Privacy Policy / 私隱政策
Effective date: 2026-11-12 Last updated: 2026-11-12
繁體中文
WAWA Awards（World Audience Wave Awards 全球歌迷音樂大獎）私隱政策
1. 我們是誰
WAWA Awards 網站（wawaawards.com）及手機應用程式「WAWA Awards」（下稱「本服務」）由 8A PRODUCTIONS LIMITED（香港註冊公司，註冊地址：Room A2, 11/F, Block A, Cambridge Court, Ho Man Tin, Kowloon, Hong Kong，下稱「我們」）營運。本政策說明我們如何依據香港《個人資料（私隱）條例》（第486章）處理你的個人資料。
私隱查詢及行使權利：hello@wawaawards.com。
2. 我們收集的資料
| 類別 | 內容 | 用途 |
|---|---|---|
| 帳戶資料 | 電郵地址；密碼（只儲存經 PBKDF2 加鹽雜湊後的結果，我們看不到你的密碼） | 建立及管理帳戶、登入、驗證電郵、重設密碼 |
| 登入階段資料 | 登入 session（只儲存雜湊值）、到期時間、註冊數字驗證碼／重設密碼的一次性 token（只儲存雜湊值） | 保持登入、保障帳戶安全 |
| 投票與參與紀錄 | 你的投票、分享（用以計算分享票額）、提名／支持紀錄、日期時間 | 計算票數、防止重複或異常投票、核查結果、顯示你本人的歷史 |
| 訂單與付款紀錄 | 訂單編號、金額、幣別、狀態、Stripe 交易／Checkout 編號、會員到期日 | 處理會員購買、對帳、退款、會計及法律義務 |
| 技術資料 | IP 位址、裝置／瀏覽器類型、請求時間、錯誤日誌；用於限流及防濫用的短期計數 | 服務安全、防止濫用、除錯 |
| 你主動提供的資料 | 你經聯絡方式寄給我們的訊息及電郵地址 | 回覆查詢 |
我們不會收集：信用卡／扣帳卡號碼（付款由 Stripe 處理，我們不接觸或儲存卡號）、精確位置、通訊錄、相片或影片庫、健康資料、香港身份證號碼。
本服務不使用第三方廣告 SDK，亦不跨應用程式或網站追蹤你。
3. 使用目的與法律基礎
提供及維護本服務；處理購買；防止詐騙及濫用；遵守法律；回覆你的查詢；（經你同意）向你發送服務以外的通訊，你可隨時退訂。
4. 披露及服務供應商
我們只在必要時向以下類別的供應商披露資料，並要求其保密及只按我們指示使用：
- Cloudflare, Inc.（網站、API、資料庫、電郵路由／寄送的雲端基建；資料可能儲存於香港以外）。
- Stripe, Inc.（付款處理；Stripe 另有其私隱政策）。
- 蘋果公司（Apple）／ Google（應用程式分發及（日後）應用內購買平台）。
我們不出售你的個人資料。如法律或法院命令要求，或為保障權利及安全所需，我們可向執法或監管機構披露。
5. 跨境傳輸
你的資料可能傳送至香港以外（包括美國及其他 Cloudflare／Stripe 營運地區）處理及儲存。我們會採取合理措施，使資料得到與本政策相若的保護。
6. 保存期限
- 帳戶及投票資料：帳戶存續期間保存；你刪除帳戶後，我們於 30 日內刪除或匿名化（見第 8 節）。
- 訂單／付款紀錄：因會計及稅務責任，保存 7 年，並與你的身份脫鈎（僅保留必要的交易資料）。
- 登入 session：最長 7 日有效，登出時即失效；註冊數字驗證碼及密碼重設 token 分別於 10 分鐘／30 分鐘後失效。
- 技術日誌：不超過 30 日。
7. 安全
密碼以加鹽雜湊儲存；session 及 token 只儲存雜湊值；傳輸使用 HTTPS；session cookie 設 Secure、HttpOnly。沒有任何系統可保證絕對安全。
8. 你的權利及刪除帳戶
你有權查閱及更正你的個人資料，及要求刪除。
- 在應用程式／網站內刪除：登入後前往「我的 WAWA」→「帳戶」→「刪除帳戶」，確認密碼即可。
- 網上刪除頁面：https://wawaawards.com/delete-account （同一頁亦須於 https://wawaawards.com/account/delete 可開啟）
- 無法登入：電郵 hello@wawaawards.com，標題「刪除帳戶」，我們會在核實身份後 30 日內處理。
刪除後：你的電郵、密碼雜湊、登入紀錄、投票歸屬及參與紀錄會被刪除或不可逆地匿名化；已計入的票數可能以不可識別方式保留，以維持結果完整性；法律要求保存的付款紀錄除外。
9. 兒童
本服務不針對 13 歲以下兒童，我們不會明知而收集其個人資料。如你認為孩子向我們提供了資料，請聯絡我們刪除。
10. 第三方連結
本服務可能連到官方社交平台等第三方網站，其私隱做法不受本政策約束。
11. 政策更新
我們可能更新本政策，重大改動會在網站／應用程式內公布並更新「最後更新」日期。
12. 聯絡
8A PRODUCTIONS LIMITED｜香港｜hello@wawaawards.com｜Room A2, 11/F, Block A, Cambridge Court, Ho Man Tin, Kowloon, Hong Kong
English
Privacy Policy — WAWA Awards (World Audience Wave Awards)
1. Who we are
The WAWA Awards website (wawaawards.com) and the "WAWA Awards" mobile app (the "Service") are operated by 8A PRODUCTIONS LIMITED, a company registered in Hong Kong (registered address: Room A2, 11/F, Block A, Cambridge Court, Ho Man Tin, Kowloon, Hong Kong) ("we", "us"). This policy explains how we handle personal data under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong. Privacy contact: hello@wawaawards.com.
