Privacy Policy

This Privacy Policy describes how SKYSCRAPERS INFO LIMITED ("SKYSCRAPERS INFO", "we", "us", or "our") collects, uses, discloses and protects personal data when you use our website located at skyscrapersinfo.ltd (the "Website") and the editorial, informational and commercial services made available through it (together, the "Services").

The Personal Data (Privacy) Ordinance (Cap. 486) of the laws of the Hong Kong Special Administrative Region ("PDPO") is the primary legal framework that applies to our handling of personal data. Where our processing activities fall within the territorial scope of Regulation (EU) 2016/679 ("GDPR") or the United Kingdom General Data Protection Regulation ("UK GDPR"), the additional requirements of those laws apply to that processing. We do not represent that those additional requirements apply to a particular processing activity unless and until their territorial applicability has been established.

This policy applies to personal data processed in connection with the Services, including data you provide to us, data observed about your interaction with the Services, and data we receive from third parties in connection with enquiries and commercial communications.

It does not apply to third-party websites, platforms or services that we do not operate or control, including any content or services linked from the Services or from third-party platforms that link to the Services.

The data controller for the personal data described in this policy (referred to as the "data user" under the PDPO) is:

SKYSCRAPERS INFO LIMITED
A company incorporated in the Hong Kong Special Administrative Region.
Registered office: Not yet verified for this policy — to be reconciled with the company information published at /contact by the operator before adoption
Privacy correspondence: No dedicated privacy mailbox or contact channel is currently operational

The published company information page at /contact identifies the legal operator and the registered office. That page is the authoritative source for the operator's identity. The registered office is the registered office of the company; it is not represented here as a customer-support office, a data-protection department, a continuously monitored privacy mailbox, or a dedicated statutory request-handling channel. Until a designated privacy contact channel is established and confirmed by the operator, this policy does not advertise any specific address, email or form as the means by which statutory or other requests must be made.

The operator has not appointed a Data Protection Officer and has not appointed a representative under Article 27 of GDPR or Article 27 of UK GDPR. Whether any such appointment becomes required depends on whether the territorial scope of GDPR or UK GDPR is established for the relevant processing activity, which has not yet been determined. Should any such appointment become required by law, the relevant details will be added to this section and the policy will be updated. No privacy officer is invented for the purposes of this Draft.

We process personal data in the following categories, to the extent each is actually collected in connection with the Services.

Information you provide voluntarily. When you contact us, request information or otherwise correspond with us through forms on the Website or by other means, you may provide identifiers and contact details such as your name, organisation, role, email address, telephone number, country, the subject of your enquiry and the contents of your message.

Information collected automatically. When you visit the Services, technical information may be collected by our platform infrastructure and, where configured, by analytics or other monitoring services. This may include your IP address, browser type and version, device type, operating system, screen resolution, referring URL, pages visited, time of visit and other technical identifiers.

Information from third parties. Where enquiries or commercial communications originate from referral channels, professional partners or third-party platforms, we may receive limited identification and contact information about the enquirer from those sources.

The categories actually collected depend on the channels you use and the configuration of the Services at the time of your interaction. Where a Personal Information Collection Statement ("PICS") is required under DPP1(3) of the PDPO, it will be set out adjacent to the relevant form on the Services and will address the categories collected through that form, the purpose of collection, the classes of potential recipients or transferees, and the rights of access and correction. The PICS for any particular form is to be read together with this policy.

The Technical Data categories above (IP address, browser metadata, server logs, device identifiers, referring URL) are typically generated by the platform infrastructure used to operate the Services and by standard web-protocol behaviour, irrespective of whether any active form is enabled on the Website. Whether those categories are actually collected for this Website in any given visit, and the retention applied to them, has not been independently audited in this Draft and is recorded as not yet verified in the absence of access to the platform's actual server-side configuration. No analytics provider, payment processor, customer-relationship platform, marketing automation tool, storage jurisdiction or advertising network is identified in this Draft by name, as the underlying configuration has not been independently inspected.

