Your privacy.

Who is responsible

Smart Towel is a brand of One World Organics Limited, a company registered in Hong Kong, business registration number 80086795, at Flat 5, 4/F, Won Hing Building, 74-78 Stanley Street, Central, Hong Kong.

We are the data controller for everything described here. For anything on this page, write to sales@smarttowel.shop.

What we collect, and the reason we are allowed to

When you order

• Your name, email address, phone number and delivery address. We need them to take the order, send it, and contact you about it. The courier uses your phone number only to arrange delivery. Our lawful basis is performance of a contract with you. Without them we cannot deliver.
• What you bought, when, and what you paid. Kept for your receipt, for returns, and because we are required to keep business records. Lawful basis: contract and legal obligation.
• Your card details never reach us. You enter them on Airwallex's own secure page. We never see them, never receive them and never store them. We are told only that a payment succeeded, for how much.

When you ask to hear from us

If you give us your email to join our mailing list (news, shipping dates and offers), or to join the affiliate waitlist, we store that email address and nothing else. Lawful basis: your consent. Every email we send has an unsubscribe link, and one click removes you for good. You can withdraw consent at any time without giving a reason, and withdrawing it does not affect anything we did before you withdrew it.

When you write to us

Messages from the contact and wholesale forms are emailed to our inbox so a person can read and answer them. We do not add you to any mailing list because you wrote to us. Lawful basis: our legitimate interest in answering people who contact our business.

While you are simply browsing

Our host keeps standard server logs, which include your IP address, the page requested and your browser's user agent. We also hold an IP address briefly in memory to stop one person flooding our forms; it is discarded within minutes and never written to disk. Lawful basis: our legitimate interest in keeping the site up and not being abused. Some privacy laws treat an IP address as personal information, which is why we mention it here.

Cookies and what sits in your browser

Nothing tracks you unless you say yes. When you first visit, a bar asks whether we may use cookies. Until you press Accept, nothing is loaded from Google or Meta and no tracking cookie is set.

If you press Accept, we load Google Analytics, which sets cookies starting _ga so we can count visits and see which pages people find useful. It is set up for counting only: Google signals and ad personalisation are switched off. Lawful basis: your consent.

Accepting also loads the Meta pixel, which tells that company which pages you visit here, so we can measure whether our ads work. It sets its own cookies. Lawful basis: your consent.

You can change your answer at any time with the cookie settings link here or in the footer of every page. Saying no removes those cookies. Your answer is kept in your browser under the name ga-consent.

Your basket is stored in your browser too, under the name smarttowel_cart. It stays on your own device so your basket is still there when you come back. It never reaches us, and clearing your browser data removes it.

If you arrive through one of our affiliates' links, we also store that affiliate's code, under the name smarttowel_aff, for 45 days, so the affiliate is paid if you buy. It identifies the affiliate, not you, and it is sent to us only when you check out.

The companies that see any of it

These are every outside company involved, what they get, and why. We name them individually rather than describing them as categories, because that is what you would want to know.

• Vercel (United States) hosts this website. Server logs, including your IP address, pass through them. When you check out, apply a discount code or send a form, Vercel also runs an invisible check in your browser to tell people from automated bots; it reads technical signals from your browser for that purpose only.
• Google (United States) runs Google Analytics. Only if you press Accept, it receives the pages you visit, your IP address and technical details of your browser, and keeps the results for no more than 14 months.
• Meta runs the advertising pixel described above. Only if you press Accept, it receives the pages you visit here, your IP address and technical details of your browser.
• Airwallex (Hong Kong, Singapore and the United Kingdom) takes payments. Their payment script loads only when you press Proceed to Checkout, so they see your IP address only if you start a purchase. They handle your card details and we do not.
• Resend (United States) sends our email and holds the mailing list. They hold your email address if you signed up, the content of any message you send us through a form, and, when you order, your order confirmation, which includes your name, delivery address and what you bought.
• Partnero (United States, with data stored in Germany) runs our affiliate program. When you order, we send them your name, email address and the value of the towels you bought, so they can pay commission to any affiliate who referred you, now or on a later order. When you arrive through an affiliate's link, they also receive the address of the page you landed on.
• Our fulfilment partner and the couriers receive your name, delivery address, phone number and email address when you order, so that your parcel can be packed and delivered and you can be told when it ships. They get nothing else and may not use it for anything else.

Apart from Meta, which applies their own terms to pixel data, nobody on that list is allowed to use your information for their own marketing, and none of them pays us for it.

Information leaving Hong Kong

We are a Hong Kong company and the companies above are in the United States, Germany, Singapore, the United Kingdom and mainland China. If you are in the United Kingdom or the European Economic Area, that means your information leaves your country. Where it does, we rely on the standard contractual clauses in our agreements with those companies, and on their own published transfer safeguards. Ask us and we will tell you which applies to a particular company.

How long we keep it

• Order records: seven years from the end of the financial year of the order, because Hong Kong's Inland Revenue Ordinance requires business records to be kept that long.
• Mailing list: until you unsubscribe, and we delete the record within 30 days of you doing so.
• Messages sent through our forms: two years from your last contact with us, so we have the history if you come back to the same question.
• Server logs: 30 days, which is our host's retention period.
• The rate-limiting record of your IP: minutes, held in memory only and never written to disk.

What you can ask us to do

Wherever you live, you can ask us to:

• Show you everything we hold about you, and tell you where it came from.
• Correct anything that is wrong.
• Delete it, where the law does not require us to keep it. Order records are the usual exception.
• Stop or limit what we are doing with it, including objecting to anything we do on the basis of legitimate interest.
• Hand it over to you, or to another company, in a machine readable file.
• Withdraw your consent to marketing, at any time.

Email sales@smarttowel.shop from the address you gave us and we will answer within 30 days. We will never charge you for asking, and we will never make the site worse for you because you did.

If you think we have handled your information badly, you are entitled to complain to a regulator as well as to us: the Privacy Commissioner for Personal Data in Hong Kong, the Information Commissioner's Office in the United Kingdom, or your national data protection authority in the European Economic Area.

Selling, sharing and artificial intelligence

We do not sell your personal information and never have. If you press Accept on the cookie bar, the Meta pixel described above may count as "sharing" for advertising under some US state laws; say no and nothing is shared. We do not use it to train large language models or any other artificial intelligence system, and we do not pass it to anyone who does. If that ever changes we will say so here before it happens, and where consent is required we will ask for it first.

Children

This shop is not aimed at children and we do not knowingly collect anything from anyone under 16. If you believe a child has given us their details, tell us and we will delete them.

If something goes wrong

If information we hold is lost or exposed in a way likely to harm you, we will tell you and the relevant regulator without undue delay, and tell you plainly what happened and what to do about it.

Changes to this page

If we change how any of this works we will update this page and change the date below. Anything that materially affects you, we will email you about if we have your address.

Last updated 27 October 2026.