2. Data we collect
| Category | Data | Why |
|---|---|---|
| Account | Email address; password (stored only as a salted PBKDF2 hash — we cannot see it) | Create/manage account, sign in, verify email, reset password |
| Session | Session records and numeric registration codes and one-time password-reset tokens (stored only as hashes), expiry times | Keep you signed in; account security |
| Voting & participation | Your votes, share actions (used to compute bonus share votes), nomination/support actions, timestamps | Count votes, prevent duplicate/abnormal voting, verify results, show your own history |
| Orders & payments | Order ID, amount, currency, status, Stripe checkout/transaction IDs, membership expiry | Process purchases, reconcile, refunds, accounting/legal obligations |
| Technical | IP address, device/browser type, request time, error logs; short-lived rate-limit counters | Security, abuse prevention, debugging |
| Messages you send us | Content and email address you send via our contact channel | Reply to you |
We do not collect: card numbers (payments are handled by Stripe; we never see or store card numbers), precise location, contacts, photos/videos, health data, or HKID numbers.
The Service uses no third-party advertising SDKs and does not track you across other apps or websites.
3. Purposes
To provide and maintain the Service; process purchases; prevent fraud and abuse; comply with law; answer your enquiries; and (with your consent) send non-service communications, which you can opt out of at any time.
4. Disclosure and service providers
We disclose data only as necessary to: Cloudflare, Inc. (hosting, API, database, email routing/sending — data may be stored outside Hong Kong); Stripe, Inc. (payment processing, under its own privacy policy); Apple / Google (app distribution and, in future, in-app purchase platforms). We do not sell personal data. We may disclose data to authorities where required by law or to protect rights and safety.
5. International transfers
Data may be processed and stored outside Hong Kong (including the United States and other Cloudflare/Stripe regions). We take reasonable steps to give it protection comparable to this policy.
6. Retention
Account and voting data: while your account exists; deleted or anonymised within 30 days after you delete your account. Order/payment records: kept 7 years for accounting/tax obligations and de-linked from your identity where possible. Sessions remain valid for up to 7 days and are invalidated at sign-out; numeric registration codes expire after 10 minutes and password-reset tokens after 30 minutes. Technical logs: no longer than 30 days.
7. Security
Passwords are salted-hashed; sessions and tokens are stored only as hashes; traffic uses HTTPS; session cookies are Secure and HttpOnly. No system is perfectly secure.
8. Your rights and account deletion
You may access, correct and request deletion of your personal data.
- In the app / website: sign in → My WAWA → Account → Delete account, confirm your password.
- Web deletion page: https://wawaawards.com/delete-account (the same page must also be available at https://wawaawards.com/account/delete)
- Cannot sign in: email hello@wawaawards.com with subject "Delete account"; we respond after verifying identity, within 30 days.
After deletion: your email, password hash, sessions, vote attribution and participation records are deleted or irreversibly anonymised; counted votes may be retained in non-identifiable form to preserve result integrity; payment records we are legally required to keep are retained.
9. Children
The Service is not directed to children under 13; we do not knowingly collect their data. Contact us to have such data deleted.
10. Third-party links
Links to third-party sites (e.g. official social accounts) are governed by those sites' policies.
11. Changes
We may update this policy; material changes will be announced in the Service with a new "Last updated" date.
12. Contact
8A PRODUCTIONS LIMITED, Hong Kong — hello@wawaawards.com — Room A2, 11/F, Block A, Cambridge Court, Ho Man Tin, Kowloon, Hong Kong