Last updated: 9 May 2026
1. Who we are and the scope of this Policy
The Bay is a wholly-owned brand of Ruca Limited (“Ruca”, “we”, “us”, or “our”), a company incorporated in Macao. While The Bay sits within Ruca Limited, editorial decisions are made independently by The Bay’s editorial leadership, in line with the principles set out in The Bay’s Ethics Policy.
For the purposes of data protection law, Ruca Limited is the data controller for personal data collected through thebay.mo (the “Site”). This Policy explains how we collect, use, share, and protect personal data, and what your rights are.
This Policy applies to personal data collected through the Site and our related editorial activities. It does not apply to third-party websites, services, or platforms that may be linked from or embedded in the Site.
The Bay’s audience extends across the Greater Bay Area, with Macao as our home base, and to readers beyond the region. This Policy is structured under the laws of Macao and references the Macao Personal Data Protection Act (Law No. 8/2005). Readers in other jurisdictions may have additional rights under their local data protection laws — see Section 11.
2. Personal data we collect
2.1 Information collected automatically when you visit the Site
When you access thebay.mo, we and our processors automatically collect certain information about your visit. This includes:
• Server log information: IP address, browser type and version, operating system, device type, referring website, pages requested, and timestamps;
• Information collected through cookies and similar technologies (see Section 4);
• Aggregated and anonymised information about how you interact with the Site, collected through Google Analytics 4 (provided via Site Kit by Google);
• Information processed by Cloudflare for content delivery, performance, and security purposes (including IP address and request metadata).
We do not actively collect names, email addresses, or other directly identifying information from anonymous visitors.
2.2 Information you provide as a reader or contributor
If you contact us by email, send story tips, submit photographs, write to us about a correction, or otherwise communicate with the editorial team, we will receive the personal data contained in those communications (typically your name, email address, and the content of your message). The use of such submissions is also governed by Section 10 of the Terms and Conditions.
3. How we use personal data
We use personal data for the following purposes, on the legal bases stated:
• To operate the Site — including delivering content, maintaining performance, ensuring security, and detecting and preventing fraud or abuse. Legal basis: our legitimate interests in operating a secure, reliable publication.
• To improve the Site and our journalism — including analysing aggregated reader behaviour, understanding what content is read and shared, and identifying improvements to design and content strategy. Legal basis: our legitimate interests in improving the publication.
• For editorial and journalistic purposes — including investigating, preparing, and publishing news and feature content, which may include personal data of public figures, sources, and people who are part of the events we cover. Legal basis: our legitimate interests in producing journalism in the public interest, subject to the principles in our Ethics Policy.
• For commercial reporting and advertising sales — including the sharing of aggregated, anonymised audience data with current and prospective advertisers, sponsors, and commercial partners. We do not share individual reader data for this purpose. Legal basis: our legitimate interests in operating our business.
• To meet legal obligations — including responding to lawful requests from regulators, law enforcement, or courts, and complying with tax, accounting, and other statutory obligations. Legal basis: compliance with legal obligations.
We do not engage in profiling or automated decision-making that produces legal or similarly significant effects on individuals.
4. Cookies and tracking technologies
The Site uses cookies and similar tracking technologies. Cookies are small files placed on your device that allow the Site to recognise your browser and remember information about your visit.
We use four categories of cookies:
• Strictly necessary — required for the Site to function (for example, security cookies and the cookie consent record itself). These cookies cannot be disabled and do not require consent.
• Functional — improve the experience of using the Site (for example, remembering your preferences). Set with consent.
• Analytics — help us understand how visitors use the Site, primarily through Google Analytics 4. Set with consent.
• Advertising — currently not in use on the Site. If we introduce advertising cookies in the future, we will update this Policy.
Consent for non-essential cookies is managed through our Consent Management Platform (CookieYes), which presents a banner on your first visit allowing you to accept or reject categories of cookies, and to change your preferences at any time.
Cookies set on the Site
The Site currently sets the following cookies. A current and detailed list is also available through the CookieYes preference centre on the Site.
Strictly necessary
• cookieyes-consent (CookieYes, 1 year): stores your consent preferences so that they are respected on subsequent visits to the Site. Does not collect or store any personal information about Site visitors.
• __cf_bm (Cloudflare, approximately 30 minutes): bot management and security. Set by Cloudflare to distinguish between humans and automated traffic. Does not store identifying information about Site visitors.
Functional
No functional cookies are currently in use on the Site.
Analytics (set with your consent)
• _ga (Google, approximately 13 months): used by Google Analytics to distinguish unique visitors. Stores a randomly generated identifier and does not store personally identifying information directly.
• _ga_<measurement ID> (Google, approximately 13 months): used by Google Analytics 4 to store and count page views for the Site’s analytics property.
Performance
No performance cookies are currently in use on the Site.
Advertising
No advertising cookies are currently in use on the Site.
Cookies set by embedded social media content
When you load a page that includes embedded social media content (for example, a YouTube video, an Instagram post, or an X/Twitter post), the relevant platform may set its own cookies on your device, depending on your consent preferences and your existing relationship with that platform. Examples include cookies set by Google/YouTube (such as VISITOR_INFO1_LIVE, YSC), Meta/Facebook and Meta/Instagram (such as fr, datr), X/Twitter (such as guest_id, twid), and LinkedIn (such as li_*, lidc, bcookie). These cookies are governed by those platforms’ own privacy policies, not this Policy. You may use the cookie consent banner, your browser settings, or platform-specific privacy controls to limit the data shared with these platforms.
