Privacy Policy

1. Who We Are

The data controller is Typhoon Ridge, operating from Unit 09, 27th Floor, Gateway Centre, 44 Java Road, North Point, Hong Kong. For data-related matters, contact us at [email protected].

2. Personal Data We Collect

We collect personal data only where necessary for business purposes. This may include:

• Name and job title, provided through our contact form or in direct correspondence
• Business email address and telephone number
• Organisation name and general business context
• IP address and browser data collected automatically when you visit our website
• Any information you choose to share with us during an enquiry or engagement

We do not collect sensitive personal data (as defined under the PDPO) unless specifically required and with your explicit consent.

3. How We Collect Personal Data

• Through our website contact form
• By email or telephone when you contact us directly
• Through cookies and analytics tools on our website (see Section 7)
• During the course of a consulting engagement, as relevant to the scope of work

4. How We Use Your Personal Data

We use personal data for the following purposes:

• Responding to enquiries and communications submitted via our website or by email
• Preparing and delivering consulting proposals and engagement work
• Complying with legal obligations applicable to our business
• Improving our website and understanding how visitors interact with it
• Sending relevant information about our services, where you have provided consent

The legal basis for processing is typically your consent (for marketing communications), our legitimate interest in running our business (for responding to enquiries), or performance of a contract (for engagement-related activities).

5. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy. Enquiry records are typically held for 12 months from the date of last contact. Data related to completed engagements is retained for 7 years in accordance with professional and legal obligations. Website analytics data is retained according to the retention settings of the relevant analytics platform (typically 26 months).

6. Data Sharing with Third Parties

We do not sell, rent, or trade personal data. We may share data with:

• Trusted service providers that support our operations (e.g., website hosting, email services), who are bound by confidentiality obligations
• Professional advisers (lawyers, accountants) where required
• Regulatory authorities or law enforcement, where required by law

7. Cookies and Website Analytics

Our website uses cookies to function and to understand visitor behaviour. Analytics data is collected in aggregate form and does not identify individual users. You can control cookie preferences using our cookie management controls. For full details, see our Cookie Policy.

8. Data Protection Measures

• Access to personal data is limited to staff who require it for legitimate work purposes
• Data stored on our systems is protected by current security standards
• We review our data handling practices periodically to ensure they remain appropriate
• In the event of a data breach that presents a risk to individuals, we will notify affected parties and, where required, the relevant authority as soon as practicable

9. Your Rights

Under the Personal Data (Privacy) Ordinance (Cap. 486), you have the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate personal data
• Object to our use of your personal data for direct marketing purposes
• Withdraw consent where consent is the legal basis for processing
• Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (Hong Kong)

To exercise any of these rights, please contact us at [email protected]. We will respond to all requests within 40 days, as required under the PDPO.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to read their respective privacy policies.

11. Children's Privacy

Our services are directed at business professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised date. Continued use of our website after any changes constitutes acceptance of the updated policy.

13. Contact

For questions about this policy or your personal data, contact: