles it and what your rights are. It covers this website and the messages you send to our advisers on WhatsApp, LINE or email.

Who we are

Blooming Notes is run by Blooming Notes Limited, a company based in Hong Kong. Blooming Notes Limited is responsible for the personal data described in this notice.

The advisers who reply to your messages are the Blooming Notes team. They work with us and follow this notice. They are members of one direct-selling skincare company and earn commission when you buy through them.

Address: 16A, Man Hing Commercial Building, 79-83 Queen’s Road Central, Hong Kong
Email: hello@blooming-notes.com

Hong Kong law comes first

Because we are based in Hong Kong, the main law that governs how we handle personal data is the Personal Data (Privacy) Ordinance (Cap. 486). Under it, Blooming Notes Limited is the data user responsible for your personal data. This section is our Personal Information Collection Statement under the Ordinance. Readers in the UK, the EU and Taiwan will find extra sections for their own laws further down.

Why we collect your data. We collect personal data to:

reply to your enquiry and follow up on the routine you asked about;
keep an enquiry log, so we know which notes help readers and that every enquiry gets a reply;
help you order through the company’s own channel, if you decide to buy;
run the website, keep it secure and count visits;
send you promotional messages, only if you agree (see “Direct marketing” below).

Giving us data is voluntary. You can read the whole site without giving us any personal data. If you do not give us contact details, we cannot reply to you.

Who we may pass it to. Your personal data may be transferred to:

the advisers of the Blooming Notes team;
our service providers, listed under “Who handles your data”, some of which are outside Hong Kong;
the direct-selling company, only if you decide to buy, and only what your order needs;
anyone to whom the law requires us to disclose it.

Direct marketing. Follow-up messages after your enquiry are about the routine you asked about, and you can ask your adviser to stop them at any time. Beyond that, we intend to use your name or display name, your WhatsApp number or LINE account and your email address to send you promotional messages about skincare routines, seasonal skincare habits, our free routine coaching and the skincare products the team buys for readers. We may not use your personal data in this way without your consent. Your adviser will ask you first, and you can say yes in the chat or by email, free of charge. You can withdraw your consent at any time, also free of charge, by telling your adviser or emailing hello@blooming-notes.com. We will not provide your personal data to anyone else for use in direct marketing.

Access and correction. You have the right to ask whether we hold personal data about you, to ask for a copy of it, and to ask us to correct it. We will respond within 40 days. We do not normally charge. If we ever charge for a copy, the fee will not be excessive and we will tell you before we prepare it. Correcting your data is always free. You may use the Data Access Request Form published by the Office of the Privacy Commissioner for Personal Data.

Contact for access and correction requests:

Privacy contact, Blooming Notes Limited
Email: hello@blooming-notes.com
Address: 16A, Man Hing Commercial Building, 79-83 Queen’s Road Central, Hong Kong

What we collect

If you message an adviser on WhatsApp or LINE, or email us:

whatever you choose to send, usually your name or display name, your phone number or LINE account, your email address and what you write
the reference code in the pre-filled message, which tells us which page and edition you came from

Our enquiry log. For each enquiry we record a reference code, the date, the page you came from, the adviser who replied and the outcome (for example, whether you went on to order). The log does not hold your name or number, but your adviser can link it to your chat, so we treat it as personal data.

When you visit the site. Cloudflare, which hosts the site, processes your IP address and basic technical information, such as your browser type, to deliver pages and keep the site secure. It also counts visits for us without cookies (see “Cookies and visitor statistics”).

The skin-type self-check. The self-check is scored entirely in your browser. Your answers are not sent to us or saved anywhere. If you like, you can tell your adviser your result.

What we never ask for on the site

The site never asks for photos of your skin, your health details or your medical history, and none of its forms do.

If you choose to send an adviser a photo, or tell her about a skin condition, in a chat or email, that may count as health information. With your agreement, she will use it only to answer you. She will not copy it into the enquiry log, and she will delete it if you ask.

We do not run a newsletter yet. If we start one, signing up will be your choice (opt-in), with double confirmation: nothing will arrive until you confirm by email. Before we collect any email addresses for it, we will name the email tool we use and update this notice.

Who handles your data

Our advisers, who reply to your messages. The Hong Kong and English-edition advisers reply from Hong Kong; Taiwan enquiries go to advisers who order through the company’s Taiwan channel.
Cloudflare, which hosts the website and keeps it secure, forwards email sent to hello@blooming-notes.com, and provides our cookie-free visitor statistics (Cloudflare Web Analytics).
Google: Gmail, where email forwarded from hello@blooming-notes.com is read and answered; and Google Sheets, part of Google Workspace, which holds the enquiry log.
WhatsApp (run by Meta) and LINE (run by LY Corporation), when you message us there. Each has its own terms and privacy policy, which also apply to you when you use it.
The direct-selling company, only if you decide to buy. Your adviser helps you order through the company’s own channel for the country you live in and passes on only what your order needs. The company then handles your order under its own privacy notice.
Authorities, where the law requires us to share data.

We do not sell your personal data, and we do not give it to anyone for their own marketing. We take practicable steps to protect it from unauthorised or accidental access, use, loss or deletion.

Cookies and visitor statistics

The site sets no advertising cookies. To count visits we use Cloudflare Web Analytics, which does not use cookies and does not track you across other websites. If we ever add anything that needs your consent, we will ask first and update this notice.

