1. Who we are
TMT Services Ltd ("TMT Services", "we", "us") is a company incorporated in Hong Kong SAR with its business office in Central, Hong Kong SAR. We provide corporate consulting, technology and trade services.
For the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO"), TMT Services Ltd is the data user in respect of personal data collected through this website and in the course of our business, and you are the data subject.
2. The law we follow
Our handling of personal data is governed by the PDPO, which is administered and enforced by the Office of the Privacy Commissioner for Personal Data, Hong Kong ("PCPD"). The PDPO is principle-based: the Data Protection Principles ("DPPs") are set out in Schedule 1 to the PDPO. This is what they require, and what we do about each of them.
| Principle | What it requires | How we comply |
|---|---|---|
| DPP1 Purpose and manner of collection |
Personal data may only be collected for a lawful purpose directly related to a function or activity of the data user; the data must be necessary and adequate but not excessive for that purpose; collection must be by lawful and fair means. | We collect only what is needed for the purpose stated at the point of collection, and we state that purpose on the form or in our Personal Information Collection Statement. |
| DPP2 Accuracy and duration of retention |
Data must be accurate, and must not be kept longer than necessary for the purpose for which it is used. | We keep records up to date and apply a retention schedule; data no longer required is erased (see also section 7 below). |
| DPP3 Use of personal data |
Data must not be used for a new purpose unrelated to the original purpose, unless the data subject gives express and voluntary consent. Consent can be withdrawn by written notice. | We use personal data only for the purpose we collected it for. If we ever need to use it for something else, we ask you first and we honour any withdrawal of consent. |
| DPP4 Data security |
All practicable steps must be taken to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. Data processors must be bound by contractual or other means to meet the same standard. | Access is limited to staff who need it; we use encryption in transit and contractual data-processing terms with our service providers. |
| DPP5 Openness and transparency |
Data users must be open about their personal data policies and practices, the kinds of personal data they hold and the main purposes for holding it. | This Privacy Policy Statement, our Personal Information Collection Statement and our Cookie Policy are published on this website and are kept current. |
| DPP6 Access and correction |
Data subjects have the right to request access to, and correction of, their own personal data. Reasons must be given if a request is refused. | We handle access and correction requests as described in section 10 below, and we give reasons if we refuse a request. |
Where our website or our engagements involve service providers that process personal data on our behalf (data processors), the PDPO holds us — not them — responsible: we are required to ensure by contractual or other means that they meet the applicable requirements.
3. Personal data we collect
We collect personal data in these situations:
- When you contact us through this website — the name and email address you enter, the company name if you provide it, and the content of your message. The form does not send data to our web server: it opens your own email application and sends the message from your mailbox to ours. See our Personal Information Collection Statement for the DPP1 notice that applies to this form.
- When you email or call us — your contact details and whatever you choose to tell us.
- When you engage us for services — the contact details of your staff and representatives, and any personal data contained in documents you send us in the course of the engagement.
- When you apply for a job with us — the contents of your application. See Careers for the recruitment notice that applies.
We do not use this website to collect identity documents, financial account numbers, health data or any other special category of data, and we ask you not to send such data through the website contact form.
4. How we use it
We use personal data for the following purposes only:
- to respond to your enquiry and to correspond with you;
- to provide, administer and improve the services you have engaged us for, and to keep records of our professional work;
- to comply with our legal, regulatory, tax and accounting obligations;
- to assess job applications and manage recruitment;
- to protect our legal rights and to prevent or detect misuse of our website or services.
5. Who we may share it with
We do not sell, rent or trade personal data. We may disclose it to the following classes of persons, and only so far as is necessary for the purposes above:
- our own staff and professional advisers who need the data for the purpose it was collected for;
- service providers who process data on our behalf, such as our email and document platform provider, our website host and our IT support provider — these are data processors, and we bind them contractually to appropriate standards of confidentiality and security;
- our auditors, insurers, bankers and legal advisers, where required in the ordinary course of business;
- a government department, regulator, law enforcement agency or court, where we are required to disclose by law, court order or a valid legal request, or where disclosure is necessary to prevent or detect crime;
- an actual or prospective purchaser of our business or assets, under confidentiality, if we were ever to restructure or sell.
6. Direct marketing
We will not use your personal data for direct marketing, and we will not provide it to a third party for direct marketing, unless we have first obtained your informed consent in accordance with the applicable provisions of the PDPO.
Where we ask for such consent we will tell you: that we intend to use or provide the data for direct marketing, that we cannot do so without your consent, the kinds of personal data involved, the classes of marketing subjects involved, whether the data would be provided to a third party and, if so, the classes of recipients and whether the data would be provided for gain — and we will tell you how to opt out. Silence is not consent.
You may withdraw your consent at any time by writing to us at the address in section 14. We will stop using your data for direct marketing within the period required by the PDPO, and at no cost to you.
7. Retention
We keep personal data only for as long as is necessary to fulfil the purpose for which it was used, plus any period required by law:
| Data | Typical retention period |
|---|---|
| Unsuccessful enquiry / general correspondence | Up to 24 months from the last contact |
| Client engagement records | 7 years after the end of the engagement, or longer where the engagement requires it |
| Recruitment records for unsuccessful applicants | Up to 24 months, unless you ask us to keep them longer |
| Accounting and tax records | As required by Hong Kong law |
When data is no longer required we take all practicable steps to erase it, unless erasure is prohibited by law or it is not in the public interest to erase it.
8. Security
We take all practicable steps to protect personal data held by us against unauthorised or accidental access, processing, erasure, loss or use. These steps include limiting access to staff and contractors who need it for their work, requiring confidentiality, using access controls and up-to-date software, and securing data in transit. We review our security measures as the nature of the data we hold and the risks change.
No method of transmission over the internet is completely secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.
9. Overseas storage and processing
We are a Hong Kong company and our own records are held in Hong Kong, but we use reputable cloud service providers for email, documents and web hosting. Those providers may store or process data on servers located outside Hong Kong. Where personal data is transferred outside Hong Kong in this way, we continue to take the steps required of us under DPP4, and we assess our providers' security and contractual terms before use.
10. Your rights: access and correction
Under the PDPO you have the right to:
- ask whether we hold personal data about you, and request a copy of it (a data access request);
- request correction of personal data about you that is inaccurate (a data correction request);
- be told the reasons if we refuse such a request.
Requests should be made in writing to the address in section 14 and should identify you and the data concerned. We will respond within the period prescribed by the PDPO, which is generally 40 days after receiving the request and any fee. The PDPO permits a data user to charge a fee for complying with a data access request; where a fee applies we will tell you the amount before we proceed.
If you consider that we have not handled your personal data in accordance with the PDPO, you may complain to us first, or make a complaint to the Office of the Privacy Commissioner for Personal Data (PCPD), whose website is www.pcpd.org.hk. You also have the right to seek compensation from us in the courts for damage caused by a contravention of the PDPO.
11. Cookies
This website sets no cookies of its own and uses no analytics, advertising or tracking technologies. See our Cookie Policy for the full position, including the effect of the web font service we load from Google.
12. Children
Our website and our services are directed at businesses and are not intended for children. We do not knowingly collect personal data from anyone under 18 through this website. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Changes to this statement
We may update this Privacy Policy Statement to reflect changes in our practices or in the law. The current version is always published on this page with the date it was last updated. Material changes will be given prominence on the website.
14. How to contact us
For any privacy question, or to make a data access or data correction request, please write to:
- Data protection contact
- The Director, TMT Services Ltd
- Address
- Central, Hong Kong SAR
- info@tmtserviceshk.com
Please mark the subject line "Personal Data" so that your message is handled by the right person.