We collect personal data through:

• forms made available on the Services, including the public online enquiry form on /contact and any data collection mechanism that may be operated on /services. As of the date of this Draft, the public online enquiry form on /contact is not active; online enquiries are not being accepted through that form, and that form does not currently collect personal data. The presence of any additional data collection mechanism on /services, and the configuration of any underlying Tilda form processing, are not independently confirmed in this Draft and must be verified before being treated as a data collection form. Where a form is later activated, it will be accompanied by a PICS only where DPP1(3) of the PDPO requires one and only after that PICS has been deployed;
• direct correspondence, including by post to the operator's published address, by email to any address made public by the operator, and by any other channel that the operator may publish from time to time, where that channel is reasonably capable of being received by the operator;
• the platform infrastructure used to operate the Services, which may log technical metadata about your interaction with the Services for security, integrity and operational purposes;
• cookies, local storage and similar technologies, where configured, as further described in our Cookies Policy at /cookies; and
• third-party services integrated into the Services, where their use is actually configured (for example embedded media, mapping and analytics services — see Section 7).

We do not knowingly collect personal data through channels that are not described above. The statement is given subject to the limitations described in Section 3 of this policy, in particular the position that the actual collection of Technical Data is not yet verified in this Draft.

The Personal Data (Privacy) Ordinance establishes six Data Protection Principles. The following four are specifically relevant to the topics discussed in this section:

• DPP1 — purpose and manner of collection. All personal data is collected for a lawful purpose and by lawful and fair means. The purpose of any given collection is identified at or before the time of collection.
• DPP3 — use of personal data and restrictions on new purposes. Personal data is not used for a purpose other than that for which it was collected (including any directly related purpose), except with the data subject's prescribed consent or as otherwise permitted by the PDPO.
• DPP5 — openness and transparency. Our general policies and practices on personal data handling are made publicly available, including through this policy and the related disclosures on the Services.
• DPP6 — access and correction. Data subjects may request access to and correction of personal data held about them, as described in Section 12 of this policy.

Within those principles (and, where applicable, the requirements of GDPR or UK GDPR), we process personal data for the following purposes:

• to respond to enquiries, requests and correspondence sent through the Services or by other means, including business enquiries regarding the Services;
• to operate, secure and improve the Services, including the detection and prevention of misuse, fraud and security incidents;
• to maintain accurate records of our commercial and editorial relationships;
• to comply with applicable legal, regulatory and accounting obligations;
• to deliver editorial updates and other non-marketing communications; and
• where permitted by applicable law, to pursue the legitimate interests of SKYSCRAPERS INFO in operating an international architectural editorial and information platform.

Direct marketing communications are addressed separately in Section 14 of this policy.

For personal data subject to the PDPO, the Ordinance is structured around compliance with the six Data Protection Principles rather than around a "legal basis" concept of the kind used in GDPR. The DPPs are obligations on us as a data user; they are not, in themselves, a lawful basis within the meaning of Article 6(1) of GDPR. Where GDPR or UK GDPR additionally applies to a particular processing activity, the Article 6(1) legal basis for that activity will be one of the six bases set out in that article (for example, performance of a contract, compliance with a legal obligation, the data subject's consent, or our legitimate interests). The basis actually relied on for each purpose is determined by the nature of the processing; not every Article 6(1) basis is relied on, and this policy does not represent that any basis has been formally recorded for any given purpose until that record has been independently verified.

This Draft does not represent that any particular cookie, local-storage item, pixel, tag, embed, analytics service, third-party service or other tracking technology is, or is not, in use on the Services, beyond what the Cookies Policy at /cookies records. The actual cookies, similar technologies, providers, purposes, retention periods and categories are described in the Cookies Policy, which is the authoritative record for cookie-related disclosures under this policy. Where the Cookies Policy and this policy are read together, the Cookies Policy controls for cookie-specific matters (categories, providers, consent mechanism, retention, user choices).

The Cookies Policy is not, on the basis of this Draft, treated as a complete or independently verified inventory. Whether the Cookies Policy accurately describes every cookie or similar technology actually set on your device when you use the Services is to be confirmed by the operator after audit. This Draft does not assert that the consent mechanism described in the Cookies Policy, where one is described, satisfies the consent requirements of any applicable law; that determination is to be made by the operator on a confirmed basis.

Cookie preferences can be changed or withdrawn through the cookie controls made available on the Services, where those controls are configured. This Draft does not represent that a granular or technically valid preference mechanism is currently available on the Services, and the actual configuration of any such controls is not yet independently verified.

Where applicable law requires consent for the setting of any non-strictly-necessary cookie or similar technology, valid consent must be obtained before that technology is activated. The actual cookie configuration, consent mechanism, and effectiveness of any consent collection have not yet been independently verified. This Draft does not claim that legal compliance has already been established, or that non-essential cookies are absent. No cookies or tracking technologies are activated by this policy document itself.

