Your data, cared for.

1. Who we are

"Wenovelists", "we", "us", and "our" refer to the entity operating the Wenovelists monthly book subscription service and the website located at wenovelists.com. We are the data controller (under the GDPR), data user (under the Hong Kong PDPO), and organisation (under the Singapore PDPA) responsible for the personal data we process about you.

For questions about this policy, our practices, or any request relating to your personal data, contact us at esteban.espeleta@wenovelists.com.

2. Data we collect

The categories of personal data we collect depend on how you interact with us:

We do not intentionally collect special categories of data (such as health, ethnicity, religion, political opinions, biometric data, or sexual orientation). Please do not include such information when you write to us.

3. How we collect data

We collect personal data in the following ways:

• Directly from you, when you create an account, place an order, send us a message, complete a form, or sign up for our editorial mail.
• Automatically, through cookies and similar technologies when you use our website (see Cookies & tracking).
• From third parties, in limited cases — for example, payment confirmation from our payment processor, delivery confirmation from a carrier, or referral information from a marketing partner.

4. Why we use your data

We use your personal data for the following purposes:

• To create and manage your account.
• To process your orders, dispatch your monthly parcels, and provide customer service.
• To take payment, process refunds, and prevent fraud.
• To remember your reading history so we don't send you the same book twice.
• To send transactional messages (order confirmations, dispatch notices, renewal reminders, account notices).
• To send editorial and promotional messages, where you have opted in.
• To improve our website, services, and curation.
• To comply with legal obligations, respond to lawful requests from authorities, and enforce our terms.

5. Lawful bases for processing (GDPR)

Where the EU or UK GDPR applies, we rely on the following lawful bases:

• Performance of a contract — to fulfil your subscription, deliver your books, and provide the services you have signed up for.
• Consent — for editorial and promotional emails and any non-essential cookies. You may withdraw consent at any time.
• Legitimate interests — to operate, secure, and improve our service; to prevent fraud; to defend legal claims; to send service-related messages. We balance our interests against your rights and only rely on this basis where the impact on you is limited.
• Legal obligation — to retain transaction records for tax and accounting purposes and to respond to lawful requests from regulators or courts.

6. Who we share data with

We share personal data only with the following categories of recipients, and only to the extent necessary:

• Payment processors (e.g. Shopify Payments, Stripe, PayPal) — to take payment.
• Carriers and logistics partners — to deliver your parcels.
• Email service providers — to send transactional and (where opted in) editorial mail.
• Analytics providers — in aggregated, de-identified form where possible.
• Customer-service tools — used to read and respond to your messages.
• Professional advisers — such as accountants, auditors, and lawyers, under duties of confidentiality.
• Authorities — where we are legally required to disclose information, or where it is necessary to protect our rights, your safety, or the safety of others.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

7. International transfers

Wenovelists operates across Hong Kong, Singapore, the Philippines, and Malaysia, and uses service providers located in jurisdictions including the European Union, United Kingdom, United States, Canada, and Australia. As a result, your personal data may be transferred to, stored in, and processed in countries outside your country of residence.

EEA / UK transfers (GDPR)

Where personal data of individuals in the EEA or the UK is transferred to a country that has not been recognised as providing an adequate level of protection, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), together with supplementary technical and organisational measures, as required.

Singapore transfers (PDPA)

Where personal data of individuals in Singapore is transferred outside Singapore, we take reasonable steps to ensure the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA, as required by section 26 of the PDPA and the Personal Data Protection Regulations 2014.

Hong Kong transfers (PDPO)

While section 33 of the PDPO has not been brought into force, we apply equivalent protection to cross-border transfers of Hong Kong personal data and follow the Privacy Commissioner's published guidance on cross-border data transfers.

8. Cookies & similar technologies

Our website uses cookies and similar technologies. We classify them as follows:

• Strictly necessary — required to operate the site and your account (e.g. session, cart, security, language). These do not require your consent.
• Functional — remember your preferences (e.g. country/region, plan picker state).
• Analytics — help us understand how visitors use the site so we can improve it.
• Marketing — used (only with your consent) to measure the performance of our editorial campaigns.

Where required (including in the EEA, the UK, Singapore for marketing-related cookies, and where the PDPO's PCPD guidance recommends), we ask for your consent before setting non-essential cookies. You can change your preferences at any time via the cookie settings link in the footer.

9. Marketing & consent

We send editorial and promotional emails only to subscribers who have opted in. Every such message includes a one-click unsubscribe link. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

For Singapore residents: in compliance with the PDPA's Do Not Call provisions, we will not send marketing messages to a Singapore phone number unless we have obtained valid clear and unambiguous consent in writing or other accessible form. You may withdraw consent at any time.

For Hong Kong residents: in compliance with Part VIA of the PDPO, we will not use your personal data in direct marketing without your consent, and we will provide an opt-out mechanism in every direct marketing message.

10. How long we keep data

We keep personal data only for as long as is necessary for the purposes set out in this policy or as required by law:

11. Security

We implement technical and organisational measures appropriate to the risks of processing, including: encryption in transit (TLS 1.2+), encryption of stored sensitive fields, hashed passwords, role-based access controls, principle-of-least-privilege for staff, regular access reviews, and contractual confidentiality obligations on staff and processors.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at esteban.espeleta@wenovelists.com.

12. Your rights by jurisdiction

Your rights vary depending on the privacy law that applies to you. The summaries below are non-exhaustive — please write to us if you would like detail on a specific right.

How to exercise a right

Email esteban.espeleta@wenovelists.com from the address on your account, with the subject line "Privacy Request – [type of request]". We may need to verify your identity before responding.

Response times

• GDPR: within one (1) month of receipt; extendable by up to two further months for complex requests, with notification.
• Singapore PDPA: within thirty (30) days of receipt for access requests; we will inform you if more time is required.
• Hong Kong PDPO: within forty (40) days of receipt for DARs and DCRs.

Most requests are free. The PDPO permits us to charge a fee that is not excessive for compliance with a DAR; if a fee will apply, we will notify you in advance.

13. Children's privacy

Wenovelists is not directed to children. We do not knowingly collect personal data from individuals under the age of 16 (or the equivalent minimum age in your jurisdiction) without verifiable parental consent. If you believe a child has provided us with personal data, contact us at esteban.espeleta@wenovelists.com and we will delete it.

14. Automated decisions & profiling

We do not make decisions about you that produce legal effects or similarly significant effects based solely on automated processing. We may use limited profiling to personalise editorial recommendations and prevent fraud; you have the right to object to such profiling.

15. Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it (where required by the GDPR), and notify affected individuals without undue delay where the risk is high. We will also notify Singapore's PDPC and Hong Kong's PCPD where required by the PDPA's mandatory breach notification regime and the PCPD's published guidance respectively.

16. Changes to this policy

We may update this policy from time to time. The version posted on this page, with the effective date above, is the version in force. If we make material changes, we will notify you by email and/or through a notice on our website at least seven (7) days before the changes take effect.

17. Contact & complaints

For all privacy-related questions, requests, or complaints, contact our privacy team:

If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority in your jurisdiction:

• EEA — your local Data Protection Authority. A list is available at edpb.europa.eu.
• United Kingdom — the Information Commissioner's Office (ico.org.uk).
• Singapore — the Personal Data Protection Commission (pdpc.gov.sg).
• Hong Kong — the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk).