1. Introduction
This Privacy Policy is issued by SBA Global Trading Co. Limited, a business registered in Hong Kong that operates a freight consolidation desk at Rm 1511 15/F Tak Fung Industrial Centre Blk 2, 168 Texaco Rd, Tsuen Wan, Hong Kong - 999077, Hong Kong (HK). The policy is published by the developer responsible for this website, SBA Globaly, and it describes the practices that apply to this website and to the services delivered from the Tsuen Wan office.
We take the handling of personal data seriously because our work depends on trust. A shipper must be able to give us a supplier contact, a driver name and a consignee address without wondering how that information will be used. A buyer must be able to send a purchase order without fearing that it will be passed to a competitor. This document sets out in plain language what we collect, why we collect it, how long we keep it and what choices you have.
By using this website, sending an enquiry or engaging our consolidation services, you acknowledge that you have read this policy. If you do not agree with the practices described here, please do not submit personal data to us and contact the desk so that we can discuss an alternative arrangement where one exists.
This policy applies to the website at www.sbaglobal.mom and to personal data processed in connection with lot files, drayage bookings, customs paper sets and related correspondence. It does not apply to the internal systems of our clients or to the websites of third parties that we do not control.
2. Who Controls Your Data
For the purposes of applicable data protection law, the data controller is SBA Global Trading Co. Limited, with its registered place of business at Rm 1511 15/F Tak Fung Industrial Centre Blk 2, 168 Texaco Rd, Tsuen Wan, Hong Kong - 999077, Hong Kong (HK). The controller determines why personal data is collected and how it is used.
The privacy function is handled by the desk coordinator at the same address. Questions, requests and complaints may be sent by email to sales@sbaglobal.mom or raised by telephone on +14327992039 during published business hours. Please include the words Privacy Request in the subject line so that the message reaches the correct person without delay.
Where we act as a processor on behalf of a client, for example when a client instructs us to store a supplier list inside a lot file, the client remains the controller for that data and our processing is governed by the service agreement between us. In those cases, requests concerning the data should be directed to the client in the first instance, and we will assist the client as required by the agreement and by law.
3. Scope of This Policy
This policy covers personal data collected through the website contact form, by email, by telephone, in person at the Tsuen Wan office, through drayage documents, through customs filings and through the ordinary operation of a lot file. It also covers data that is generated as part of a commercial relationship, such as invoice contacts and account notes.
The policy does not cover data that is entirely anonymous or aggregated in a form that cannot be linked back to an individual. For example, a count of cartons handled in a month, or a summary of sailing punctuality, is not personal data when it carries no identifier. The policy also does not cover data held by shipping lines, airlines, port authorities or government agencies under their own rules, even where that data relates to a consignment we have arranged.
Where a client supplies us with personal data about its own employees, contractors or customers, the client is responsible for ensuring that it has a lawful basis to share that data with us. We process such data only for the purposes of the service and in line with the client instructions recorded in the lot file.
4. Categories of Personal Data
We collect only the categories of personal data that are needed to quote, plan, execute and document a consolidation service. The categories are described below in the order in which they usually arise in a lot file.
Contact and identity data
This includes names, job titles, employer names, business email addresses, business telephone numbers, office addresses and, where relevant, a messaging handle used for operational coordination. It may include a passport or identity document number where a customs authority requires the identity of a declarant or an authorised signatory.
Consignment and logistics data
This includes pickup addresses, factory contacts, gate appointment details, consignee names and delivery addresses, carton counts, weights, dimensions, photographs taken at intake, loading sequences, lashing positions, gate tag references and vessel or flight references. It may include driver names and vehicle registration numbers where these are needed to schedule a collection or a delivery.
Commercial and financial data
This includes purchase order references, invoice contacts, quotation records, payment status, bank details supplied by a client for settlement and remittance advice. Bank details are stored in a restricted area of our finance records and are not placed in the general lot file.
Technical data
This includes internet protocol addresses, browser type and version, device type, referring pages and pages visited on this website, together with the date and time of a visit. Technical data is collected in server logs and, where analytics are enabled, through a privacy-respecting measurement setup described later in this policy.
Correspondence data
This includes the content of emails, messages, call notes and meeting notes exchanged with the desk, together with any attachments that form part of an enquiry or a booking. Correspondence is retained so that the desk can answer follow-up questions and resolve a dispute about what was agreed.
5. How We Obtain Personal Data
Most personal data reaches us directly from the person concerned. You may fill in the contact form, send an email, call the desk or visit the office. In those cases you decide what to share, and we encourage you to share only what is needed for the enquiry.
