Privacy Notice
Effective Date: 01.07.2026
Table of Contents
Introduction
This privacy notice ("Privacy Notice") for Flipnames Limited (Business Registration No. 75424130), a company incorporated in Hong Kong ("Slimlink", "we", "us", or "our") describes how and why we might collect, store, use, and/or share ("process") your information when you use our services such as URL shortening, custom-branded links, link management, link-in-bio, QR code, and analytics products and services ("Services"), when you:
- Visit our website at https://slimlink.com, or any website that links to this Privacy Notice
- Engage with us in other related ways, including sales, marketing, or events
How this Privacy Notice is organised. We are a Hong Kong data user and our handling of personal data is governed by the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO"). Sections 1–13 of this Notice apply to all users, wherever located, and reflect the PDPO's requirements as our global baseline. Because our Services are available worldwide, users in certain regions have additional rights under their local laws: Addendum A applies to users in the European Economic Area, the United Kingdom and Switzerland (GDPR / UK GDPR). Nothing in the addenda reduces the protections in the core sections.
By using the Services, you acknowledge that your personal data will be processed as described in this Privacy Notice and, where required by law (e.g., for non-essential cookies and for direct marketing), we will seek your consent first.
Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at [email protected].
SUMMARY OF KEY POINTS
Who is responsible for your personal data? For our websites, accounts, billing, and direct communications, Flipnames Limited ("Slimlink") is the data user under the PDPO and, where the GDPR or UK GDPR applies, the data controller. For analytics relating to clicks on our Clients' links, we act as our Clients' agent (under the PDPO) or data processor (in terms of GDPR or UK GDPR) and process personal data on the Client's instructions.
Contact:
[email protected]
general enquiries: [email protected]
Address: Flipnames Limited (Business Reg. No. 75424130), Rm 7B, One Capital Place, 18 Luard Road, Wan Chai, Hong Kong.
What personal data do we process? We may process personal data depending on how you interact with Slimlink and the Services, the choices you make, and the products and features you use.
Do we process sensitive personal data? We do not process sensitive personal data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person's sex life or sexual orientation.
Do we receive information from third parties? We may receive information from public databases, marketing partners, social media platforms, and other outside sources.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with the law.
Do we use your data for direct marketing? Only with your consent. We will not use your personal data in direct marketing unless you have consented or indicated no objection, and you may opt out at any time, free of charge. We do not provide your personal data to third parties for use in their own direct marketing. See Sections 2 and 10.
In what situations and with which types of parties do we share personal data? We may share information in specific situations and with specific categories of third parties. We do not sell your personal data.
How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure.
What are your rights? All users have the rights set out in Section 10, including access to and correction of their personal data. Users in the EEA, UK and Switzerland have some additional rights in Addendum A.
How do you exercise your rights? The easiest way to exercise your rights is by contacting us at [email protected]. We will consider and act upon any request in accordance with the PDPO and other applicable data protection laws, including the GDPR where it applies.
1. WHAT INFORMATION DO WE COLLECT?
Personal Data You Disclose to Us
We gather personal information that you voluntarily provide when you register on our Services, show interest in our products or Services, participate in activities on the Services, or otherwise contact us.
The personal data we collect depends on the context of your interactions with us and the Services, the choices you make, and the features you use. Usually, we collect the following data, necessary for the Service provision and account registration:
- First name, last name, email address, password, payment methods used
However, the personal information we collect may also include:
- Identification data: IP address, user ID
- Interaction data: history of our email exchanges and support tickets history, time and date of specific actions performed in our Service like link created, user created, etc
- Communication data: data related to the processing of emails and communications sent to you, such as timestamps and dates
Important: Please avoid including any personal or sensitive data in link slugs, titles, tags, QR payloads, or campaign parameters. See "Client's Content & Naming Conventions" for details.
Processing End-User Data on Behalf of Our Clients
We provide the Services to our clients ("Clients"). Such services also may include analytical products such as collecting information about visitors or customers of our Clients ("End-Users"), visiting the Client's websites / shortened links.
When the End-Users access the Client's websites / shortened links, they may be briefly redirected through our domain, where limited personal data of such End-Users – namely, (i) IP address, (ii) information about type of device/browser/device's operating system, (iii) country of location – is collected.
We process this data solely at the direction of our Clients, who are the "data controllers" under the GDPR and the "data users" under the PDPO; in that context we act as a "data processor" (GDPR) and as the Client's agent/processor (PDPO).
We do not determine the purposes or means of this processing and will use such data only as instructed by our Clients and strictly in accordance with our contractual obligations. If you are the End-User of one of our Clients and wish to exercise your data subject rights (e.g., access, correction, erasure), or have questions about how your data is processed, please consult the Client's privacy notice or contact the Client directly.
Client's Content & Naming Conventions
To minimise the risk of unintended disclosure, Clients must not include any personal data — especially sensitive data or unique identifiers — in links (custom link addresses), titles, tags, QR payloads, UTM parameters, or other metadata created or uploaded in the Services. These elements can be publicly visible or captured in logs, referrers, or third-party systems.
Slimlink treats any such information as Client's Data processed solely on the Client's instructions, and the Client is responsible for ensuring a lawful basis, transparency, and compliance with applicable law.
Information Automatically Collected
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services and for our internal analytics and reporting purposes. Like many businesses, we also collect information through cookies and similar technologies. More details can be found in our Cookie Policy
The information we collect automatically may include:
- Log and Usage Data: service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services. This log data may include your IP address, device information, the pages visited on our website, the website from which our website was accessed, subsequent websites accessed via our website, the transmitted amount of data, the access status, the operating system used, browser type, settings and version, and information about your activity in the Services (such as date/time stamps, pages and files viewed, searches, and other actions).
- Device Data: information about your computer, phone, tablet, or other device used to access the Services. This data may include IP address (or proxy server), device and application identification numbers, approximate location, browser type, hardware model, internet service provider and/or mobile carrier, operating system, and system configuration information.
- Location Data: by default we collect only imprecise location derived from your IP address, which is necessary for analytics, fraud prevention and security. We collect precise location data (e.g., GPS) only if you enable a specific feature that requires it and give your prior consent through your device settings; you can withdraw that permission at any time in your device settings. Declining precise location does not affect your use of the core Services.
Temporary storage of data is necessary for website visits to enable delivery of the website. Further storage of log files ensures website functionality and IT system security (especially to prevent DDoS attacks). Unless specified otherwise, your IP address will be shortened as soon as possible so that identification is no longer possible. The legal basis for temporary storage is to provide you with our website to fulfill a contract or process pre-contractual measures. Further storage with a shortened IP address is based on our legitimate interest to protect our IT systems. Personal evaluation of the data, especially for marketing purposes, does not occur without prior consent.
We use Google reCAPTCHA, a service provided by Google LLC, to distinguish human users from bots and to protect our Services against automated abuse. reCAPTCHA analyses signals such as your IP address, browser type and settings, device information, cookies, and your interactions with our pages (for example, mouse movements and time spent), and transmits this information to Google, which returns a score indicating whether the activity is likely automated. This may involve the transfer of your data to Google servers outside Hong Kong, including in the United States. We use the resulting score solely to maintain the security and integrity of our Services; we do not use it for marketing or profiling. Your use of reCAPTCHA is also subject to the Google Privacy Policy ( https://policies.google.com/privacy ) and Google Terms of Service ( https://policies.google.com/terms ).
Account Registration Data
You may register a Client account. During registration, you must provide personal data marked as "mandatory field." This generally includes:
- First name, last name, email address, password
If registering as a company, we also collect:
- Company/organization name
This data is used for Client identification and account administration. It is voluntary for you to supply personal data to us; however, without the data marked as mandatory we may be unable to open or maintain your account or provide the Services. You may voluntarily provide further data categories, which help us with additional verification and quicker communication. You will choose a User-ID and a password to log into your account. Ensure that no unauthorized person gains access to your login credentials.
Payment Data
We utilize various payment options from third-party payment providers. If you select one of these options, your payment details will be forwarded to the respective payment service provider for processing. These third-party providers manage your personal data as independent controllers according to their privacy policies. This transfer is necessary for fulfilling the contract and for secure payment processing and fraud prevention. We take reasonable steps to engage reputable payment providers.
Sensitive Information
We do not process sensitive information.
All personal data that you provide to us must be truthful, complete, and accurate, and you must notify us of any changes to such personal data.
2. HOW DO WE PROCESS YOUR INFORMATION?
We handle your data to provide, enhance, and manage our Services, communicate with you, ensure security and fraud prevention, and comply with legal requirements. We may also use your information for other purposes with your consent.
We collect and use your personal data only for the purposes set out in this Privacy Notice or purposes directly related to them; we will not use your personal data for a new, unrelated purpose without your prescribed consent.
We process your personal data for various reasons, based on how you interact with our Services, including:
Account Creation and Management: to help you create and log in to your account, and to maintain your account's functionality.
Service Delivery: to provide the services you have requested.
Customer Support: to respond to your inquiries and resolve any issues related to the services you have requested.
Administrative Communications: to send you important information about our products, services, changes to our terms and policies, and other similar notifications. These service communications are not direct marketing.
Order Fulfillment: to process and manage your orders, payments, returns, and exchanges made through our Services.
User-to-User Communications: if you use any features that allow communication with other users.
Feedback Requests: to request feedback and to contact you about your experience with our Services.
Marketing Communications (with your consent): We intend to use your name and contact details (email address) to send you direct marketing about our own products and services, namely: URL shortening, custom-branded links, link management, link-in-bio, QR code and analytics products, and related features, offers, discounts and events. We may not so use your personal data unless we have received your consent or an indication that you do not object. We do not provide your personal data to any other person for use in that person's direct marketing.
Personalised Content and Advertising (with your consent): With your consent (for example, through your cookie preferences), we may use your information to create and display personalised content and advertising tailored to your interests and approximate location. You can withdraw this consent at any time through our cookie settings. For more information, see our Cookie Policy .
Bot Protection: to protect our Services against automated abuse, such as bots or fraudulent clicks, as described in Section 1.
Service Protection: to ensure the security of our Services, including monitoring for fraud.
Usage Analysis: to better understand usage patterns and improve our offerings.
Marketing Effectiveness: we may use aggregated information to assess the success of our marketing and promotional efforts and make them more relevant.
Vital Interests: when necessary to protect an individual's vital interests, such as preventing harm.
This Privacy Notice does not apply to the personal data we process on behalf of our Clients. In those cases, the Client with whom we have entered into a data processing agreement is responsible for your personal data, and we merely process your data on their behalf according to their instructions. To understand more about our Clients' privacy practices, you should read their privacy policies and direct any questions to them.
3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL DATA?
We may share personal data with the following categories of recipients:
Service providers acting on our behalf, including providers that support IT systems, communication tools and other business support services.
Professional advisers, including lawyers, auditors, accountants, tax advisers, consultants and insurers, where this is necessary for legal, accounting, audit, insurance, tax, compliance or business purposes.
Group companies and affiliated companies, where this is necessary for internal administration, management reporting, business operations.
Public authorities, courts, regulators and law enforcement bodies, where this is required by applicable law, regulation, court order, legal process, regulatory request or other lawful request.
Counterparties and advisers in corporate transactions, including potential or actual buyers, investors, successors, group companies, external advisers and other relevant parties, where this is necessary in connection with a merger, acquisition, restructuring, financing, transfer of business, sale of assets or similar corporate transaction.
We do not sell your personal data, and we do not provide your personal data to any third party for use in that party's own direct marketing. Where we engage service providers to process personal data on our behalf (within or outside Hong Kong), we adopt contractual or other means to require them to protect the data against unauthorised or accidental access, processing, erasure, loss or use, to use it only for our instructed purposes, and not to retain it longer than necessary.
4. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?
We are not accountable for the security of any information you share with third parties that we link to or who advertise on our Services but are not affiliated with us.
