Privacy Policy

Introduction

Galdric ("we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, process, and safeguard your personal information in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong.

This policy applies to information we collect through our website, consulting engagements, and any other interactions you have with our organization. By using our services or providing us with your personal data, you consent to the practices described in this policy.

Data Collection

Personal Data We Collect

We collect personal data that you voluntarily provide to us when you:

• Complete contact forms on our website
• Request information about our services
• Enter into consulting engagements with us
• Communicate with us via email, phone, or other channels
• Subscribe to our communications

The types of personal data we may collect include:

• Name and contact information (email address, phone number, business address)
• Organization name and role
• Professional background and qualifications
• Information relevant to consulting engagements
• Communication preferences
• Website usage data (through cookies and analytics)

How We Use Your Data

Purposes of Data Processing

We process your personal data for the following purposes:

• Responding to your inquiries and providing requested information
• Delivering consulting services and fulfilling contractual obligations
• Communicating with you about our services, projects, and engagements
• Sending relevant business communications (with your consent)
• Improving our website, services, and customer experience
• Complying with legal and regulatory requirements
• Conducting internal business operations and administration

Legal Basis for Processing

We process your personal data based on:

• Your consent (which you may withdraw at any time)
• Performance of a contract to which you are party
• Compliance with our legal obligations
• Legitimate interests pursued by our organization

Data Sharing and Third Parties

We do not sell, rent, or trade your personal data. We may share your information with:

• Professional service providers who assist us in operating our business (such as IT service providers, accounting firms)
• Legal and regulatory authorities when required by law
• Third parties in connection with business transfers or reorganization

All third-party service providers are required to maintain appropriate security measures and process data only for specified purposes. We ensure that appropriate contractual safeguards are in place before sharing data.

Analytics Services

We use analytics services (such as Google Analytics) to understand how visitors use our website. These services may collect information such as IP addresses, browser types, and page views. This data is used in aggregate form to improve our website and services.

Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Secure server infrastructure with regular security updates
• Access controls limiting data access to authorized personnel
• Regular security assessments and monitoring
• Staff training on data protection and confidentiality

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot provide absolute assurance regarding data security but maintain rigorous protocols to minimize risks.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal, accounting, or reporting requirements.

Typical retention periods include:

• Client engagement data: 7 years after engagement completion
• Inquiry and communication records: 3 years from last contact
• Marketing communications: Until consent is withdrawn
• Website analytics data: 26 months

Once the retention period expires, personal data is securely deleted or anonymized.

Your Rights

Under the Personal Data (Privacy) Ordinance, you have the following rights:

• Right to access your personal data held by us
• Right to request correction of inaccurate or incomplete data
• Right to request erasure of your personal data (subject to legal retention requirements)
• Right to object to data processing for direct marketing purposes
• Right to withdraw consent where processing is based on consent
• Right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within a reasonable timeframe, typically within 30 days.

Cookies

Our website uses cookies and similar technologies to enhance user experience and collect usage information. Cookies are small data files stored on your device.

We use the following types of cookies:

• Essential cookies: Required for website functionality
• Analytics cookies: Help us understand website usage patterns
• Preference cookies: Remember your settings and preferences

For detailed information about cookies, please see our Cookie Policy.

Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will delete such information.

International Data Transfers

Your personal data is primarily stored and processed in Hong Kong. In some cases, data may be transferred to service providers located in other jurisdictions. When such transfers occur, we ensure appropriate safeguards are in place through contractual measures and compliance with applicable data protection requirements.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this policy.

We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.