Privacy Policy

Effective: [2026-09-22]. Gawin Century Limited (“Gawin”) operates gawinresearch.com. This policy explains how we collect, use and share personal data.

1. Data controller

Gawin Century Limited, [HK registered address / correspondence address]. Contact: privacy@gawinresearch.com.

2. What we collect

Account: name/display name, email, password hash, membership tier, subscription status.
Billing: billing email, country, tax location, last4/brand metadata via Stripe. We do not store full card numbers; Stripe does.
Newsletter: email, open/click metadata, consent records.
Site logs/security: IP, user-agent, login attempts; analytics only if you consent.
Communications: support emails, institutional contract details.

Performance of contract: deliver free/paid articles, send transactional/renewal emails (Art. 6(1)(b)).
Consent: marketing newsletter and non-essential analytics/cookies (Art. 6(1)(a)); you may withdraw anytime.
Legitimate interests: fraud prevention, security, debugging (Art. 6(1)(f)).
Legal obligation: tax, accounting, responding to lawful requests (Art. 6(1)(c)).

4.Third parties & international transfers

Stripe: payment processing, tax calculation, fraud; data may process in the US/other regions under its compliance program.
Mailgun/Amazon SES: email delivery.
Hosting: self-hosted server located at [region/provider]; backups encrypted.
Analytics: [Plausible/Fathom/none] by default; if Google Analytics is enabled, it loads only after consent.

For EU/UK transfers we rely on providers’ lawful transfer mechanisms (e.g., SCCs/UK IDTA where applicable) and standard contractual protections.

5.Cookies

Strictly necessary cookies for login/session/security are set without consent. Analytics/marketing cookies are set only after consent via our banner; see /cookies/. You can clear or block cookies in your browser, but some features may break.

6.Retention

Account and billing data retained while your account is active and for the period required by tax/accounting law (commonly 7 years for Hong Kong tax/records; shorter if you delete and no legal hold applies). Newsletter consent logs retained to evidence compliance. Server logs rotated per hosting policy.

7.Your rights

Depending on location you may access, correct, export, delete, object to marketing, withdraw consent, or complain to a supervisory authority. EU users may contact their member-state DPA; UK users the ICO; California users may request access/deletion/opt-out under CCPA/CPRA. Email support@gawinresearch.com. We verify identity before acting.

8.Children

Not directed to under-18s; we do not knowingly collect data from minors.

9.Changes

We post material changes here and, where required, notify by email.