Privacy Policy
Apex Digital Services Limited
1. Who we are
Apex Digital Services Limited ("Apex Digital", "we", "us", "our") is a private company limited by shares incorporated in Hong Kong under company number 80554647.
We are the "data user" of the personal data described in this Privacy Policy within the meaning of the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"). Where the EU General Data Protection Regulation ("GDPR") or the UK GDPR applies, we are the "controller". In both cases, this means we decide how and why your personal data is used.
2. Scope of this Policy
This Policy explains how we collect and use personal data when you:
- visit our website at https://apex-digital.ltd (the "Website");
- contact us through the Website form, by email or through other channels;
- are a prospective or existing client, or a contact person at a client, supplier or business partner.
This Policy does not cover personal data we process on behalf of our clients when we deliver software development, consulting, marketing or other services. In those cases, our client is the controller (data user) and we act as its processor (data processor) under a separate data processing agreement. Please refer to that client's privacy notice.
The Website may contain links to third-party websites. We are not responsible for their content or privacy practices, and we encourage you to read their privacy notices.
3. Personal data we collect
Data you give us
- Contact form and emails: name, email address, company name (optional) and the content of your message.
- Business relationship data: job title, phone number, project details, contract and invoicing details, and our correspondence with you.
Data collected automatically
- Technical data: IP address, browser type and version, device type, operating system, date and time of access, and pages viewed. Our hosting provider records this data in server logs for the security and operation of the Website.
- Cookie data: see Section 5.
Data from other sources
We may receive business contact details (name, job title, company, business email and phone number) from public sources, such as company websites, public registers or professional networks, or from people who refer you to us. Where we obtain your data in this way, we will inform you of this Policy when we first contact you.
4. How we use personal data and our legal bases
We collect and use personal data only for the purposes below, which are directly related to our business. Under the PDPO, we will not use your personal data for a new purpose without your prescribed (express and voluntary) consent. If you are in the EEA or the UK, the table also shows the legal basis we rely on under the GDPR or UK GDPR.
| Purpose | Personal data | Legal basis (EEA/UK) |
|---|---|---|
| Reply to your enquiry and prepare a proposal | Contact form and email data | Steps at your request before entering into a contract; our legitimate interest in responding to business enquiries |
| Enter into and perform a contract with you or your organisation | Business relationship data | Performance of a contract; our legitimate interest in managing relationships with clients' and partners' contact persons |
| Invoicing, payments, accounting and tax | Contract and invoicing details | Compliance with legal obligations; performance of a contract |
| Compliance checks by banks and payment providers (KYC/AML) | Identification and business data of clients and their representatives | Compliance with legal obligations; our legitimate interest in maintaining banking and payment services |
| Operate and secure the Website, prevent fraud and misuse | Technical data, strictly necessary cookie data | Our legitimate interest in a secure and functioning Website |
| Establish, exercise or defend legal claims | Relevant data from the categories above | Our legitimate interest in protecting our legal rights |
| Send business updates about our services (only with your consent) | Name, email address, company name | Consent |
| Comply with requests from courts, regulators and law enforcement | Relevant data from the categories above | Compliance with legal obligations |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more information about this assessment.
5. Cookies and similar technologies
The Website uses only strictly necessary cookies and similar technologies that are needed to load the Website securely and deliver the content you request. We do not use analytics, advertising or tracking cookies. Strictly necessary cookies do not require your consent, so we do not show a cookie consent banner.
You can block or delete cookies in your browser settings, but parts of the Website may then not work properly. If we start using non-essential cookies in the future, we will update this Policy and ask for your consent before placing them.
6. Who we share personal data with
We do not sell personal data. We share it only where needed for the purposes in Section 4, with the following classes of recipients:
- Service providers (processors): website hosting, email and office software, cloud storage and IT support. They act only on our instructions and under written contracts that require them to protect your data.
- Banks and payment service providers: to receive and send payments, including the identity verification and anti-money laundering checks they are required to carry out. These providers act as independent controllers and process your data under their own privacy notices.
- Professional advisers: lawyers, accountants and auditors, who are bound by confidentiality duties.