We also receive personal data from clients and from parties acting on a client instruction. A client may give us a supplier contact, a consignee receiving clerk or a driver name so that a movement can be planned. A supplier may give us the name of the person who will release the cargo at the factory gate. A shipping agent may give us the name of a port representative who will attend an inspection.
Some data is created by our own operations. Intake photographs, measurement sheets, load checklists and delivery notes are produced by desk staff and carry the initials or names of the people who performed each step. This is a quality and accountability practice, and the resulting records are treated as personal data where they identify an individual.
6. Purposes of Processing
We process personal data for the following purposes, each of which is tied to a real operational need. We do not collect data simply because it might be useful one day.
- Responding to enquiries, preparing quotations and opening a lot file for a new shipment.
- Planning a consolidation layout, including measurement, stacking order and lashing positions.
- Booking drayage, confirming pickup and delivery windows and coordinating site access.
- Preparing and lodging customs declarations, packing lists, invoices and certificates.
- Issuing sailing confirmations, arrival notices and delivery appointments.
- Raising invoices, reconciling payments and maintaining financial records required by law.
- Handling claims, insurance notifications and disputes about damage, delay or loss.
- Maintaining the security of our office, our records and our information systems.
- Complying with legal, tax, customs and regulatory obligations that apply in Hong Kong and in destination jurisdictions.
- Sending operational updates to clients who have asked to receive them.
If we wish to use personal data for a purpose that is not listed above and that is not compatible with the original purpose, we will inform the person concerned and, where the law requires it, obtain consent before the new use begins.
7. Legal Bases for Processing
Where the law requires a legal basis, we rely on one or more of the following grounds.
Performance of a contract
Most processing is necessary to provide the service that a client has asked for. This covers the measurement of cargo, the booking of a sailing, the preparation of documents and the delivery of the consignment to the consignee.
Compliance with a legal obligation
We must keep certain records for customs, tax and accounting purposes, and we must respond to lawful requests from authorities. Where a law requires us to retain or disclose a record, we will do so and, where permitted, inform the person concerned.
Legitimate interests
We rely on legitimate interests for limited activities such as protecting our systems, preventing fraud, improving the clarity of our service documents and responding to business enquiries. We balance those interests against the rights and expectations of the individuals concerned and we limit the processing to what is necessary.
Consent
Where we rely on consent, for example for an optional marketing message, we will ask for it separately and clearly. Consent can be withdrawn at any time without affecting the lawfulness of processing that took place before the withdrawal.
8. Consent and Its Withdrawal
Consent is used sparingly. Operational correspondence about a shipment is handled under the contract and the legal obligation grounds, because a lot file cannot be managed without contacting the people involved. Optional activities, such as a periodic service bulletin, are offered on an opt-in basis.
You may withdraw consent at any time by writing to sales@sbaglobal.mom and stating which consent you wish to withdraw. The desk will action the request promptly and will confirm the change in writing. Withdrawal does not affect the lawfulness of earlier processing, and it does not prevent us from holding records that we are required to keep by law.
Where a client has provided consent on behalf of another person, the client is responsible for keeping that consent current. If we learn that a consent has been withdrawn, we will stop the relevant optional processing and update the lot file.
9. Freight and Consignment Data
Freight records are the operational core of the desk and they require a higher level of care than ordinary correspondence. A lot file may contain addresses, photographs, signatures, gate references and inspection notes. Access is limited to staff who need the file to perform their work, and access is recorded.
Photographs taken at intake serve a specific purpose: they prove the condition and count of the cargo at the moment it entered our control. We avoid capturing people in these photographs wherever possible. If a person appears in an intake photograph, the image is retained only for the claim and audit purposes described in this policy and is not used for any other purpose.
Signatures on delivery notes and gate passes are collected to confirm that a transfer took place. They are stored with the relevant movement record and are not used to build profiles of the individuals who signed. Where a consignee uses an electronic confirmation instead of a signature, the electronic record is treated in the same way.
Reefer temperature logs identify the equipment and the lot, not the individual who recorded the reading, but the initials of the recording officer may appear in the log. These initials are used for accountability and are handled as personal data.
12. Service Providers and Processors
We use a small number of service providers to operate the business. These may include an information technology support provider, a cloud storage provider, an accounting service and a telecommunications provider. Each provider is selected with care and is bound by a written agreement that limits its use of personal data to the services it provides to us.
Access by a service provider is restricted to what is needed for its task. A support engineer who resolves a mailbox issue does not receive access to the lot file archive. A cloud storage provider holds encrypted backups but does not have the keys needed to read the content. An accounting service receives invoice data but not intake photographs or supplier lists.
We review our providers periodically. If a provider cannot demonstrate adequate security or cannot accept the contractual limits we require, we replace it. Where a provider is located outside Hong Kong, the international transfer section of this policy applies.
13. International Transfers
Freight is an international activity, so personal data will sometimes cross a border. A delivery address in another country must be shared with the local agent who will perform the delivery. A customs declaration must be filed with the authority of the importing jurisdiction. A claim may require documents to be sent to an insurer based abroad.
Before transferring personal data to a party in another jurisdiction, we consider whether the destination provides an adequate level of protection, whether the receiving party is bound by a contract that includes appropriate safeguards, and whether the transfer is necessary for the performance of the service or for the establishment or defence of a legal claim.
Where a transfer requires additional safeguards, we use contractual clauses or another lawful mechanism. A client who wishes to know which jurisdictions are involved in a particular route may ask the desk, and the desk will provide the information recorded in the lot file. We do not transfer personal data to a party that we know will use it for an unrelated purpose.
14. Retention of Records
We keep personal data only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires. Retention periods are recorded in our records schedule and are applied consistently.
- General enquiries that do not become a booking are kept for up to twenty four months so that a later follow-up can be answered.
- Lot files, including the packing list, measurement sheet and load checklist, are kept for seven years after the final delivery, which matches the period during which a claim or an audit may arise.
- Customs and financial records are kept for the period required by the applicable tax and customs rules, which may exceed seven years.
- Reefer temperature logs are kept with the lot file for the same seven year period.
- Server logs are kept for a short operational period and are then deleted or aggregated.
- Marketing consent records are kept until the consent is withdrawn, plus a short period to evidence the withdrawal.
When a retention period ends, the record is deleted or irreversibly anonymised. Where deletion is not immediately possible because a record sits in a backup, the backup is protected from ordinary access and the record is removed when the backup cycle completes.
15. Security Measures
We apply technical and organisational measures that are proportionate to the sensitivity of the data and to the risk of harm if it were lost or misused. No system is perfectly secure, but the measures below are maintained and reviewed.
Access to the lot file archive is role based and requires a named account. Shared passwords are not permitted. Accounts are removed promptly when a person leaves the desk or changes role. Administrative access is limited to a small number of staff and is logged.
Data in transit between the desk and our service providers is encrypted. Data at rest in our cloud storage is encrypted, and backups are stored separately from the working copy. Office devices use full disk encryption and screen locks, and portable media are restricted.
Staff receive regular guidance on handling personal data, recognising phishing messages and reporting incidents. Physical records, such as signed delivery notes, are stored in a locked cabinet at the Tsuen Wan office and are accessible only to the desk coordinator and the finance officer.
We test our procedures periodically, including a review of access rights and a test restore of a backup. Findings are recorded and remedied. Security is treated as an operational process rather than a one-off project.
16. Your Privacy Rights
Subject to the law that applies to you, you may have the following rights in relation to your personal data.
Right of access
You may ask whether we hold personal data about you and request a copy of it, together with information about how it is used. We will respond within the period required by law and will explain any redactions made to protect the rights of other people.
Right to correction
You may ask us to correct inaccurate data. Because freight records are evidential, a correction is recorded as an amendment with a date and a reason rather than by silently overwriting the original entry.
Right to deletion
You may ask us to delete data that we no longer need and that we are not required to keep. Where a legal retention obligation applies, we will explain why the record must remain and will restrict its use to the purpose that requires it.
Right to restriction and objection
You may ask us to restrict processing while a dispute about accuracy is resolved, or object to processing based on legitimate interests. We will assess the objection and explain the outcome. You may also object to direct marketing at any time, and we will stop promptly.
Right to portability
Where processing is based on consent or contract and is carried out by automated means, you may request a copy of the data in a structured, commonly used format. We will provide the data that we hold in a form that can be read by another organisation.
To exercise a right, write to sales@sbaglobal.mom with the subject line Privacy Request. We may need to verify your identity before acting, and we will not charge a fee unless the law permits one for manifestly unfounded or excessive requests.
17. Marketing Communications
We do not buy contact lists and we do not send bulk marketing to addresses that we have not been given for that purpose. A client who asks to receive sailing bulletins or service notes will receive them on the channel and at the frequency agreed.
Every marketing message includes a simple way to stop receiving it. You may also reply to any message and ask the desk to remove you from the list. Operational messages about an active lot are not marketing and will continue for as long as the lot is in progress.
If we invite you to an event or send a seasonal note, the invitation is sent once unless you respond. We do not use a marketing message to collect additional personal data, and we do not sell or rent contact details to any third party.
18. Privacy for Children
Our services are provided to businesses and are not directed at children. We do not knowingly collect personal data from anyone under the age of eighteen through this website. The contact form asks for a business enquiry and is not designed for use by a minor.
If we learn that we have collected personal data from a child without an appropriate legal basis, we will delete the record promptly and confirm the deletion to the person who raised the matter. A parent or guardian who believes that a child has submitted data to us may contact the desk using the details at the end of this policy.
Where a consignment includes goods intended for a school or a family, the address and receiving contact are business data held by the client and are handled under the client relationship. We do not collect data about the end users of those goods.
19. Automated Decisions and Profiling
We do not make decisions that produce legal or similarly significant effects about an individual through automated processing alone. Our systems support the desk, but a person reviews a booking, a stack plan, a customs set and a claim before it takes effect.
Operational tools may sort enquiries by date or flag a missing document, and those flags help staff prioritise work. They do not decide whether a client is accepted or refused. Where a tool produces a suggestion, a member of the desk reviews it and remains accountable for the outcome.
If we introduce an automated feature that could materially affect an individual, we will document the logic, provide a route to request human review and update this policy before the feature is used in live operations.
20. Third Party Websites
This website may contain links to the websites of shipping lines, port authorities, customs agencies or industry bodies. Those websites are operated by other organisations and are governed by their own privacy notices. We are not responsible for the content or the data practices of a site that we do not control.
We encourage you to read the privacy notice of any external site before submitting personal data to it. A link from our site is a convenience, not an endorsement of the way another organisation handles your information.
If you reach our site from a partner page, the partner may have its own cookie or measurement setup. That setup is outside our control, and any questions about it should be directed to the partner.
21. Data Breach Response
We maintain a written response plan for a personal data breach. The plan covers containment, assessment, notification and remediation. A breach is logged when it is discovered, and the log records the facts, the decisions taken and the people involved.
Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority within the time required by law and, where the law requires it, notify the affected individuals directly. Notification will describe the nature of the breach, the likely consequences and the measures taken or proposed.
After containment, the desk reviews what happened and changes the process or the system that allowed it. A breach is treated as a signal that a control has failed, and the response is not complete until that control has been corrected.
22. Changes to This Policy
This policy is reviewed at least once a year and whenever a material change is made to our services, our systems or the law that applies to us. The effective date at the top of the page is updated when a new version is published.
Where a change is material, we will take reasonable steps to inform clients and other affected people before the change takes effect. The updated policy is posted on this page, and the previous version is retained in our records so that the position at a given date can be established.
Continued use of the website or of the services after a change takes effect indicates acceptance of the updated policy. If a change requires consent under the law, we will ask for it separately rather than relying on continued use.
23. Complaints and Escalation
If you believe that we have mishandled your personal data, please contact the desk first so that the matter can be examined. Write to sales@sbaglobal.mom with the subject line Privacy Complaint and include the facts, the dates and any reference number that you have.
We will acknowledge the complaint promptly, investigate it and provide a written response within the period required by the applicable law. If we need more time to complete a thorough investigation, we will explain why and give an expected date for the response.
If you are not satisfied with the response, you may escalate the matter to the privacy regulator in the jurisdiction that applies to you. In Hong Kong, the relevant authority is the Office of the Privacy Commissioner for Personal Data. We will cooperate with any lawful inquiry and will provide the records that the regulator requires.
24. Contact for Privacy Matters
For any question about this policy, a request to exercise a right or a report of a possible breach, please use the details below. The desk answers privacy correspondence during published business hours, Monday to Friday from 09:00 to 18:00 Hong Kong time.
SBA Global Trading Co. Limited
Rm 1511 15/F Tak Fung Industrial Centre Blk 2, 168 Texaco Rd, Tsuen Wan, Hong Kong - 999077, Hong Kong (HK)
Email: sales@sbaglobal.mom
Phone: +14327992039
This policy is published by SBA Globaly, the developer of this website, on behalf of SBA Global Trading Co. Limited. It describes the practices of the consolidation desk and should be read together with our Terms of Service, which govern the commercial relationship between the company and its clients.