The third-party content, embed resources, scripts and infrastructure services actually configured on the Services at any given time may include items that set cookies, transmit request metadata or otherwise process personal data, and that are documented to different degrees. The Cookies Policy at /cookies records cookies and similar technologies set on your device; the broader data-flow inventory (including recipient jurisdictions, transfer mechanisms and processor relationships) is to be recorded in an internal data-flow register that has not yet been completed or independently verified. This Draft does not assert that every third-party integration on the Services is, or is not, documented in the Cookies Policy, and does not assert that the Cookies Policy is a complete inventory of all data flows until that inventory has been independently established.

Where the Services embed content or functionality from third-party providers (for example mapping, video, fonts, social-media widgets or analytics services), information about your interaction with that content may be transmitted to the relevant provider under its own terms and policies. Some of that processing will be carried out by the third party as an independent controller for its own purposes; some may be carried out on our behalf as our processor. Where a third party acts as our processor, DPP2(3) and DPP4(2) of the PDPO require that we use contractual or other means to ensure that the processor does not retain the data longer than is necessary for the purpose of processing and protects it with reasonable security safeguards. Whether those contractual or other means are in place for each processor we engage is not yet verified in this Draft; this policy does not represent that they are.

No third-party provider, content-delivery network, advertising network, payment processor, customer-relationship platform or storage jurisdiction is named in this Draft. The Cookies Policy and the internal data-flow register are the appropriate locations for any such names once the underlying configuration has been independently inspected.

We may share personal data with the following categories of recipients, to the extent reasonably necessary for the purposes set out in this policy and subject to applicable confidentiality and security obligations. The actual sharing that occurs depends on the configuration of the Services and on whether you use a particular channel (such as submitting a form, contacting us by email, or interacting with an embedded third-party resource).

• Platform and hosting providers — the website platform and infrastructure providers engaged to host, deliver, secure and operate the Services. The specific platform provider currently in use, and the infrastructure providers engaged by it, are not yet verified in this Draft and are not named here.
• Leads and form processing services — where leads and form submissions are processed through a leads and form service, submissions are stored by that service and may be exported to email and to any external CRM, webhook or integration configured. The public online enquiry form on /contact is not active at the time of this Draft, and the form-processing pathway is therefore not exercised through that form. The underlying Tilda configuration (including any T972 block, any leads destination, any webhook, any CRM connector and any email recipient) is not independently inspected in this Draft; this policy does not claim that any such pathway is currently enabled, and does not claim that it is currently disabled. If an active form is later introduced, the operator will confirm the configuration, update the Cookies Policy, deploy a PICS where DPP1(3) requires it, and record the relevant processing in the internal data-flow register before collection begins.
• Professional advisers and authorities — our legal, accounting and other professional advisers, insurers, auditors, and competent authorities, courts or regulators, where required by law or to protect our lawful interests.

We do not currently sell personal data. If this position changes, this section will be updated to reflect the position adopted and the lawful basis relied on. We do not share personal data with third parties for their own independent marketing purposes except where you have given specific, separate consent or where required by law.

We do not represent that personal data is never shared. The categories above reflect the categories of recipients that may receive personal data in the ordinary operation of the Services. The complete list of recipients configured at any given time, and the contractual or other safeguards relied on for each, are not yet verified in this Draft and form part of the internal data-flow register.

Personal data may be processed in jurisdictions other than the Hong Kong Special Administrative Region, including in the jurisdictions in which the platform, hosting, form-processing and other service providers engaged by the operator operate. The actual recipient jurisdictions depend on the configuration of those services, which has not been independently verified in this Draft. The recipient jurisdictions are to be recorded in an internal data-flow register maintained by the operator, not in this policy or in the Cookies Policy. That register has not yet been completed or independently verified, and the actual recipient jurisdictions of personal data processed by the operator are not specified in this policy. The Cookies Policy at /cookies records only the cookies and similar technologies set on your device by the Services, together with their providers and purposes.

This Draft does not assert that international transfers occur, and does not assert that they do not occur. The general likelihood is that some technical data (such as IP addresses and request metadata) generated by ordinary web-protocol interaction is processed in jurisdictions outside Hong Kong by the platform and infrastructure providers actually configured for the Services, but the actual arrangements have not been independently inspected. The operator's authoritative position on transfers will be made only after the underlying configuration has been verified.

Section 33 of the PDPO, which would restrict cross-border transfers of personal data out of Hong Kong, was scheduled for commencement but, at the time of this Draft, is not in force. We do not represent that section 33 currently applies to our processing, and the cross-border-transfer restrictions it would introduce are not yet enforceable.

