Legal

Privacy Policy

Last Updated: 18 March 2025 · Effective: 18 March 2025

gantwellm ("we", "us", "our") is committed to protecting the personal data of individuals who interact with our website and services. This Privacy Policy explains how we collect, use, and protect your personal information in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO") and, where applicable, the General Data Protection Regulation ("GDPR").

1. Introduction and Scope

This policy applies to personal data collected through our website at https://{{DOMAIN}}, through our contact forms, and in the course of client engagements. It does not cover data held under separate contractual arrangements governed by engagement-specific non-disclosure agreements.

2. What Personal Data We Collect

We may collect the following categories of personal data:

Name and contact details (email address, telephone number)
Business name and job title (where provided)
Information submitted through our enquiry form (including messages and queries)
Technical data including IP address, browser type, and pages visited (collected via analytics tools where consented)
Cookie preferences and consent records

3. How We Collect Personal Data

Personal data is collected through:

The enquiry and contact form on our website
Direct email or telephone communication initiated by you
Cookies and website analytics tools (subject to your consent)
In-person meetings or engagement scoping discussions

4. Legal Basis for Processing

We process personal data on the following bases:

Consent: Where you have provided explicit consent, for example by submitting our contact form or accepting analytics cookies.
Legitimate interests: For responding to enquiries, managing client relationships, and improving our services, where these interests are not overridden by your rights.
Contractual necessity: Where processing is required to fulfil an engagement or pre-contractual obligation.
Legal obligation: Where processing is required to comply with applicable law.

5. How We Use Your Personal Data

To respond to enquiries submitted through our contact form
To schedule and manage initial consultation conversations
To deliver and administer consulting engagements
To send relevant service information where you have consented to receive communications
To improve our website and service based on aggregated analytics data
To comply with legal and regulatory obligations

6. Data Retention

We retain personal data for the following periods:

Enquiry form submissions: 12 months from date of submission, unless an engagement commences
Client engagement data: 7 years from the conclusion of the engagement, in accordance with standard business record obligations under Hong Kong law
Cookie and analytics data: in accordance with the retention periods described in our Cookie Policy

7. Data Sharing

We do not sell, rent, or trade personal data. We may share data with:

IT service providers and hosting companies who process data on our behalf under appropriate data processing agreements
Professional advisers (legal, accounting) where necessary and subject to confidentiality obligations
Regulatory or law enforcement authorities where required by applicable law

8. Data Security

We maintain appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, or destruction. These include encrypted data storage, access controls restricted to authorised personnel, and regular review of our security practices. In the event of a data breach that is likely to affect your rights or freedoms, we will notify you and the Office of the Privacy Commissioner for Personal Data (PCPD) as required by law.

9. Cookies

We use cookies on our website. For a full explanation of the types of cookies used, their purposes, and how to manage your preferences, please see our Cookie Policy.

10. Your Rights

Under the PDPO and, where applicable, the GDPR, you have the following rights:

Right to access personal data we hold about you
Right to correction of inaccurate or incomplete data
Right to erasure (in certain circumstances)
Right to data portability (under GDPR, where applicable)
Right to object to processing based on legitimate interests
Right to withdraw consent at any time (where processing is consent-based)
Right to lodge a complaint with the PCPD (Hong Kong) or a relevant supervisory authority

To exercise any of these rights, please contact us at privacy@{{DOMAIN}}. We will respond within 30 days.

11. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their respective privacy policies.

12. Children's Privacy

Our services are directed at business professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors.

13. International Data Transfers

We operate primarily in Hong Kong. If personal data is transferred outside Hong Kong, we ensure appropriate safeguards are in place in accordance with the requirements of the PDPO and applicable international data protection standards.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via a notice on our website. Continued use of our website following such changes constitutes acceptance of the revised policy.

15. Contact Information

For privacy-related queries or to exercise your data rights:

Email: privacy@{{DOMAIN}}
Post: gantwellm, 24/F, United Centre, 95 Queensway, Admiralty, Hong Kong
PCPD: Office of the Privacy Commissioner for Personal Data, www.pcpd.org.hk