Privacy Policy

1. About this Policy

This Privacy Policy (the "Policy") explains how Carbonmall Coal Sales Special Limited ("Beehox", "we", "us", "our") collects, uses, shares and protects personal data when you visit https://beehox.com, sign up for an account at https://dash.beehox.com, route traffic through our residential-proxy infrastructure, or contact us through any other channel listed below.

Carbonmall Coal Sales Special Limited is a company incorporated in Hong Kong under registration number 3348577, with its registered office at Rm 06, 13A/F., South Tower, World Finance Centre, 17 Canton Road, Harbour City, Tsim Sha Tsui, Kowloon, Hong Kong SAR. For the purposes of this Policy Carbonmall Coal Sales Special Limited is the data controller of personal data collected from website visitors, account holders and billing contacts. When we route customer traffic through proxy nodes on instructions of a customer, we act as a data processor strictly within the limits of the customer's agreement with us.

This Policy is written with the European Union General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") and the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") in mind. To the extent any of those laws apply to you, we treat their requirements as binding even where Hong Kong law does not strictly require it.

By using the website, the dashboard or any of our services (collectively the "Services") you confirm that you have read this Policy. If you do not agree with it, please discontinue use of the Services. Continued use of the Services after a revised Policy has been published constitutes acceptance of that revised version.

2. Information we collect

We collect personal data in five broad categories. We try to keep the collection to the minimum necessary for the purpose for which it is processed.

Account and billing data. When you register an account we collect your email address, display name, password hash (we never store plaintext passwords), language preference, and any optional fields you choose to fill in such as company name and contact phone. To issue invoices and comply with tax obligations we additionally collect billing legal name, tax identification number where applicable, country, and postal address.

Service usage data. While you operate the dashboard or route traffic through Beehox we record your account and wallet status, active free-trial state (if any), bandwidth and request counters per endpoint, session identifiers, gateway and country / city selection, error logs, abuse signals and an audit trail of administrative actions performed on the account (such as password changes, two-factor enrolment, and API-key creation).

Technical data. When you load any page on the website or dashboard we automatically receive the IP address of the requesting client, browser user-agent, viewport size, referrer URL, request timestamps and cookies. A full list of cookies and similar technologies is set out in our Cookie Policy and that document forms part of this Policy by reference.

Communications. When you contact us by email, through an in-product feedback widget, or through any future support channel we operate, we retain a copy of your message together with attachments and the email address you wrote from. We keep this material so we can resolve your request and demonstrate a history of customer-service interactions.

Identity-verification data. For higher-tier or higher-risk transactions, and where required by anti-money-laundering legislation, we may ask you to complete a Know-Your-Customer ("KYC") flow. This may include providing a copy of a government-issued identity document, proof of address, a declaration of ultimate beneficial owner for legal entities, and a live photograph for biometric comparison. KYC data is processed by a specialised verification provider on our behalf and is described in section 5 below.

3. How we use your information

We process the personal data described above only for the purposes listed in this section.

• Service delivery — authenticating your sessions in the dashboard, routing your traffic through the proxy network, billing the bandwidth and requests you consume, replenishing your wallet, generating invoices, and providing customer support and account administration.
• Security, fraud prevention and platform integrity — detecting credential stuffing, payment fraud, abuse of the proxy network, distributed denial-of-service, automated scraping of our own dashboard, and other malicious patterns. This includes risk scoring of new sign-ups, IP-reputation checks, device fingerprinting strictly for anti-abuse purposes, and screening against international sanctions lists.
• Service improvement and analytics — aggregated, anonymised analysis of which pages, features and endpoints are used most, error rates, latency distribution and performance characteristics. Where analytics rely on cookies or browser storage, they are loaded only after you grant consent through the cookie banner.
• Transactional and operational communications — sending password resets, two-factor codes, security alerts, billing receipts, invoices, scheduled-maintenance notifications and material updates to our Terms of Service or this Policy. These are not marketing communications: you cannot opt out of them without closing the account.
• Marketing communications — only with your explicit opt-in, sending product announcements, educational content, and offers related to Services you already use. Every marketing email contains a one-click unsubscribe link, and you can withdraw consent at any time without affecting prior processing.
• Legal compliance — meeting tax, accounting, sanctions-screening, anti-money-laundering, anti-terrorist-financing and law-enforcement obligations that apply to our business in Hong Kong, in jurisdictions where our sub-processors are based, and in jurisdictions where you are located.
• Establishing, exercising or defending legal claims — retaining material that we may need to bring or defend a claim, respond to a regulatory enquiry or comply with a court order.

