Privacy Policy

1. Introduction

Thoughtform ("we", "us", "our") is committed to protecting the personal data of every individual who interacts with our website and services. This Privacy Policy describes how we collect, use, store, and protect personal data, and outlines the rights you hold under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) (PDPO). If you have questions about anything described here, you can reach us at [email protected].

2. Data We Collect

We collect personal data through the following means:

• Contact form submissions: name, email address, phone number (optional), and any message content you provide
• Service engagements: business contact details, role information, and any data shared with us in the course of a project
• Website analytics: anonymised usage data collected via cookies (see our Cookie Policy)
• Email correspondence: any information contained in emails you send to us directly

We do not collect sensitive personal data (as defined under PDPO) through our website or standard service interactions.

3. How We Use Your Data

Personal data you share with us is used for the following purposes:

• Responding to enquiries submitted through our contact form
• Delivering the services described in our service agreements
• Sending project-related communications and updates
• Improving our website and services based on aggregated, anonymised analytics
• Complying with applicable legal and regulatory obligations

We do not use your personal data for unsolicited marketing, and we do not sell or share your data with third parties for commercial purposes.

4. Legal Basis for Processing

We process personal data on the following grounds:

• Consent: where you have submitted a contact form or agreed to cookies
• Contractual necessity: where processing is required to deliver services you have engaged us for
• Legitimate interests: for analytics and website improvement, where these interests do not override your rights
• Legal obligation: where processing is required by Hong Kong law or regulation

5. Data Retention

We retain personal data for no longer than is necessary for the purpose it was collected. Specifically:

• Contact form enquiries that do not lead to an engagement: deleted within 12 months
• Client project data: retained for 3 years following project completion, then securely deleted unless legal obligations require longer retention
• Financial records: retained for 7 years as required under Hong Kong tax and accounting regulations
• Analytics data: retained in anonymised, aggregated form; no individual-level retention beyond 26 months

6. Data Security

We take the protection of personal data seriously. Our security measures include:

• Encrypted data storage and transmission (TLS for all web traffic)
• Access controls limiting personal data to authorised team members only
• Documented data handling procedures reviewed annually
• Secure deletion of data at the end of its retention period

In the event of a data breach that affects your personal data, we will notify you and, where required, the Office of the Privacy Commissioner for Personal Data (PCPD) within a reasonable timeframe.

7. Cookies

Our website uses cookies to understand how it is used and to maintain basic functionality. We use essential cookies (which cannot be disabled) and optional analytics cookies (which you can decline). Full details are provided in our Cookie Policy.

8. Third-Party Services

We use a limited number of third-party services that may process data on our behalf:

• Website analytics: anonymised traffic data processed under data processing agreements
• Email services: used to send and receive correspondence; governed by our provider's data processing terms

We do not embed social media trackers or share personal data with advertising networks.

9. Your Rights Under PDPO

Under Hong Kong's Personal Data (Privacy) Ordinance, you have the right to:

• Request access to personal data we hold about you (Data Access Request)
• Request correction of inaccurate personal data (Data Correction Request)
• Withdraw consent for processing where consent is the legal basis
• Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD)

To exercise these rights, contact us at [email protected]. We will respond within 40 days as required by PDPO. A fee may apply for data access requests in accordance with PDPO provisions.

10. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend that you review their policies directly.

11. Children's Privacy

Our services are intended for business use by organisations and adult individuals. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted data through our site, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be noted with a revised "Last Updated" date at the top of this page. Continued use of our website or services following changes constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions, data access or correction requests, or complaints about how we handle your personal data, please contact:

Thoughtform
88 Queensway, Admiralty, Hong Kong
Email: [email protected]
Phone: +852 5936 2748

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner for Personal Data (PCPD) at www.pcpd.org.hk.