Privacy Policy

1. Scope and controller

This Privacy Policy applies to:

• the corporate website dikurooms.com (including all sub-pages such as /services.html, /culture.html, /news.html, /contact.html); and
• the mobile applications published by DIKUROOMS Trading Co., Limited on the Google Play Store and the Apple App Store.

The data controller responsible for the processing of your personal data under this Policy is:

DIKUROOMS Trading Co., Limited
Rm F(B22) 2/F FREDER CTR 3 MOK CHEONG ST
To Kwa Wan, Kowloon, Hong Kong SAR
Email: support@dikurooms.com

If you are in the European Economic Area (EEA), the United Kingdom (UK) or Switzerland, this entity is also your controller under the General Data Protection Regulation (GDPR) and the UK GDPR. Where local law requires, we additionally rely on locally appointed representatives — please contact us for details.

2. Definitions

For the purposes of this Policy:

• Personal data means any information relating to an identified or identifiable natural person.
• Processing means any operation performed on personal data (collection, storage, use, disclosure, deletion, etc.).
• Controller means the entity that determines the purposes and means of the processing (DIKUROOMS).
• Processor means an entity that processes personal data on the controller's behalf (e.g. a hosting or email provider).
• User means any individual accessing the website or installing/using our apps.
• Child means a person under the age defined by the law of their place of residence (see § 12).
• SDK means a software development kit integrated into our apps (most often an advertising SDK listed in § 8).
• Advertising identifier means a device-level identifier used by ad partners for ad selection and measurement — the Google Advertising ID (GAID) on Android and Apple's Identifier for Advertisers (IDFA) on iOS.
• EEA means the European Economic Area.
• UK means the United Kingdom of Great Britain and Northern Ireland.
• California means the State of California, USA.

3. Data we collect

We collect the following categories of data, depending on how you use our Services:

Identifiers

• Name, email address, company, job title (when you submit a contact or inquiry form).
• IP address, browser user agent, referrer, device and operating-system identifiers.
• Mobile-app identifiers: GAID (Android), IDFA (iOS), app instance ID, push-notification token.

Commercial information

• The inquiry topic and message body you choose to send us.
• Order, quote or service-request metadata you provide.

Internet / network activity

• Pages visited, time on page, scroll depth, referrer URL, timestamps.
• Search terms you used to reach our site.

Approximate location

• City- and country-level location inferred server-side from your IP address. We do not collect precise GPS coordinates from the website; the mobile apps do not request precise location unless explicitly required by a feature you opt into.

Mobile-app telemetry

• App version, build number, OS version, device model, locale, crash logs and diagnostic traces.
• Ad events: impression, click, completion, reward-grant, mediation waterfall outcomes.

We do not knowingly collect government-issued identifiers (passport, national ID), precise geolocation, biometric data, health data, sexual orientation, racial or ethnic origin, religious beliefs, or financial account credentials.

4. How we collect data

Directly from you

• When you submit the contact form on /contact.html or send us an email.
• When you create an account or invitation in one of our mobile apps.

Automatically from your device

• Cookies and similar storage on the website (see § 13).
• Server logs captured by our hosting provider.
• Mobile-app SDKs that initialize at app launch to deliver and measure ads (see § 8).

From partners

• App-store partners (Apple, Google) provide basic install, crash and aggregate usage statistics.
• Ad networks return auction results, ad-rendering events and aggregated performance metrics (see § 8).

5. Legal basis (GDPR / UK GDPR Art. 6)

For users in the EEA and the UK we rely on the following lawful bases under Article 6 of the GDPR / UK GDPR:

• Consent (Art. 6(1)(a)) — for non-essential cookies, ad personalization, and marketing emails. You may withdraw consent at any time without affecting prior lawful processing.
• Performance of contract (Art. 6(1)(b)) — to respond to an inquiry, deliver a quote, or fulfil an order you have placed.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, customs, accounting, record-keeping and law-enforcement obligations.
• Legitimate interests (Art. 6(1)(f)) — to keep the Services secure, prevent abuse, and produce internal aggregate reports. We conduct and re-test a balancing on a case-by-case basis and offer an objection mechanism (see § 16).

Where we rely on consent, the cookie banner on our website or the in-app consent prompt collects it. You can change your choice at any time.

6. How we use data

• To respond to your inquiries and provide customer support.
• To operate, maintain, secure and improve the website and the mobile apps.
• To select, render and measure advertising (see § 8 and § 9).
• To produce aggregated, de-identified analytics.
• To comply with applicable law and enforce our Terms.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you, and we do not build user profiles for advertising beyond what the ad partners listed in § 8 do on their own behalf.

7. Sharing and disclosure

Service providers (processors)

We share personal data with vetted service providers acting as processors on our behalf, including:

• Hosting and content delivery.
• Email and customer-support tools.
• Privacy-respecting analytics.
• Advertising SDKs listed in § 8 (each acts as an independent controller for the data they receive).

Legal

We may disclose personal data when required by law, valid legal process, or to protect the rights, property or safety of DIKUROOMS, our users or others.

Business transfers

If DIKUROOMS undergoes a merger, acquisition, reorganisation or sale of assets, personal data may be transferred under continued protection of this Policy (or a successor policy notified to you).

8. Ad partners — SDK inventory

Our mobile applications integrate the following advertising SDKs. Each sub-section below documents (a) what the SDK does, (b) the data it collects, (c) our lawful basis for the integration (and the vendor's own role as controller for the data they receive), (d) how to opt out on iOS and Android, and (e) a link to the vendor's privacy page. The list reflects our production configuration as of the Last updated date above; minor additions or removals are reflected in our App Store privacy labels and Data safety forms.

