Sipp Limited ("Sipp", "we", "us") operates this website (sipp.hk) and is the data user of personal data collected through it and related contact channels. We strictly comply with Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO") and its six Data Protection Principles.
1. What we collect
We collect only data that is directly related, necessary and not excessive for the purposes below:
- Information you give us: your name, business name, phone number or email, and your message when you use the website form, WhatsApp or email.
- Technical data: to keep the site secure and working, our hosting provider may process your IP address, browser type and access time.
- Analytics and advertising data: only after you give explicit consent through the cookie banner do we use analytics and advertising cookies to collect browsing data (such as pages viewed and referral source). If you do not consent, these cookies are not activated.
Please do not submit identity card numbers, bank details, health information or other sensitive personal data through the website form.
Providing personal data is voluntary. Without your name and contact details we cannot reply to your enquiry.
2. Purposes
We use your personal data only to:
- reply to your enquiry and arrange a chat or meeting;
- quote for, deliver, invoice and follow up on services you engage us for;
- with your consent, analyse website use to improve content and measure marketing performance;
- comply with legal obligations and lawful requests from law enforcement or regulators.
We will obtain your express and voluntary consent before using your data for any new purpose.
3. Direct marketing
We do not use your personal data for direct marketing, and we do not sell, rent or provide it to anyone for direct marketing. If this ever changes, we will notify you and obtain your consent in advance as required by Part 6A of the PDPO.
4. Disclosure and transfer
We never sell your personal data. We disclose it to third parties only where necessary:
- Service providers (data processors): website hosting (Cloudflare), email and document systems (Google Workspace), and, only with your consent, analytics and advertising services (Google Analytics, Google Ads). We use contractual or other means to ensure they process data only on our instructions, for no other purpose, keep it secure and delete it when no longer needed.
- Partners: if another partner is needed to deliver a service you engaged us for, we share only what that work requires and tell you beforehand.
- Legal requirements: where required by law or court order.
Cross-border transfer: these providers may store or process data outside Hong Kong. We only use providers with appropriate data protection safeguards.
5. Artificial intelligence tools
We may use AI tools in delivering our services. We commit to:
- never entering your personal data into any AI tool without your consent;
- de-identifying personal data before processing wherever possible;
- only using services or settings that commit not to train models on client data.
6. Retention
We keep personal data only as long as needed for its purpose:
- Enquiries that do not lead to further work: deleted within 24 months of the last contact;
- Client and transaction records: kept as required by Hong Kong law (business records are generally kept for 7 years), then deleted;
- Analytics data: kept under the shortest practicable retention setting of the analytics service.
7. Security
We take all practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use, including HTTPS encryption across the site, least-privilege internal access, two-factor authentication on accounts, and removing all system access after a project ends.
8. Cookies
Analytics and advertising cookies are activated only after you consent. You can choose "Accept" or "Decline" on your first visit, change your choice at any time via "Cookie settings" in the footer, or delete cookies in your browser. Declining does not affect your ability to browse or contact us.
9. Your rights
Under the PDPO you have the right to:
- ask whether we hold your personal data and request a copy;
- request correction of inaccurate data;
- ask us to stop using your data for any purpose you have not agreed to, or to delete it when retention is no longer needed;
- withdraw any consent you have given.
We will respond within 40 days of receiving your request. As permitted by the PDPO, we may charge a fee that is not excessive for complying with a data access request; we will tell you beforehand if so.
10. Children
This website and our services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from anyone under 18.
11. Changes
We may update this policy from time to time. The updated version will be posted here with its effective date, and material changes will be clearly highlighted on the website.
12. Contact
For any question, request or complaint about this policy or your personal data, contact our Data Protection Officer:
Email: [email protected] (subject: "Personal data enquiry")
Sipp Limited, Hong Kong
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.
This policy is published in Chinese and English. If there is any inconsistency, the Chinese version prevails.