Our Services, including any offer walls, may contain links to third-party websites, online services, or mobile applications and/or include advertisements from third parties not affiliated with us. We make no guarantees regarding these third parties, and we will not be responsible for any loss or damage resulting from your use of these third-party websites, services, or applications. The presence of a link does not imply our endorsement. Information collected by third parties is not covered by this Privacy Notice. You should review the privacy policies of such third parties and contact them directly if you have any questions or concerns.
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
We employ cookies and similar tracking technologies to access or store information. Detailed information about our use of these technologies and how you can opt out of certain cookies is provided in our Cookie Policy
6. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
We operate globally and may transfer information for the purposes outlined in this Privacy Notice to our trusted partners and service providers who have servers outside Hong Kong and the European Economic Area (EEA), including in the United States.
We transfer personal data only for the purposes described in this Privacy Notice, and we adopt contractual safeguards consistent with the Privacy Commissioner's Recommended Model Contractual Clauses to require overseas recipients to protect your personal data, prevent unauthorised access, and not retain it longer than necessary.
For any transfers of personal data from the EEA, Switzerland, or the United Kingdom, we implement appropriate safeguards, which may include standard contractual clauses approved by the European Commission — see Addendum A. We will take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.
7. HOW LONG DO WE KEEP YOUR INFORMATION?
We retain your information for as long as necessary to achieve the purposes outlined in this Privacy Notice, unless a longer period is required by law (e.g., for tax, accounting, or other legal obligations).
Once we no longer have a legitimate business need to process your personal information, we will delete or anonymize it. We take all practicable steps to erase personal data that is no longer required for the purpose for which it was used, unless erasure is prohibited by law or is not in the public interest.
8. HOW DO WE KEEP YOUR INFORMATION SAFE?
We have put in place appropriate and reasonable technical and organizational safeguards designed to protect the security of any personal data we process. We take all practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use, having regard to the kind of data and the harm that could result. However, despite our efforts to secure your information, no method of electronic transmission over the Internet or method of information storage can be guaranteed to be 100% secure. You should access the Services only within a secure environment.
9. DO WE COLLECT INFORMATION FROM MINORS?
We do not intentionally collect data from or target our marketing to children under the age of 18. By using the Services, you affirm that you are at least 18 years old or that you are the parent or guardian of a minor and consent to their use of the Services. If we discover that we have collected personal information from users under the age of 18, we will deactivate the account and take reasonable steps to promptly delete the data from our records. If you become aware of any data we may have gathered from children under 18, please contact us at [email protected].
10. YOUR PRIVACY RIGHTS AND CHOICES
The rights in this Section apply to all users of our Services, wherever located, and reflect our obligations as a Hong Kong data user under the PDPO. If you are in the EEA, the United Kingdom, or Switzerland, please consult also Addendum A of this Privacy Notice.
Access and correction
You have the right to ascertain whether we hold personal data about you, to request access to your personal data, and to request the correction of inaccurate or incomplete data. We may need to verify your identity and may ask for additional details to locate your data. We will respond to a data access or correction request within 40 days. We may charge a fee for a data access request, which will not be excessive; correction requests are free of charge. If we refuse a request in whole or in part, we will give you written reasons for the refusal.
Deletion
You can request deletion of your personal data if it is no longer needed for the purposes it was collected, if we lack a legal basis for using it, if we are obligated by law to delete it, if you withdraw consent, or if you object to processing and there are no overriding reasons for it. This right is not absolute, and we may need to retain some information for legal obligations or administrative purposes.
Direct marketing opt-out
You may at any time, and without charge, require us to cease using your personal data in direct marketing.
Withdrawal of consent
Where our processing is based on your consent, you may withdraw that consent at any time by written notice. Withdrawal does not affect processing that occurred before it takes effect.
Filing a complaint
If you have concerns about how we process your personal data, contact us first at [email protected] and we will try to resolve your issues. You may also complain to a supervisory authority:
Hong Kong — Office of the Privacy Commissioner for Personal Data (PCPD): website https://www.pcpd.org.hk; complaint hotline (852) 2827 2827; email [email protected]; address: Unit 1303, 13/F, Dah Sing Financial Centre, 248 Queen's Road East, Wanchai, Hong Kong.
