Privacy Policy

lionroock Consulting Limited ("lionroock", "we", "us", "our") is committed to protecting the personal data of individuals who interact with our website and engage with our services. This Privacy Policy describes what data we collect, how we use it, the basis for doing so, and your rights under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO").

1. Data Controller

The data controller responsible for your personal data is lionroock Consulting Limited, Unit 12, 27th Floor, Capital Tower, 161 Queen's Road East, Wan Chai, Hong Kong. For data-related enquiries, contact us at [email protected].

2. Data We Collect

We collect the following categories of personal data:

• Contact and identity data: name, email address, phone number, company name, and job title — provided when you submit an enquiry or contact us directly.
• Correspondence data: the content of messages you send via our contact form or by email.
• Usage data: IP address, browser type, pages visited, and session duration — collected via analytics tools when you visit our website.
• Cookie data: preferences and consent records stored in your browser. See Section 8 and our Cookie Policy for details.

We do not collect sensitive personal data (such as financial account details or identification documents) through this website. Sensitive materials shared during a consulting engagement are governed by a separate confidentiality agreement.

3. Legal Basis for Processing

• Consent: where you have actively provided your data by submitting an enquiry form or accepting cookies.
• Legitimate interests: for website analytics used to improve the quality and performance of this website.
• Contract: where processing is necessary to respond to an enquiry that may lead to a consulting engagement.
• Legal compliance: where we are required to retain data by applicable law.

4. How We Use Your Data

• To respond to your enquiries and schedule initial consultations.
• To provide and manage consulting services where an engagement is agreed.
• To send relevant communications about our services (with your consent; you may withdraw at any time).
• To improve our website through aggregated, anonymised usage analysis.
• To comply with legal and regulatory obligations applicable in Hong Kong.

5. Data Retention

We retain personal data only for as long as necessary:

• Enquiry and contact data: up to 24 months from last contact, unless an engagement follows.
• Engagement-related data: up to 7 years following the close of an engagement, in line with Hong Kong commercial record-keeping obligations.
• Website usage/analytics data: typically retained in aggregated form for up to 26 months.
• Cookie consent records: up to 12 months.

6. Data Sharing

We do not sell personal data. We may share data with:

• Service providers: web hosting providers and analytics tools (e.g. Google Analytics) acting as data processors under contractual data protection obligations.
• Professional advisors: legal or accounting advisors where necessary to protect our legal interests.
• Regulatory authorities: where required by Hong Kong law or court order.

All third-party processors are required to handle your data in a manner consistent with this policy and applicable law.

7. Data Security

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include encrypted data transmission (HTTPS), access controls on internal systems, and periodic security reviews. In the event of a data breach affecting your personal data, we will notify you and the relevant authority as required under applicable Hong Kong law.

8. Cookies

Our website uses cookies to support site functionality and to understand how visitors use the site. For detailed information, including how to manage your cookie preferences, please see our Cookie Policy.

9. Your Rights under the PDPO

Under Hong Kong's Personal Data (Privacy) Ordinance, you have the right to:

• Request access to personal data we hold about you (Data Access Request).
• Request correction of inaccurate personal data (Data Correction Request).
• Withdraw consent to the use of your data for direct marketing at any time.
• Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) at www.pcpd.org.hk.

To exercise your rights, contact us at [email protected]. We will respond within 40 days as required by the PDPO. A reasonable administrative fee may apply for data access requests.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policy of any external site you visit.

11. Children's Privacy

Our services are directed to business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted personal data through our website, contact us at [email protected] and we will take appropriate steps to delete that data.

12. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated via notice on this page. The "Last Updated" date at the top of this page indicates when the most recent revision was made. Continued use of our website following publication of an updated policy constitutes acceptance of the changes.

13. Contact for Privacy Enquiries

For all privacy-related questions, access requests, or complaints, please contact:

• Email: [email protected]
• Address: Unit 12, 27th Floor, Capital Tower, 161 Queen's Road East, Wan Chai, Hong Kong