Privacy Policy

Last updated 23 July 2026

This policy explains what data Varelle Limited collects, how we use it, and the choices you have. It covers both our online stores and the internal software we use to operate them. If anything here is unclear, email us at hq@nnholdings.co.

Who we are

Varelle Limited, trading as NN Holdings, operates direct-to-consumer ecommerce stores and builds the internal software that runs them. For the purposes of data protection law, Varelle Limited is the data controller for the information described below.

Our registered office is:
Room 01, 26/F, Working View Commercial Building
21 Yiu Wa Street, Causeway Bay
Hong Kong Island, Hong Kong SAR

Information we collect from customers

• Order information — name, delivery address, email address, phone number and the items ordered, so we can fulfil and support your order.
• Payment information — handled by our payment processors. We receive confirmation that a payment succeeded and the last digits of the card, but we do not store full card numbers.
• Usage information — pages viewed and similar analytics, used to understand how our stores perform.
• Correspondence — messages you send us, kept so we can answer and keep a record of support history.

Google account data

Our internal software connects to Google services for the advertising and merchant accounts we operate. When someone on our team connects a Google account, they are asked to grant access through Google's own consent screen. We request the following, and use it only for the purposes stated:

• Google Ads data (adwords scope) — we read campaign, keyword, cost and performance data, and create or adjust campaigns and budgets, for the Google Ads accounts we operate. This is used to run and report on our own advertising.
• Google Merchant Center data (content scope) — we read and update product feed data for the merchant accounts we operate, so that our shopping listings reflect accurate prices and availability.
• Basic account identity (openid, email) — we read the email address of the Google account being connected, solely so the person connecting can confirm they have selected the correct account.

How Google data is stored and protected

Connecting a Google account produces an access token and a refresh token. These are held in our own database, on infrastructure we control, and are transmitted only over encrypted HTTPS connections. They are never displayed in our user interface, never returned by our application's status endpoints, and never shared with third parties. Access to the underlying systems is restricted to the small number of staff who administer them.

We request the narrowest set of permissions our work requires, and we hold the tokens only for as long as the connection is in use.

Anyone can disconnect at any time from within our software, which revokes the token with Google, or by removing our access directly at myaccount.google.com/permissions. When access is revoked, the stored tokens are deleted.

Limited Use disclosure

Varelle Limited's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide and improve the features described above; we do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising outside the accounts it came from; and we do not allow humans to read it except with explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymised.

How we share information

We do not sell personal information. We share it only with service providers who help us operate — payment processors, shipping and fulfilment partners, hosting providers and analytics providers — and only to the extent they need it to perform that service for us. We may also disclose information where we are legally required to.

How long we keep information

Order records are kept for as long as needed to fulfil the order and to meet our accounting and tax obligations. Google access tokens are kept only while the connection is active and are deleted when it is revoked. Other data is kept only as long as it serves the purpose it was collected for.

Your rights

You may ask us to give you a copy of the personal information we hold about you, to correct it if it is wrong, to delete it, to restrict or object to how we use it, or to provide it in a portable format. To exercise any of these, email hq@nnholdings.co and we will respond within the period required by the law that applies to you.

Varelle Limited is incorporated in Hong Kong and handles personal data in line with the Hong Kong Personal Data (Privacy) Ordinance. If you are unhappy with how we have handled your data, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.

Because we sell into European markets, the EU and UK General Data Protection Regulation also applies to customers in those regions. If you are in the EEA or the UK, you have the rights set out above under that legislation and may complain to your local supervisory authority.

International transfers

We are based in Hong Kong, so information you give us is processed outside your own country if you live elsewhere. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards for that transfer, such as the European Commission's standard contractual clauses. You can ask us for details of the safeguards that apply to you.

Children

Our stores and software are not directed at children under 16, and we do not knowingly collect their personal information.

Changes to this policy

If we change this policy we will update the date at the top of this page, and for significant changes we will make the update clear on our site.

Contact

Varelle Limited
Room 01, 26/F, Working View Commercial Building
21 Yiu Wa Street, Causeway Bay
Hong Kong Island, Hong Kong SAR
hq@nnholdings.co