4. Legal bases for processing

For users located in the European Economic Area, the United Kingdom and Switzerland, we rely on the following lawful grounds under Article 6 of the GDPR (and the equivalent provisions of the UK GDPR and the FADP). For users in Hong Kong, the equivalent grounds under the PDPO apply.

Performance of a contract (Art. 6(1)(b) GDPR) — to deliver the Services you subscribed to, including account creation, traffic routing, billing, refunds, technical support and any other action required to fulfil the Terms of Service.

Legitimate interests (Art. 6(1)(f) GDPR) — to keep the platform secure, prevent fraud and abuse, monitor service quality, conduct internal analytics, develop new features and protect our own rights. Before relying on a legitimate interest we balance it against your rights and freedoms; you have the right to object to this processing at any time on grounds relating to your particular situation.

Legal obligation (Art. 6(1)(c) GDPR) — to comply with tax, accounting, anti-money-laundering, sanctions and law-enforcement obligations and to respond to lawful requests from competent public authorities.

Consent (Art. 6(1)(a) GDPR) — for non-essential cookies, analytics, optional product communications and any other purpose explicitly flagged as consent-based at the time of collection. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing performed before withdrawal.

Vital interests and public interest (Art. 6(1)(d) and 6(1)(e) GDPR) — we do not generally rely on these grounds, but reserve the right to do so in narrowly defined emergency cases (for example, to protect a person's life from an imminent threat).

5. Sharing and sub-processors

We do not sell, rent, trade or otherwise commercialise personal data. We share strictly necessary data with the categories of sub-processors listed below. Each sub-processor is bound by a written data-processing agreement that requires it to apply security measures at least equivalent to ours and to act only on our documented instructions.

On request, and subject to confidentiality, we can share the current list of the specific entities engaged in each category, the country in which they operate and a redacted copy of the data-processing agreement that binds them.

We may also disclose information to courts, regulators and law-enforcement authorities where required by valid legal process such as a court order, subpoena or sanctions-enforcement notice. In any such case we disclose only the minimum data demanded by the request.

Corporate transactions. In the event of a contemplated or completed merger, acquisition, reorganisation, asset sale or financing, we may share personal data with the prospective counterparty and its advisers under appropriate confidentiality obligations and only to the extent reasonably necessary to evaluate or close the transaction. We would notify affected users in advance through the dashboard or by email.

6. International transfers

Carbonmall Coal Sales Special Limited is based in Hong Kong. Our primary compute and database infrastructure operates within the European Union, while a number of sub-processors operate from the United States, the United Kingdom and other countries. As a result, personal data we collect about you may be transferred outside your country of residence.

When personal data of EEA, UK or Swiss data subjects is transferred to a third country, we rely on one of the transfer mechanisms permitted under Chapter V of the GDPR: (a) an adequacy decision of the European Commission where one exists; (b) the European Commission's Standard Contractual Clauses 2021/914 or their UK / Swiss equivalents, combined with supplementary technical and organisational measures where required by the recipient country's legal environment; or (c) one of the specific derogations under Article 49 GDPR, such as your explicit consent or necessity for the performance of a contract concluded in your interest.

For data subjects in Hong Kong and other jurisdictions, we apply equivalent safeguards consistent with the PDPO and any other applicable cross-border-transfer rules.

You may request a list of countries to which your personal data is transferred and a copy of the safeguards in place by emailing team@beehox.com. Trade secrets and commercially sensitive contract clauses may be redacted from any copy provided.

7. Data retention

We keep personal data only for as long as necessary to fulfil the purposes set out in this Policy, or for longer where required by law. Specific retention periods follow.

Account data is retained for the entire lifetime of the account and for up to twelve months after closure, so that you can reopen the account if you change your mind and so that we can meet our legal obligations.

Billing records, invoices, payment transactions and any identity-verification data are retained for the period required by tax, accounting and anti-money-laundering legislation. In Hong Kong and most jurisdictions where our financial counterparties operate, this is typically five to seven years from the date of the last transaction.

Server logs containing IP addresses and request metadata are retained for up to ninety days for security investigations and abuse-prevention purposes, after which they are aggregated, anonymised or deleted.

Support tickets, product-feedback messages and other customer correspondence are retained for up to twenty-four months after the last interaction on the relevant thread, except where a longer period is required to defend a legal claim.

Anonymised, aggregated statistics that no longer permit identification of any individual may be retained indefinitely for product analytics and research.

Once a retention period expires we delete or irreversibly anonymise the data. Backups containing your data are overwritten on a rolling basis through normal backup-rotation processes; restoring an older backup to recover deleted data is not part of our routine operations.

8. Your privacy rights

Subject to the limits set out in applicable law, you may exercise the following rights with respect to your personal data:

• Access — receive confirmation of whether we are processing personal data about you and obtain a copy of that data along with information about the processing.
• Rectification — ask us to correct inaccurate data or to complete data that is incomplete.
• Erasure — ask us to delete your data (the so-called right to be forgotten) where there is no overriding legal reason to keep it: data no longer necessary for its purpose, consent withdrawn, or processing unlawful.
• Restriction — ask us to suspend processing while a request is being resolved, while the accuracy of data is being verified or where you object to processing pending a decision on legitimate interests.
• Portability — receive a structured, commonly used, machine-readable copy of the data you have provided to us and ask us to transmit it directly to another controller where technically feasible. This right applies only to data processed by automated means on the basis of contract or consent.
• Objection — object to processing based on legitimate interests, including any profiling related to such processing. We will stop unless we can demonstrate compelling legitimate grounds that override your rights and freedoms, or unless the processing is needed to establish, exercise or defend legal claims.
• Withdrawal of consent — withdraw any consent you previously gave (cookie banner, marketing opt-in, etc.) without affecting the lawfulness of processing performed before withdrawal.
• Complaint — lodge a complaint with the supervisory authority in your country of residence, place of work or place of the alleged infringement. For Hong Kong residents that authority is the Office of the Privacy Commissioner for Personal Data (PCPD); for EEA residents it is the data-protection authority of your member state; for UK residents it is the Information Commissioner's Office.
• Automated decision-making — we do not subject you to decisions producing legal or similarly significant effects on you based solely on automated processing, including profiling. Some operational scoring (automated fraud or abuse detection) influences but does not determine final outcomes; a human reviewer is involved in any action with significant consequences such as account suspension.

9. Notice to EEA, UK and Swiss residents

If you are a resident of the European Economic Area, the United Kingdom or Switzerland, the GDPR and its UK / Swiss counterparts apply to our processing of your personal data because we offer Services to you within the meaning of Article 3(2) GDPR. Carbonmall Coal Sales Special Limited acts as data controller for that processing.

Where we are required to appoint a representative in the EU or the UK under Article 27 GDPR, we will update this Policy with the representative's name and contact details. In the meantime, you may exercise all of your GDPR rights directly with us at team@beehox.com.

International transfers of EEA / UK / Swiss data are conducted under the safeguards described in section 6 above.

You have the right to lodge a complaint with the data-protection authority in your country of residence. A list of EEA authorities is available at edpb.europa.eu; the UK authority is the Information Commissioner's Office at ico.org.uk; the Swiss authority is the Federal Data Protection and Information Commissioner at edoeb.admin.ch.

10. Notice to California residents

If you are a California resident, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (the "CCPA/CPRA") grants you certain rights with respect to your personal information.

Categories of personal information collected. In the preceding twelve months we have collected the categories described in section 2 above, which under the CCPA fall within: identifiers (name, email, IP address, account ID); commercial information (purchase history, transactions); internet or other electronic network activity (usage of the dashboard, request logs); geolocation data approximated from IP address; professional information voluntarily provided (company name, role); and inferences drawn from the above for security, billing and product purposes.

Sources. We collect personal information directly from you, automatically when you use the Services, and from our sub-processors (for example, payment processors confirming a transaction).

Business and commercial purposes. We use the information for the purposes set out in section 3 above.

Categories of third parties to which we disclose personal information. We disclose personal information to the categories of sub-processors listed in section 5 (payment processors, infrastructure providers, analytics providers, customer-experience tooling and identity-verification providers), as well as to professional advisers and competent authorities where required.

