Privacy policy

Updated 8 November 2026. This policy covers Drop Your Take (https://dropyourtake.com) and the shared polling service described below.

Who is responsible?

OM Group Limited is the controller under the GDPR where applicable and data user under Hong Kong's Personal Data (Privacy) Ordinance. Contact talk@dropyourtake.com or Privacy Contact at the address above.

EU privacy contact and representation

Ocean Material Solutions GmbH, Graumannsweg 61, 22087 Hamburg, Germany; Amtsgericht Hamburg, HRB 194421; support@oceanmaterial.com. Address requests to “EU Data Protection Representation for OM Group Limited”. The company is the appointed EU privacy contact and, where Article 27 GDPR applies, representative. It is not the website operator, controller or Data Protection Officer.

Hosting and security

Cloudflare delivers and secures these websites, provides the D1 database and Turnstile abuse protection. It necessarily processes network information including IP addresses and technical request data. Turnstile checks may process browser and device signals. We use security measures to operate the service and protect the integrity of participation, based on legitimate interests (Article 6(1)(f) GDPR where applicable). Cloudflare privacy information.

Voting and shared data

When you vote, we store your answer, poll ID, originating brand, timestamp and a pseudonymous browser identifier. A keyed digest of the IP address limits repeated voting across both websites. The application does not store the raw IP address in D1. Cloudflare may process it for delivery and security. Pseudonymisation is not complete anonymity.

After an accepted vote, a necessary, HttpOnly cookie named take_voter helps prevent repeated voting in that browser for up to 180 days. Each domain has its own cookie. Clearing cookies or using another device can evade browser checks; a shared-network cap provides a further imperfect check. We do not link votes to email subscriptions. Neither individual answers nor identifiers are made public. Only combined answer totals are shown.

We retain pseudonymous vote records for up to 180 days. Daily maintenance then removes browser and network digests and reduces timestamps to the day, preserving the answer counts without those identifiers. Temporary rate-limit entries expire within two hours and are cleared during maintenance. Backups follow Cloudflare's recovery cycles. Contact us with a privacy request; without an identifying cookie it may not be possible to identify your specific vote.

Optional aggregate analytics

Analytics is off until you choose “Allow aggregate analytics”. If enabled, we count page views, recognised search-engine arrivals, share-link requests, successful share-sheet actions, copied share links and visits through the shared campaign link. Only day, website, event category and count are stored; no full referrer, search query, email or persistent visitor profile is stored in the analytics table. These totals are not unique people or proof of a conversation, delivered share or new voter. No advertising pixels, Google Analytics or third-party analytics beacon is loaded.

Your preference is saved in localStorage as take_privacy for up to 180 days. Use “Privacy choices” in the footer to change it anytime. Withdrawal stops future optional events; already aggregated counts cannot be attributed to you. Aggregate totals may be retained to compare performance. Optional measurement relies on consent (Article 6(1)(a) GDPR where applicable).

Optional email updates

Voting never subscribes you. Where the sign-up form is available, you may separately request new-question emails from this brand using an unticked consent checkbox. We store the email, chosen brand, request and confirmation times and consent-text version in a separate table. Confirmation is required within 48 hours; unconfirmed requests are removed during maintenance. Resend delivers the confirmation email when enabled; updates will only go to confirmed subscribers. Withdraw consent using the unsubscribe link in an email or contact us. We remove the active subscription when you unsubscribe. Resend privacy information.

Contacting us and retention

Email addressed to talk@ is routed by Cloudflare to the operator's mailbox. We process correspondence to answer requests and, where needed, establish or defend legal claims (legitimate interests), or take steps requested before a contract. Unneeded messages are deleted; general completed enquiries are normally retained no longer than 24 months unless a legal duty or dispute requires longer. Technical logs, recovery copies and backups have separate provider cycles.

International processing and recipients

OM Group Limited is established in Hong Kong. Cloudflare and enabled email providers operate internationally, including in the United States. Hong Kong has no EU adequacy decision. Applicable controller/processor terms and transfer safeguards, including contractual mechanisms where required, govern covered provider transfers; further information can be requested from us. Visiting the site is not treated as consent to an international transfer. Access is limited to authorised personnel and service providers for the stated purposes. We do not sell individual votes or contact details.

Your rights

Where GDPR applies, you may request access, rectification, erasure, restriction or portability as applicable, object to processing based on legitimate interests, withdraw consent and complain to your competent supervisory authority. Hong Kong PDPO rights include access and correction and a complaint to the Privacy Commissioner for Personal Data. We do not make decisions producing legal or similarly significant effects about you through automated processing. Providing a vote or email is voluntary.