Transfers outside Hong Kong

Some of the people and services that handle your data are outside Hong Kong. Your data may therefore be handled in Taiwan, the United Kingdom, the United States and Japan, and in other places where our service providers run their systems.

To protect it, we use established providers and rely on contract terms that require them to keep personal data safe. You can ask us for details.

How long we keep it

Chats and emails with an adviser: deleted 12 months after your last message, unless you are still in touch with her.
Health information you shared in a chat or email: deleted sooner if you ask.
Enquiry log: 24 months from the date of the enquiry.
Website logs: kept by Cloudflare for the periods Cloudflare sets.

If we start a newsletter, we will add how long we keep subscribers’ details. We keep data longer only where the law requires it.

Your rights

You can ask us to:

tell you whether we hold personal data about you, and give you a copy
correct data that is wrong
delete your data
stop using your data for direct marketing
withdraw any consent you have given

To use any of these rights, email hello@blooming-notes.com, or write to the Privacy contact, Blooming Notes Limited, at the address under “Who we are”. We may need to check who you are before we act. In Hong Kong, we reply within 40 days. If you are in the UK, the EU or Taiwan, the reply times in your section below apply.

If you are unhappy with how we handle your data, please tell us first. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.

If you are in the UK or the EU

When we offer our pages to readers in the United Kingdom or the European Union, the UK GDPR or the EU GDPR may also apply. Under those laws, Blooming Notes Limited is the controller of your personal data.

Our lawful bases.

Legitimate interests: answering your enquiry and following it up, including keeping the enquiry log; and keeping the website running and secure, including counting visits without cookies.
Your consent: anything else, including any health information you choose to share (for which we rely on your explicit consent) and any promotional messages beyond your enquiry.
Legal obligation: where the law requires us to share data.

Your rights. You have the right to:

access your personal data
have it corrected
have it deleted
object to how we use it, including an absolute right to object to direct marketing
restrict how we use it
receive data you gave us in a portable format, where the law gives this right
withdraw your consent at any time, without affecting anything we did before

We reply within one month. If a request is complex, the law allows us up to two more months; if we need them, we will tell you within the first month.

You have the right to complain to the Information Commissioner’s Office (ICO) in the UK, or to the data protection authority in the EU country where you live. We would welcome the chance to sort things out with you first, but you do not have to.

Your data comes to us in Hong Kong. “Transfers outside Hong Kong” explains how we protect it.

If you are in Taiwan

For readers in Taiwan, these are the items required by Article 8 of Taiwan’s Personal Data Protection Act (個人資料保護法).

1. Who collects your data. Blooming Notes Limited, a company based in Hong Kong, and the advisers of the Blooming Notes team who reply to Taiwan enquiries.

2. Purposes.

replying to your enquiry and following up on your routine (customer service)
keeping an enquiry log to understand which notes help readers (statistics and analysis)
helping you order through the company’s Taiwan channel, if you decide to buy
sending you promotional messages, only with your consent (marketing)
running the website and keeping it secure

3. Categories of personal data.

what you choose to send on LINE, WhatsApp or by email, such as your name or display name, your LINE account, phone number or email address, your messages and any photos
any health information you choose to share in a chat or email
enquiry log entries: reference code, date, page, adviser and outcome
basic technical data when you visit the site, such as your IP address

4. Period, area, recipients and methods of use.

Period: for as long as each purpose lasts, then for the periods under “How long we keep it”, or longer where the law requires.
Area: Taiwan, Hong Kong, and the places where our service providers process data, including the United Kingdom, the United States and Japan.
Recipients: the advisers of the Blooming Notes team; our service providers (Cloudflare, Google, LINE (LY Corporation) and WhatsApp (Meta)); the direct-selling company, only if you decide to buy; and authorities where the law requires.
Methods: electronically, by email, LINE and WhatsApp messages and online spreadsheets.

5. Your rights under Article 3, and how to use them. You may ask us to:

answer your enquiry about your data, or let you review it (查詢或請求閱覽)
give you a copy (請求製給複製本)
supplement or correct it (請求補充或更正)
stop collecting, processing or using it (請求停止蒐集、處理或利用)
delete it (請求刪除)

To use these rights, email hello@blooming-notes.com. Under Article 13 of the Act:

For a request to inquire, review or copy, we will give you our decision within 15 days. If we need longer, we may extend this by up to 15 days and will tell you the reason in writing.
For a request to supplement, correct, stop or delete, we will give you our decision within 30 days. If we need longer, we may extend this by up to 30 days and will tell you the reason in writing.

We do not normally charge. If providing a copy involves necessary costs, we will tell you before charging them. These rights cannot be waived in advance or limited by agreement.

You may also ask us at any time to stop using your data for marketing, and we will stop. The first time we send you marketing, we will tell you how to refuse it, at our cost.

6. If you do not provide personal data. Providing personal data is your choice, and you can read the whole site without it. Without contact details we cannot reply to you or follow up on your routine.

Children

This site is not aimed at children under 16, and we do not knowingly collect their data. If you think a child has given us personal data, email us and we will delete it.

Changes to this notice

If we change this notice, we will update the date at the top. Where appropriate, we will also tell people affected by a change, for example in a chat or by email.