Privacy Policy

We respect your privacy and are committed to protecting your personal data. This privacy policy is prepared with reference to the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (PDPO) and, where applicable, the European Union General Data Protection Regulation (GDPR). Hong Kong Business Services Centre Limited is the data user under the PDPO and, where GDPR applies, the controller of the personal data described in this policy.

We may collect, use, store, and transfer different kinds of personal data about you depending on the service, enquiry, or secure invitation link involved:

• Identity and contact data, such as name, company name, role, email address, telephone number, correspondence address, and billing or service contact details.
• Client verification and KYC data, such as identity documents, HKID or passport numbers, address proof, birth place, source of funds, source of wealth, business background, uploaded files, and verification status.
• Company formation and corporate service data, such as proposed company names, directors, shareholders, beneficial owners, shareholdings, residential or correspondence addresses, business details, declarations, and signatures.
• Financial and payment data, such as bank account details, payment references, invoices, service fees, transaction records, and payment provider records.
• Service and transaction data, such as services requested or purchased, statutory filing information, document support records, cloud storage records, and correspondence relating to your matter.
• Technical, security, and usage data, such as IP address, user agent, browser and device information, cookies, submission timestamps, Turnstile verification results, and analytics or site usage information.
• Communications data, such as contact form messages, emails, calls, WhatsApp or other messages, meeting notes, and support requests.
• AI chat data, where you choose to use the optional AI chat feature, including the text you submit, selected language, technical request data, and security verification results.
• Other data you or an authorised contact provide to us in connection with our services.

We use different methods to collect personal data from and about you, including:

• Direct interactions with you, such as when you complete a website form, contact us by email, phone, WhatsApp or other channels, request a quotation, instruct us, or provide documents.
• Secure invitation-only links sent to a client or authorised contact for KYC uploads, onboarding, company formation, or other client-specific workflows.
• Automated technologies or interactions, such as cookies, server logs, analytics tools, security verification tools, browser/device information, IP address, user agent, and submission timestamps.
• Third parties or public sources where appropriate, such as authorised representatives, professional advisers, banks, brokers, registries, regulators, public registers, or service providers involved in your matter.

We use personal data only for lawful, service-related, compliance, security, and administrative purposes, including:

• To respond to enquiries, prepare quotations, communicate with you, and provide the services you request.
• To perform or take steps to enter into a contract with you or the client you represent.
• To carry out KYC, client due diligence, anti-money laundering, company formation, company secretarial, accounting, tax, audit arrangement, cloud storage, document support, and other service workflows.
• To comply with legal, regulatory, accounting, tax, reporting, record-keeping, sanctions, fraud prevention, or law enforcement requirements.
• To maintain website, AI chat, account, document, and system security; prevent abuse; verify legitimate access; and troubleshoot technical issues.
• To manage our business, keep internal records, improve website and service operations, and send service-related updates or direct marketing only where permitted by law.

We may have to share your personal data with third parties, including:

• HKBSCL directors, employees, contractors, agents, and authorised staff who need the data for service, support, compliance, or security purposes.
• Cloud, email, storage, database, analytics, security, payment, AI service, and communications providers, including providers such as Microsoft, Google, Amazon Web Services, MongoDB, Cloudflare, AI providers, and relevant email or hosting providers.
• Professional advisers and service partners such as lawyers, tax advisers, accounting advisers, insurers, banks, brokers, registered agents, and independent auditors for audit arrangement or audit coordination.
• Government departments, registries, tax authorities, regulators, law enforcement bodies, courts, or other authorities where required or permitted by law.
• Client companies, authorised contacts, directors, shareholders, beneficial owners, signatories, or representatives connected with the relevant matter.
• Other parties where you instruct us, authorise disclosure, or where disclosure is reasonably necessary for the relevant service.

We use administrative, technical, and physical safeguards designed to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or misuse. These safeguards may include access controls, secure invitation-only links, encryption or provider security controls where appropriate, file validation, staff confidentiality obligations, and limits on access to people and providers who need the data for authorised purposes. No internet transmission or storage system is completely secure, but we work to keep protections proportionate to the sensitivity of the data.