Users in the EEA, the United Kingdom, or Switzerland: see Addendum A for your local authorities.
11. CONTROLS FOR DO-NOT-TRACK FEATURES
Many web browsers and some mobile operating systems and applications offer a Do-Not-Track ("DNT") feature or setting. Currently, there is no universally accepted standard for recognizing and implementing DNT signals. Therefore, we do not respond to DNT browser signals or any other mechanism that automatically communicates your preference not to be tracked online. If a uniform standard for online tracking is established and we are required to comply, we will update you about that practice in a revised version of this Privacy Notice.
12. DO WE MAKE UPDATES TO THIS NOTICE?
We may periodically update this Privacy Notice. The new version will be identified by a "Revised" date and will become effective as soon as it is posted. If we make significant changes, we may notify you by prominently posting a notice of the changes or by sending you a direct notification. Where any change involves using your personal data for a new purpose not directly related to the purposes described when your data was collected, we will obtain your consent as required by law before doing so. We recommend that you review this Privacy Notice regularly.
13. HOW CAN YOU CONTACT US?
If you have questions or comments about this Privacy Notice or you wish to file a complaint/request, you may contact us:
- By email: [email protected] (privacy matters, data access/correction requests) or [email protected] (general enquiries)
- By post: Flipnames Limited, Rm 7B, One Capital Place, 18 Luard Road, Wan Chai, Hong Kong
ADDENDUM A — ADDITIONAL PROVISIONS FOR THE EEA, THE UNITED KINGDOM AND SWITZERLAND (GDPR / UK GDPR)
This Addendum applies if you are located in the European Economic Area, the United Kingdom or Switzerland. It supplements — and does not reduce — the core sections of this Privacy Notice. Where the GDPR or UK GDPR applies, Flipnames Limited is the data controller for the processing described in this Privacy Notice (other than processing carried out on behalf of our Clients, for which the Client is the controller).
Legal bases for processing
We process your personal data only when we have a valid legal basis to do so:
Consent: we may process your data if you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time.
Performance of a Contract: when necessary to fulfill our contractual obligations to you, including providing our services or acting on your requests before entering into a contract.
Legitimate Interests: when reasonably necessary to achieve our legitimate business interests and these interests do not override your rights and freedoms — for example, to:
- Analyze how our services are used to improve them and enhance user engagement
- Diagnose problems and prevent fraudulent activities
- Understand how users interact with our products and services to improve user experience
- Detect and prevent malicious automated access attempts (e.g., bot traffic)
Legal Obligations: when necessary to comply with our legal obligations.
Additional rights under the GDPR / UK GDPR
In addition to the rights in Section 10, you have the right to:
Restrict Processing: request that we limit the processing of your data in specific situations — if you contest its accuracy, if the processing is unlawful but you oppose deletion, if we no longer need the data but you require it for legal claims, or if you object to processing pending verification of our legitimate grounds.
Object to Processing: object to processing based on our legitimate interests on grounds relating to your particular situation, and object at any time, free of charge, to processing for direct marketing purposes.
Data Portability: receive a copy of your data in a structured, commonly used, machine-readable format and ask us to transmit it to another controller, where processing is based on your consent or a contract with you.
Erasure: request the deletion of your personal data in the circumstances set out in Article 17 GDPR, as described in Section 10.
International transfers
For transfers of personal data from the EEA, Switzerland, or the United Kingdom to countries without an adequacy decision, we implement appropriate safeguards, which may include the standard contractual clauses approved by the European Commission.
EU Data Protection Authorities (DPAs): https://edpb.europa.eu/about-edpb/about-edpb/members_en
Swiss Federal Data Protection and Information Commissioner (FDPIC): https://www.edoeb.admin.ch/edoeb/en/home.html
Information Commissioner's Office (United Kingdom): https://ico.org.uk/make-a-complaint/