Privacy Policy

1. Information we collect

When you submit an enquiry, we collect the name, company, email, telephone number, message and project requirements you provide. Required details, including name and email, help us process your enquiry; other fields are voluntary as marked. Without necessary details, we may be unable to follow up. The website also processes IP addresses, browser details, access logs, language settings and session identifiers.

2. How we use information

We use information to respond to enquiries, arrange demonstrations, prepare quotations, deliver and improve services, operate the website, prevent abuse and meet legal obligations. We will not use personal data for a new purpose unrelated to its original purpose without obtaining any required consent.

3. Google Sign-In for administrators

When a staff member signs in with Google, we request basic account information through the openid, email and profile permissions. For authorised administrators, we store the Google account ID, email address, display name and profile image URL in their website account, along with the time of their last sign-in. We use these details to check access, maintain the administrator’s account and show their name and profile image in the administration panel. Website visitors can browse and submit enquiries without signing in with Google.

4. Google Workspace email sending

An administrator can separately connect a sender account. We request openid and email to verify the sender’s Google account ID and email address. The only Gmail permission requested is gmail.send. It lets the website send enquiry notifications and administrator-requested test emails from the connected address. The website does not read, search or modify the mailbox or access Google contacts.

5. What we send to Google and who receives it

To deliver a message, we send Google’s Gmail API the sender and recipient addresses, subject and message content. Enquiry notifications are sent to the recipients selected by our administrators. They include the enquiry type, name, email address, any company, phone number, message and project details entered in the form, plus the website language and IP address. The submitter’s email address is also used as the reply-to address. A test email contains a standard test message and goes to the address the administrator enters. We do not sell Google account data or use it for advertising or AI model training.

6. Google data retention and removal

Sign-in details are kept in the administrator’s website account record. The sender address, Google account ID and encrypted OAuth refresh token are kept on our server until the sender is replaced or the connection record is removed. The refresh token lets us send enquiry notifications when the administrator is signed out. We cache encrypted access tokens only until shortly before they expire. You can revoke the website’s Google access in your Google Account. To remove the separate records we hold, email the contact below with the affected account address and whether you want the sign-in record or the sender connection removed. After verifying the request, we will remove the relevant data unless retention is required by law. Revocation and website record deletion do not recall emails already delivered to recipients. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

• Manage access in your Google Account
• Google API Services User Data Policy

7. AI assistant and abuse prevention

The AI assistant processes your questions and recent conversation to generate replies and understand context. Recent conversation is currently cached on our server and expires approximately 30 minutes after its last update. To limit automated attacks and usage, we use visitor cookies, IP addresses and hashed identifiers derived from browser and device characteristics. These identifiers may still relate to an individual. Do not submit identity document numbers, passwords, financial details, health information or other sensitive data.

8. Cookies, advertising and third-party services

Cookies and similar technologies support sessions, security checks, language settings and AI usage limits. When enabled, Google Ads tags may also collect usage and conversion information, such as clicks on WhatsApp links; Cloudflare Turnstile processes security verification data. You can manage cookies in your browser, although some features may be affected. WhatsApp, Google Maps and other external services are operated by their providers and have their own privacy policies.

9. Disclosure and processing locations

Information may be shared with suppliers supporting our hosting, email, infrastructure, security verification, advertising measurement and service delivery, as needed for those services. We may also disclose information to authorities where required by law. Some suppliers may process information outside Hong Kong; we take reasonable safeguards in accordance with applicable requirements.

10. Retention and security

Enquiry, service and security records are retained as needed to handle enquiries, deliver services, resolve disputes and meet legal obligations, rather than indefinitely after those purposes cease. Retention periods differ for records and backups. We use reasonable access controls and technical safeguards, but internet transmission and storage cannot be guaranteed absolutely secure.

11. Access, correction and policy updates

You may request access to and correction of personal data we hold about you. We handle requests under Hong Kong’s Personal Data (Privacy) Ordinance; a reasonable access fee may apply where permitted by law. Policy changes and their update date will be published on this page.