We retain personal data only for as long as necessary for the purposes for which it was collected, and for legal, accounting, tax, compliance, regulatory, audit arrangement, dispute handling, and security purposes. Enquiry records may be kept for follow-up and business records. KYC, company formation, statutory, accounting, tax, corporate administration, and client due diligence records may need to be kept for longer periods required or permitted by applicable law and professional practice. When data is no longer needed, we will delete, anonymise, or restrict it where reasonably practicable. We generally keep client due diligence, KYC, transaction, company administration, accounting, tax, and statutory records for the period required or permitted by applicable law and professional practice; where anti-money laundering, TCSP, accounting, tax, or company record rules apply, this may include keeping relevant records for at least 5 years after the end of the business relationship or relevant transaction. Website security cookies and short-lived verification records are kept only for their stated security purpose and period unless a longer legal, security, or dispute need applies.

Depending on the privacy law that applies to you, your rights in relation to personal data may include:

• Under the PDPO, request access to personal data we hold about you.
• Under the PDPO, request correction of inaccurate personal data.
• Where GDPR applies, request erasure of your personal data in applicable circumstances.
• Where GDPR applies, object to processing based on applicable grounds.
• Where GDPR applies, request restriction of processing.
• Where GDPR applies, request transfer or portability of personal data.
• Withdraw consent where processing is based on consent, without affecting prior lawful processing.
• Opt out of direct marketing communications where applicable.
• Raise a privacy concern with us, the Hong Kong Privacy Commissioner for Personal Data, or an EU/EEA supervisory authority where applicable.

To exercise access, correction, or other privacy rights, contact our Privacy/Data Protection Contact at info@HKBSCL.com or Unit 744, 7/F, Star House, 3 Salisbury Road, Tsim Sha Tsui, Kowloon, Hong Kong. Please mark the request as a personal data access or correction request. We may verify your identity and may charge any fee permitted by applicable law before handling the request.

This website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Our primary data processing operations are based in Hong Kong. We also use trusted cloud, email, storage, database, security, analytics, and communications providers, and their systems may store, back up, replicate, or process encrypted or access-controlled data in Hong Kong, the Asia-Pacific region such as Singapore or Japan, or other locations according to their service architecture. Where a cross-border transfer occurs, we take practical steps such as provider due diligence, access controls, contractual terms, and technical safeguards appropriate to the nature of the data and the service. Where GDPR applies, transfers are handled with reference to applicable transfer safeguards.

We may update our privacy policy from time to time. Any changes we make will be posted on this page, and where appropriate, we will notify you by email.

For privacy questions, data access or correction requests, or concerns about this policy, please contact our Privacy/Data Protection Contact at info@HKBSCL.com or Unit 744, 7/F, Star House, 3 Salisbury Road, Tsim Sha Tsui, Kowloon, Hong Kong.

Some website forms and secure client links include a short collection notice at the point where data is collected. Those notices should be read together with this policy.

• Contact and enquiry forms are voluntary. If you do not provide the requested contact details and message, we may be unable to respond.
• Secure KYC upload and company formation links are sent only to specific clients or authorised contacts. Required fields and documents are generally necessary for onboarding, client due diligence, service delivery, statutory records, and compliance.
• If required KYC, formation, identity, address, source-of-funds, signature, or business information is not provided, HKBSCL may be unable to continue onboarding, perform the requested service, or satisfy legal or regulatory requirements.
• Each collection notice identifies the main purposes, whether provision is voluntary or required, likely transferee classes, and how to contact us for access or correction.

The AI chat is an optional website feature for general HKBSCL service enquiries. Please do not submit sensitive personal data through AI chat.

• Submission is voluntary. If you type a message, we use it to generate an answer to your enquiry and to maintain the security and fair use of the AI chat feature.
• AI chat messages may include the text you submit, your selected language, technical request data, and security verification results.
• Messages are sent to our configured AI service provider for processing. Provider-side retention, logging, and training controls depend on the active provider account and settings.
• HKBSCL does not store AI chat transcripts in this website database and does not use AI chat messages to train HKBSCL models.
• Cloudflare Turnstile is used to help distinguish legitimate users from automated abuse before AI chat is available.
• After successful verification, the website sets a signed HTTP-only AI verification cookie for up to 2 hours so you do not need to repeat the same security check during that period.