Do Not Sell or Share. We do not sell personal information for monetary or other valuable consideration, and we do not share personal information for cross-context behavioural advertising. We therefore do not display a Do-Not-Sell-or-Share link; you are nonetheless entitled to make that request and we will confirm the same in writing on request.

California rights. You may request to know what we collect about you, to access and receive a copy of that information, to correct inaccurate information, to delete information subject to the statutory exceptions, and to limit the use of sensitive personal information. You may submit a verifiable consumer request by emailing team@beehox.com. We will respond within forty-five days and may extend the period by a further forty-five days where reasonably necessary.

We do not discriminate against you for exercising any CCPA / CPRA right.

11. Notice to Hong Kong residents

Because Carbonmall Coal Sales Special Limited is incorporated in Hong Kong, the PDPO applies to our processing as a matter of local law. The rights described in section 8 of this Policy mirror the rights granted by the PDPO, including the right of access and correction.

Should we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the Privacy Commissioner for Personal Data without undue delay and, where required, will also notify affected data subjects in accordance with the PDPO.

You have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD); contact information is available at pcpd.org.hk.

12. Children's data

The Services are designed for adults who use proxy infrastructure in a professional or business capacity. We do not knowingly collect personal data from individuals under the age of sixteen, and individuals under eighteen are not permitted to open an account.

If you believe that a child has provided personal data to us, please contact team@beehox.com and we will take steps to delete the information from our systems as soon as reasonably possible.

13. Security

We protect personal data with industry-standard technical and organisational measures, including TLS 1.2+ for all client connections, encryption at rest for credentials and identity-verification documents, hashed and salted password storage, strict role-based access control for administrative tooling, audit logging of privileged operations, internal segregation between production and staging environments, time-bound access tokens for administrative actions, mandatory two-factor authentication for staff with privileged access, and periodic internal security reviews.

We test backups regularly and maintain a documented incident-response plan. No system is ever perfectly secure. If we become aware of a personal-data breach that affects your data, we will notify the relevant supervisory authority without undue delay and, where required by applicable law, within seventy-two hours of becoming aware of the breach. We will inform affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

We strongly recommend that you enable two-factor authentication on your account, use a strong unique password, keep your operating system and browser up to date and never share dashboard credentials with third parties. We will never ask you for your password or two-factor codes by email or chat.

14. Cookies and similar technologies

This Policy is supplemented by our Cookie Policy, available at https://beehox.com/cookie-policy. The Cookie Policy describes each cookie or local-storage entry set by the website and dashboard, its purpose, duration and category, and how to control them through our consent banner or through your browser settings.

Personal data captured through cookies is processed under the rules set out in this Policy. Strictly necessary cookies are set without prior consent; analytics and other optional cookies are loaded only after you grant consent through the banner.

15. Updates to this Policy

We may update this Policy from time to time to reflect changes in our practices, the services we offer, our sub-processors or applicable law. The 'Effective' date at the top of this page always shows the date of the latest revision. Where a change is material and affects your rights, we will additionally notify active customers by email or by a prominent banner on the dashboard at least thirty days before the revised Policy takes effect, except where a shorter notice period is required by law (for example, in response to a regulator's order).

Continued use of the Services after a revised Policy becomes effective constitutes acceptance of the revised version. If you do not agree with a revision, you must stop using the Services and may exercise your right of erasure as described in section 8.

Previous versions of the Policy are kept on file and a copy of an earlier version applicable on a specific past date can be requested by email.

Contact

Carbonmall Coal Sales Special Limited is a company incorporated in Hong Kong under registration number 3348577, with its registered office at Rm 06, 13A/F., South Tower, World Finance Centre, 17 Canton Road, Harbour City, Tsim Sha Tsui, Kowloon, Hong Kong SAR.

For any questions about this document, requests to exercise your data-subject rights, or anything else covered above, please email team@beehox.com from the email address associated with your account. We aim to acknowledge requests within five business days and to provide a substantive reply within thirty days. We may extend that period for complex requests, in which case we will tell you so in writing.

Written correspondence can be sent to the registered office above. Please mark envelopes "Legal — Carbonmall Coal Sales Special Limited" so they reach the right team.