Privacy Policy

1. Introduction

Thumon ("we", "us", or "our") is committed to protecting the privacy of individuals who interact with our website and services. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website, submit enquiries, or engage our consulting services.

Thumon operates from Hong Kong and processes data in compliance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO"). If you have questions about this policy, please contact us at [email protected].

2. Data We Collect

We may collect the following categories of personal data:

Information you provide directly: When you submit a form on our website or contact us by email or phone, we may collect your name, email address, phone number, company name, and any details you include in your message.

Information collected through technology: When you visit our website, we may collect technical data such as your IP address, browser type, operating system, referring URL, pages visited, and time spent on our site. This data is collected through cookies and similar technologies, as described in our Cookie Policy.

Engagement data: If you become a client, we may collect additional information necessary for delivering our services, including business documents, financial data, and regulatory filings that you share with us during the engagement.

3. How We Use Your Data

We use your personal data for the following purposes:

Service delivery: To respond to your enquiries, provide consulting services, and communicate with you about engagements.

Website improvement: To understand how visitors use our website and to improve its functionality and content.

Communication: To send you information relevant to our services, but only where you have given consent or where we have a legitimate business reason to do so.

Legal compliance: To comply with applicable laws, regulations, and legal processes in Hong Kong.

4. Legal Basis for Processing

Under the PDPO, we process your personal data based on one or more of the following grounds: your consent (for example, when you submit a contact form), the performance of a contract or steps taken at your request prior to entering into a contract, compliance with legal obligations, and our legitimate business interests in providing and improving our services.

5. Data Sharing

We do not sell your personal data. We may share your data with trusted third-party service providers who assist us in operating our website and delivering our services — for example, hosting providers and analytics services. These providers are contractually obligated to handle your data securely and only for the purposes we specify.

We may also disclose personal data if required by law, regulation, or legal process, or to protect our rights and the safety of our clients.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Contact form submissions are retained for up to 24 months. Client engagement data is retained for a period of seven years following the conclusion of the engagement, in line with Hong Kong's record-keeping requirements. Website analytics data is retained in anonymised form.

7. Data Protection Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted data transmission, secure server infrastructure, access controls limited to authorised personnel, and regular review of our security practices.

In the event of a data breach that poses a significant risk to your rights and freedoms, we will notify the affected individuals and the Privacy Commissioner for Personal Data as appropriate.

8. Cookies

Our website uses cookies to improve your experience and to collect analytics data. For detailed information about the types of cookies we use, how you can manage them, and your options for opting out, please refer to our Cookie Policy.

9. Your Rights

Under the PDPO, you have the right to request access to the personal data we hold about you, request correction of inaccurate personal data, request the cessation of use of your data for direct marketing purposes, and withdraw consent where processing is based on consent.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 40 days, as required by the PDPO.

10. Third-Party Links

Our website may contain links to external websites that are not operated by us. We are not responsible for the privacy practices of these third-party sites and encourage you to review their privacy policies independently.

11. Children's Privacy

Our services are intended for individuals aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. Any updates will be posted on this page with a revised "Last Updated" date. We encourage you to review this policy periodically.

13. Contact Information

Data Controller: Thumon

Address: 15/F, Prosperity Tower, 39 Queen's Road Central, Central, Hong Kong

Email: [email protected]

If you are not satisfied with our response to a privacy concern, you may contact the Office of the Privacy Commissioner for Personal Data, Hong Kong.