- Public authorities: courts, regulators, tax authorities and law enforcement agencies, where we are required by law or need to protect our legal rights.
- Successors to our business: a buyer or investor, and its advisers, in connection with a merger, acquisition, restructuring or sale of all or part of our business, under confidentiality obligations.
We do not share your personal data with third parties for their own direct marketing.
7. International transfers
We are based in Hong Kong. Our team members and service providers may be located in other countries. This means your personal data may be transferred to, stored in or accessed from a country other than the one where you live.
Where we transfer personal data from the EEA to a country that does not have an EU adequacy decision (including Hong Kong), we use the European Commission's Standard Contractual Clauses. For transfers from the UK, we use the UK International Data Transfer Addendum to those clauses or another mechanism approved under UK law. Where needed, we also apply additional safeguards, such as encryption and access controls.
8. How long we keep personal data
We keep personal data only for as long as needed for the purposes in Section 4. After that, we delete or anonymise it, in line with the PDPO requirement not to keep personal data longer than necessary.
| Data | Retention period |
|---|---|
| Enquiries that do not lead to a contract | 24 months after our last contact |
| Client and contract data, correspondence | Term of the contract plus 7 years, to meet Hong Kong accounting and tax record-keeping rules and for possible legal claims |
| Invoicing and accounting records | At least 7 years, as required by Hong Kong law |
| Marketing consent records | Until you withdraw consent, plus 24 months as evidence of consent |
| Server logs | Up to 90 days, unless needed to investigate a security incident |
| Strictly necessary cookies | For the duration of your browsing session, or up to 12 months for cookies that remember your settings |
We may keep data for longer where required by law or to deal with an ongoing dispute or investigation.
9. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. These include encryption in transit (HTTPS), access controls on a need-to-know basis, multi-factor authentication on our business systems, and confidentiality obligations for our staff and contractors. We also require our processors, by contract, to apply equivalent measures.
No system is completely secure. If a personal data breach occurs, we will act promptly to contain it. Where required by law, we will notify the competent supervisory authority (for EEA/UK data, within 72 hours of becoming aware of the breach) and inform affected individuals without undue delay. We may also notify the Office of the Privacy Commissioner for Personal Data, Hong Kong, where appropriate.
10. Your rights
All individuals. Under the PDPO, you can ask us to:
- confirm whether we hold your personal data and give you a copy (data access request);
- correct personal data that is inaccurate (data correction request).
We will respond to data access and correction requests within 40 days. We may charge a fee for a data access request that is not excessive, as the PDPO allows. We will not charge for correction requests. You can also ask us at any time to stop using your data for direct marketing, free of charge.
If you are in the EEA or the UK, you also have the right to:
- ask us to delete your personal data;
- restrict our processing, or object to processing based on legitimate interests;
- object at any time to direct marketing;
- receive the data you gave us in a structured, machine-readable format and have it sent to another controller;
- withdraw your consent at any time, without affecting processing carried out before the withdrawal;
- lodge a complaint with the data protection authority in the country where you live or work, or where an alleged infringement took place.
We will reply to EEA/UK requests within one month. We may extend this by two further months for complex or numerous requests, and we will tell you if we do. Requests are free of charge, unless they are manifestly unfounded or excessive.
11. Other important information
Children. Our Website and services are intended for businesses. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
Direct marketing. We will use your name, email address and company name to send you information about our software development, IT, consulting and digital marketing services only if you have given your consent. We will not transfer your personal data to others for their direct marketing. You can withdraw your consent at any time, free of charge, by using the unsubscribe link in each marketing email or by contacting us.
Automated decisions. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
Providing data. You are not required to give us personal data. However, if you do not provide the data we need to reply to your enquiry or to enter into and perform a contract, we may not be able to do so.
Changes to this Policy. We may update this Policy from time to time. We will post the new version on this page and change the "Last updated" date at the top. For material changes, we will notify our clients directly before the changes take effect.
Language. If this Policy is translated into another language, the English version prevails.
Contact. Apex Digital Services Limited, Privacy / General enquiries: sales@apex-digital.ltd.