Where personal data is transferred across borders in circumstances where GDPR, UK GDPR, the Mainland China Personal Information Protection Law, or any other foreign law applies, the transfer should be supported by a transfer mechanism recognised under the applicable law — such as an adequacy decision, Standard Contractual Clauses or another lawful safeguard — together with any supplementary measures reasonably required in the circumstances. Whether any such recognised mechanism has in fact been put in place for any cross-border flow that we operate is not yet verified in this Draft. This policy does not represent that any such mechanism is, or is not, in place; the operator is to confirm the matter after audit.

This Draft does not assert that GDPR, UK GDPR, PIPL or any other foreign regime automatically applies to every visit. Whether a particular foreign regime applies to a particular processing activity depends on the territorial scope of that regime, the nature of the processing and the data subjects involved, none of which has been conclusively established in this Draft.

We retain personal data only for as long as reasonably necessary for the purposes set out in this policy or for compliance with applicable legal, regulatory and accounting obligations, in line with Data Protection Principle 2 of the PDPO. Specific retention periods, storage destinations and deletion methods for the categories of personal data actually processed by the operator are not yet verified in this Draft and are not specified in this policy. No fixed retention period is invented here, and no automatic deletion schedule is represented as already in operation.

Technical logs and platform metadata. Technical logs, server logs, security and access logs, and similar platform metadata are typically generated by the platform infrastructure used to operate the Services. The retention applied to those logs by the platform infrastructure actually in use, and any additional retention applied by the operator, are not yet independently verified in this Draft.

Enquiries and correspondence. No active form for general personal-data collection is currently operated on the Website, and the operator does not accept online enquiries through the Website at the time of this Draft. Where personal data is nevertheless received by other means (for example, by post or by email to an address made public on the Website), it is retained only for as long as reasonably necessary to respond and to comply with any applicable legal, regulatory or accounting obligation, after which it is deleted or anonymised.

Analytics, embedded third-party content and cookies. Where analytics, embedded third-party content, or non-essential cookies are configured, the retention of those cookies and similar technologies on your device is determined by the configuration actually in place. The cookie-specific retention periods described in the Cookies Policy have not yet been reconciled with the actual configuration on the Services and have not been independently verified in this Draft. Browser-side cookie retention is distinct from the infrastructure-side retention of technical logs, server logs, security and access logs, and other platform metadata, which is determined by the platform infrastructure actually in use and is addressed in the separate paragraph above.

Commercial and accounting records. Records relating to commercial and accounting matters are retained for the periods required by applicable laws where such records exist. As of the date of this Draft, the Website does not operate commercial or transactional features and no commercial records of that kind are generated through the Website.

A practical retention schedule identifying the retention period applicable to each category of personal data, together with the deletion method and the responsible person, is to be prepared and reflected in this section once the underlying processing has been independently verified. Until that schedule is in place, personal data is retained only as long as reasonably necessary for the purposes set out in this policy or as required by applicable law, after which it is deleted or anonymised. You may request information about the applicable retention period by contacting us using the details set out in Section 16, subject to the operational limitations on the contact channel described in this policy.

We are required by Data Protection Principle 4 of the PDPO to take all reasonably practicable steps to protect personal data held by us against unauthorised or unlawful processing, accidental loss, destruction or damage, having regard to the nature of the personal data processed and the reasonably foreseeable risks. That statutory obligation applies to the operator regardless of the draft status of this policy, and is not suspended, reduced or disclaimed by anything in this section.

The specific organisational and technical safeguards relied on by the operator (including any platform-level controls, transmission security, access controls, audit logging, secure development practices and incident response procedures) are not described in detail in this Draft. The complete description of those safeguards is to be prepared by the operator and kept under review. This policy does not represent that any specific safeguard, encryption standard, certification, audit standard or server jurisdiction is currently in place beyond the controls that the platform infrastructure used to operate the Services provides by default. No specific safeguard is named or claimed in this Draft.

Information about the organisational and technical safeguards relied on by the operator is available to the extent that disclosure is consistent with the legitimate interests of the operator, the rights of data subjects under the PDPO, the confidentiality of any protective security architecture, and the safety and integrity of the Services. The operator is not required by the PDPO to disclose the full detail of its protective security architecture, and the operator does not in this Draft promise the disclosure of any such detail. Data subjects may nevertheless make a Data Access Request under section 18 of the PDPO in relation to personal data held about them; the operator will respond to such a request in accordance with section 19(1) and the other applicable provisions of the PDPO, subject to the conditions, exemptions and limitations set out in the Ordinance.