9. Ad formats used in our apps

Our apps use the following ad formats. The data flowing to the ad partners named in § 8 for each format is described below; the user controls described here apply in addition to the platform-level controls listed in § 8.

10. App-store compliance

Apple App Store Review Guidelines

Our mobile apps comply with all current Apple App Store Review Guidelines, including the following families that govern privacy:

• Guideline 1 (Objectionable Content) — content standards and user safety.
• Guideline 2 (Functionality) — apps must work as advertised and must not crash.
• Guideline 3 (Accuracy) — metadata, screenshots and descriptions must reflect actual functionality.
• Guideline 4 (Design) — UI and UX must follow Apple's design conventions.
• Guideline 5 (Legal), including:
  • 5.1.1 (App Privacy) — accurate responses to the App Privacy questions on App Store Connect for every app version.
  • 5.1.2 (Data Use) — data is used only as the user reasonably expects and only for the purposes disclosed in the privacy label and in this Policy.
  • Privacy Manifest — apps submit a current Privacy Manifest declaring all Required Reason APIs accessed, in line with the requirement that became effective on 1 May 2024.

Google Play Developer Program Policy

Our apps comply with the Google Play Developer Program Policy, including:

• User Data policies — Prominent Disclosure & Consent, and the requirement that all data collection, use and sharing match the disclosures in the Data safety form.
• Permissions policy — apps request only the runtime permissions strictly necessary for the functionality described.
• Families policy — where applicable, apps designed for or attractive to children comply with the Families requirements.

We keep the App Store privacy nutrition labels and the Play Console Data safety forms current for every app we publish on every store.

11. Regional laws

The rights below apply depending on where you live. We honour them regardless of which store you used to install our apps. To exercise any of these rights, see § 16 or contact us at support@dikurooms.com.

12. Children's data

COPPA (US)

We do not direct our websites or mobile apps to children under 13 and we do not knowingly collect personal data from children under 13. Where we have done so inadvertently, we delete it on discovery. Parents or guardians who believe we hold data about their child may contact us at support@dikurooms.com to request access and deletion.

GDPR-K (EU)

The default age of digital consent under the GDPR is 16. Several EU member states have lowered this to 13 (including Germany, Ireland, the Netherlands, Sweden and Finland, for instance). Where our Services are accessible to under-16s in those jurisdictions, we rely on verifiable parental consent before any non-essential processing. Our apps are not specifically designed for or marketed to children.

UK Age-Appropriate Design Code (AADC)

Where our Services are likely to be accessed by children in the UK, we follow the AADC's standards of best interest of the child, data-minimization, default-high privacy settings, no behavioural advertising to children, and a Data Protection Impact Assessment before launch.

If we discover that we have collected personal data from a child in error, we delete it as soon as reasonably practicable.

13. Cookies and tracking

• Strictly necessary cookies are always on and require no consent under EU/UK law.
• Analytics cookies are opt-in in the EEA/UK; in the US the default can be opt-out.
• Advertising cookies and SDKs are opt-in in the EEA/UK.
• Our cookie banner offers Reject and Accept controls. Your choice is stored in a persistent cookie so that you are not re-prompted on every visit, and you can change your choice at any time from the link in the footer (where available).

14. International transfers

Personal data may be processed in Hong Kong, the EEA, the United Kingdom, the United States, Singapore or Japan depending on the service provider used for a given function. Where personal data is transferred outside the EEA, the UK or other jurisdictions that the European Commission or the UK ICO consider adequate, we rely on the following safeguards:

• European Commission Standard Contractual Clauses (Commission Decision 2021/914), including the UK IDTA and the UK Addendum where applicable.
• Equivalent safeguards under local law, including equivalent US state laws (CCQP) where applicable.
• Vendor-level adequacy decisions or certifications where they exist.

15. Retention

• Inquiry emails and contact-form submissions: 24 months from the last interaction.
• Web server logs: 12 months.
• Mobile-app analytics: 13 months maximum.
• Ad-SDK identifiers and ad-event records: governed by the vendor's retention as published in the linked vendor privacy pages in § 8.

We may retain data for longer where required by tax, accounting or other legal obligations.

16. Your rights

Depending on where you live, you have some or all of the following rights with respect to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data (the "right to be forgotten"), subject to legal exceptions.
• Restriction — ask us to suspend processing of your data while a complaint is being investigated.
• Portability — receive the data you provided to us in a structured, machine-readable format and transmit it to another controller.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Withdrawal of consent — at any time, without affecting prior lawful processing.
• Complaint — to a supervisory authority (see § 11).

California-specific: right to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and non-discrimination for exercising these rights.

How to exercise

Email support@dikurooms.com from the address associated with your account or installation. We respond within 30 days (or within 45 days where the CCPA/CPRA applies and an extension is permitted by law). For verification we may request information that reasonably demonstrates your identity.

17. Security

• Personal data is encrypted in transit using TLS (HTTPS).
• Personal data is encrypted at rest where commercially reasonable for the storage layer involved.
• Access to personal data is restricted to staff who need it, under least-privilege controls.
• In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and the competent supervisory authority in accordance with applicable law.

No security measure is perfect; we continuously improve ours but cannot guarantee absolute security.

18. Changes to this policy

Material changes to this Policy will be posted with a new "Last updated" date at the top. Non-material changes (clarifications, corrections of typos, broken-link fixes) will be posted on this page without further notice. We encourage you to review this Policy periodically.

19. Contact

For any question about this Policy or to exercise your rights:

DIKUROOMS Trading Co., Limited
Rm F(B22) 2/F FREDER CTR 3 MOK CHEONG ST
To Kwa Wan, Kowloon, Hong Kong SAR
Email: support@dikurooms.com

© 2026 DIKUROOMS Trading Co., Limited. This Policy is also available on our Terms of Service page in the parent document.