5. Third-party processors and international data transfers
To operate the Site, we engage the following third-party processors, each of whom is bound by data processing terms:
• ICDSoft (hosting provider, headquartered in Bulgaria, with our hosting infrastructure in Hong Kong) — provides the server infrastructure that hosts thebay.mo.
• Cloudflare (headquartered in the United States) — provides content delivery, performance optimisation, and security services. Cloudflare’s edge network is global, meaning that requests from your browser may be processed at edge locations in various jurisdictions before reaching the origin server in Hong Kong.
• Google LLC (headquartered in the United States) — provides Site Kit, Google Analytics 4 (analytics), and Search Console (verification and search-indexing performance). Search Console does not set visitor-side cookies. Google Analytics processes IP-truncated information about Site visits.
• CookieYes Limited (headquartered in the United Kingdom) — provides cookie consent management and consent records.
• Embedded platform providers (X, Meta/Facebook, Meta/Instagram, YouTube/Google, LinkedIn) — when you interact with embedded social media content on the Site, those platforms collect information directly from you under their own privacy policies.
International data transfers in connection with the Site involve processing in or transit through Hong Kong, the United States, the European Union, the United Kingdom, and other jurisdictions where our processors operate. We rely on contractual safeguards with each processor to ensure that personal data transferred internationally remains protected.
6. Embedded social media content
The Site embeds content from social media platforms — including Instagram, YouTube, Facebook, X and others. When you load a page that contains an embedded post, the relevant social platform may collect information about your visit (such as your IP address) regardless of whether you have an account or are logged in. The collection and use of that information is governed by the platform’s own privacy policy, not this Policy.
You may use your browser settings, the cookie consent banner, or platform-specific privacy controls to limit the data shared with these platforms.
7. Sharing personal data
We do not sell personal data.
We share personal data in the following circumstances:
• With our processors (named in Section 5), under data processing terms requiring them to process your data only for our specified purposes;
• With advertisers, sponsors, and commercial partners — only on an aggregated, anonymised basis, for the purposes of media planning and ad sales. Individual reader data is not shared with sponsors or advertisers;
• With legal authorities and other third parties where we are required to do so by law, regulation, or valid legal process;
• With successors in a corporate transaction — in the event of a merger, acquisition, restructuring, or sale of all or part of Ruca Limited’s business, personal data may be transferred to the successor entity, subject to applicable data protection law.
8. Artificial intelligence and text and data mining
We do not use the personal data of Site users to train, fine-tune, or evaluate artificial intelligence systems. Where The Bay journalists use AI tools to support their work (as set out in the Ethics Policy), those tools are used only on Bay-controlled content and are reviewed by a human journalist before publication.
We expressly prohibit the use of any Content from the Site for the purposes of training, fine-tuning, evaluating, or otherwise developing AI systems, machine learning models, generative AI models, or large language models, without prior written agreement.
9. How long we keep personal data
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law:
• Server logs: typically 30 days.
• Cookie consent records: 12 months from collection.
• Google Analytics data: aggregated and retained per Google’s default retention setting.
• User submissions and editorial correspondence: for as long as necessary for editorial purposes; published content and the supporting record may be retained indefinitely as part of the historical archive.
Where personal data is no longer required, it is securely deleted or anonymised.
10. Security
We take reasonable technical and organisational measures to protect personal data against unauthorised access, processing, alteration, disclosure, or loss. These measures include:
• HTTPS encryption for all communications between your browser and the Site;
• Cloudflare bot management and DDoS protection;
• Access controls on personal data held by The Bay;
• Regular reviews of our security posture as the threat landscape evolves.
No system can be guaranteed completely secure. If we become aware of a security incident affecting personal data, we will notify affected users and the relevant data protection authorities where required by law and within the timeframes required by law.
11. Your rights
Under the Macao Personal Data Protection Act (Law No. 8/2005), you have the following rights in respect of your personal data:
• Right to information — to be informed about how your personal data is processed (this Policy is part of how we meet this obligation);
• Right of access — to request a copy of personal data we hold about you;
• Right to rectification — to have inaccurate or incomplete personal data corrected;
• Right to opposition — to object to processing on grounds relating to your particular situation, where the processing is based on legitimate interests;
• Right to erasure — to request the deletion of your personal data in certain circumstances;
• Right to lodge a complaint — with the Macao Office for Personal Data Protection (Gabinete para a Protecção de Dados Pessoais).
To exercise any of these rights, please write to [email protected] with sufficient information to identify your record (typically the email address you used to contact us). We will respond as soon as practicable and within statutory timeframes where applicable.
Acknowledgment of regional rights
The Bay’s audience extends across the Greater Bay Area and beyond. Readers in Hong Kong may have additional rights under the Hong Kong Personal Data (Privacy) Ordinance. Readers in mainland China may have additional rights under the Personal Information Protection Law (PIPL); thebay.mo is not actively marketed in mainland China, and we do not maintain a designated representative in mainland China. Readers based in mainland China may contact us at [email protected] with any questions. Readers in the European Union and other jurisdictions may have additional rights under their applicable data protection laws.
12. Children
The Site is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you become aware that a child under 16 has provided us with personal data, please contact [email protected] and we will take reasonable steps to delete that data.
13. Changes to this Policy
We may update this Policy from time to time to reflect changes in the law, the Site, our services, or our business.
14. Contact us
For privacy queries and data subject rights requests:
For legal queries, copyright notices, takedown requests, and licensing:
For general enquiries: