Privacy Policy

This Privacy Policy explains how CITYLINK DIGITAL TRADING LIMITED ("Aurea", "we") collects, uses, shares and protects your personal data when you use Aurea. We comply with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the "PDPO") and other applicable data-protection laws. By using Aurea, you acknowledge that you have read and understood this policy.

Last updated: 22 June 2026.

Who we are. Aurea is operated by CITYLINK DIGITAL TRADING LIMITED, a company incorporated in Hong Kong SAR. For any privacy question or request, contact us at support@klootn.com.

Data we collect. Account data — your email and a password, which we store only as a salted hash. Order data — the details you provide at checkout, including your delivery email, game account or player ID, server/region, the products ordered and order status. Payment data — limited metadata returned by our payment providers (such as a transaction reference, payment status, and the card brand and last four digits where provided); we do not store full card numbers. Technical data — IP address, device and browser information, and activity logs collected automatically. Communications — the messages you send us and our replies.

How we use it. To create and secure your account; process, deliver and support your orders; prevent fraud and abuse; send you transactional messages such as order confirmations and delivery notices; comply with our legal, tax and accounting obligations; and maintain and improve the store. Where the law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in running and securing the store, your consent (for optional cookies and any marketing), and compliance with legal obligations.

Cookies. We use essential cookies to keep you signed in, hold your cart and operate the store, and — only with your consent — optional analytics cookies to understand and improve how the store is used. You can manage optional cookies through the cookie banner or your browser.

Who we share with. We do not sell your personal data. We share it only with service providers who help us run the store — payment providers, email and messaging providers, and hosting and infrastructure providers — under confidentiality obligations and only to provide services to us. We may also disclose data to professional advisers, auditors or authorities where required by law, or to a successor entity in a merger, acquisition or sale of our business.

Cross-border transfers. Some providers may process data outside Hong Kong. Where we transfer personal data across borders, we take reasonable steps to ensure it is protected to a standard consistent with the PDPO.

Retention. We keep account data while your account is active, and order and transaction records for as long as needed to provide the service and to meet legal, tax and accounting requirements (typically up to seven years), after which we delete or anonymise them.

Security. We use industry-standard measures including hashed passwords, encrypted transport (HTTPS/TLS) and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Keep your password confidential and contact support@klootn.com immediately if you believe your account has been compromised.

Your rights. Under the PDPO you may request access to, or correction of, your personal data, withdraw consent for optional cookies or marketing, and delete your account from your account page. To make a request, contact support@klootn.com; we may need to verify your identity first.

Children. The store is intended for users aged 18 or over. We do not knowingly collect data from children; if you believe a child has provided us with data, contact support@klootn.com.

Changes. We may update this policy and will post the revised version here with a new "last updated" date. If you are not satisfied with how we handle your data, you may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).