No method of transmission over the internet or method of electronic storage is completely secure. Reasonable residual risk remains, and the operator cannot ensure or warrant the security of information during transmission to the Services. Where the operator becomes aware of a security incident affecting personal data, it will follow the approach described in Section 15 of this policy.

Rights under the PDPO. Subject to the PDPO, you have the right:

• to make a Data Access Request under section 18 of the PDPO to ask whether we hold personal data about you and to obtain a copy of that personal data (Data Protection Principle 6);
• to make a Data Correction Request under section 22 of the PDPO to have any personal data that is inaccurate corrected (Data Protection Principle 6); and
• to raise concerns with the Office of the Privacy Commissioner for Personal Data ("PCPD").

Prescribed form for Data Access Requests. Under section 67(1) of the PDPO and Data Protection Principle 6, the Privacy Commissioner for Personal Data has prescribed a standard form (PCPD Form OPS003) for Data Access Requests made under section 18 of the PDPO. Where a Data Access Request is made otherwise than on the prescribed form, the operator may, in the circumstances permitted by the PDPO, refuse the request; this Draft does not represent that a request submitted otherwise than on the prescribed form is automatically invalid or that it is automatically accepted, and the operator will consider each request on its merits in accordance with the applicable law. The prescribed form is not required for Data Correction Requests, for general privacy correspondence, or for the exercise of any other statutory or contractual right. The prescribed form is available from the Office of the Privacy Commissioner for Personal Data.

Under sections 19(1) and 23(1) of the PDPO, the operator is required to respond to a Data Access Request or Data Correction Request within 40 days after receiving it. Where the operator is unable to comply with the request within that period, a written notice will be provided to the requester setting out the reasons for the inability to comply and the latest date by which the operator will respond. Any fee charged for a Data Access Request must comply with section 28 of the PDPO, which prohibits the imposition of a fee that is excessive. These statutory obligations are not suspended, reduced or disclaimed by reason of the draft status of this policy, the absence of an active form on the Website, or the absence of a dedicated privacy contact channel.

Requests may be addressed to the operator using the operator's published company information. As of the date of this Draft, the Website does not operate an online form for the submission of statutory requests, and a dedicated privacy mailbox has not been established. The lack of a dedicated channel does not affect the existence of the underlying statutory rights; it is a high-priority operational issue for the operator to address.

Rights under GDPR or UK GDPR. Where GDPR or UK GDPR additionally applies to a particular processing activity, the rights available to you in relation to that activity depend on the lawful basis on which the processing is carried out and include, in defined circumstances, the right to erasure, restriction of processing, data portability, objection to processing carried out on the basis of legitimate interests, and the right to withdraw consent at any time where consent is the basis relied on. These rights are subject to the conditions, exemptions and limitations set out in those laws, including any conditions that apply because of the lawful basis relied on for the processing in question.

How to make a request. To exercise any right, please contact us using the details set out in Section 16, subject to the operational limitations on those details described in that section and elsewhere in this policy. We may need to verify your identity before responding, and may request additional information necessary to locate the personal data you are requesting. Where a fee is permitted by the applicable law — including, in the case of Data Access Requests under the PDPO, any fee permitted under section 28 of the Ordinance — that fee must not be excessive.

We do not represent that any particular right is available in respect of all processing. The specific rights available to you depend on the law that applies to the relevant processing and on the conditions and limitations set out in that law.

The Services are intended for a professional and general adult audience interested in architecture, design and the built environment. The Services are not directed at children, nor do we knowingly collect personal data from children.

If you are under the age at which you can lawfully provide consent under the law of the country from which you access the Services, please do not submit personal data through the Services. If you are a parent or guardian and believe that a child has provided personal data to us, please contact us using the details set out in Section 16 so that we can take appropriate action, including deletion where required, subject to the operational limitations on that contact channel described in this policy.

We do not operate age-verification mechanisms. We therefore cannot confirm that no personal data of minors is processed through the Services, and we do not represent that such processing is, or is not, occurring. If the operator becomes aware that personal data of a minor has been provided, it will take steps to delete that information unless a lawful basis to retain it applies.

Future features of the Services may include community accounts, uploaded photos and videos, newsletter subscriptions, commercial enquiries, booking or licensing requests and advertising products. Each such feature, if introduced, will be subject to a separate assessment of applicable notices, lawful processing conditions, vendor arrangements and other necessary safeguards before launch, and is not treated in this Draft as currently active. The /legal, /terms and /disclaimer pages, where relevant, will be updated in line with any such introduction.

We distinguish between responding to genuine enquiries and direct marketing communications.

Responses to genuine enquiries. When you contact us through a form or by other means, we may use the contact details you have provided to respond to your enquiry. This is not direct marketing.

Direct marketing. Where we send direct marketing communications, we do so only in accordance with applicable law. At the time of drafting, we have intentionally not activated email newsletter collection through the Website and do not maintain a marketing mailing list of subscribers. Accordingly, we do not currently send direct marketing communications to subscribers through the Services.

If direct marketing communications are introduced in future, the requirements of sections 35C (notification of intention), 35E (consent) and 35F (content of the first marketing communication to a data subject) of the PDPO will be observed, and section 35G will be observed when responding to any request to cease direct marketing. The PDPO's direct-marketing rules apply alongside, and not in substitution for, the requirements of GDPR or UK GDPR where those laws additionally apply, and the consent required under the PDPO is not the same consent as the consent required under Article 6(1)(a) of GDPR. Consent obtained through a contact-form submission will not, without a separate and specific opt-in, be treated as consent to receive direct marketing.

Each direct marketing communication we send will contain, or will be accompanied by, an unsubscribe mechanism. You may opt out of direct marketing communications at any time, without giving reasons and free of charge.

Incident response. Personal data security incidents are addressed through measures aligned with Data Protection Principle 4 of the PDPO. Where we become aware of a security incident affecting personal data, we will respond by assessing the incident, containing and remediating its impact, recording the relevant facts, and assessing whether any notification obligation arises under applicable law (including under GDPR or UK GDPR where those laws apply). Where an applicable law requires notification within a defined timeframe, that timeframe will be observed.

The PDPO does not currently impose a general statutory duty to notify the PCPD or affected individuals of personal data breaches. Where any other applicable law (including GDPR or UK GDPR) imposes a notification obligation in defined circumstances, we will comply with that obligation, including any applicable time limits.

Policy updates. We may update this policy from time to time to reflect changes to the Services, the law or our internal practices. The Version, Effective Date and Status fields at the top of this policy indicate the present position; where this Draft is replaced by an effective version of the policy, those fields will be updated to reflect the new version, the date from which the effective version applies, and the publication status of that version. The prior version of the policy will be retained on our records where reasonably practicable.

Continued use of the Services after an update does not, in itself, constitute consent to any new processing operation for which a separate consent is required under applicable law.

Privacy enquiries, rights requests and complaints should be addressed to the operator. The operator is identified on the company information page at /contact, which is the authoritative source for the operator's identity and registered office.

SKYSCRAPERS INFO LIMITED
Operator identification: as published at /contact
Registered office: as published at /contact
Designated privacy contact channel: No dedicated privacy mailbox or contact channel is currently operational on the Website

The registered office is the registered office of the company and is not represented here as a customer-support office, a data-protection department, a continuously monitored privacy mailbox, or a dedicated statutory request-handling channel. Until a designated privacy contact channel is established and confirmed by the operator, correspondence relating to privacy matters should be directed to the operator using the company's published contact details. The absence of a dedicated channel is a high-priority operational issue for the operator to address and does not affect the existence of the underlying statutory rights under the PDPO or any other applicable law.

The operator will respond to statutory Data Access Requests and Data Correction Requests within the timeframes required by the PDPO, including the 40-day period under sections 19(1) and 23(1) of the PDPO, and to other privacy correspondence in accordance with the applicable law. Where you wish to make a statutory Data Access Request, you should use PCPD Form OPS003 unless the circumstances permit otherwise under the PDPO; the prescribed form is not required for Data Correction Requests, for general privacy correspondence, or for the exercise of any other statutory or contractual right. Until an operational privacy contact channel is established, correspondence may be directed to the operator in any manner that is reasonable in the circumstances and that is capable of being received by the operator, including by post to the operator's registered office or by email to any address made public by the operator. This policy does not represent that the inactive public online form on /contact receives or processes statutory requests.

If you are dissatisfied with our response, you may contact the Office of the Privacy Commissioner for Personal Data, the privacy regulator of the Hong Kong Special Administrative Region:

Office of the Privacy Commissioner for Personal Data, Hong Kong
Unit 1303, 13/F, Dah Sing Financial Centre, 248 Queen's Road East, Wanchai, Hong Kong
Website: www.pcpd.org.hk

If GDPR or UK GDPR applies to our processing of your personal data, you may also have the right to lodge a complaint with the relevant supervisory authority in the European Economic Area or the United Kingdom.