◈ Legal
Privacy Policy
Last Updated: 15 January 2026 · Effective: 15 January 2026
Novathread ("we", "us", "our") is committed to handling personal data responsibly and in accordance with Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"). This Privacy Policy explains how we collect, use, store, and protect personal data in connection with our website and services.
If you have questions about this policy, please contact us at [email protected].
1. Data Controller
The data controller responsible for your personal data is Novathread, registered in Hong Kong SAR, with offices at 118 Connaught Road West, Sai Ying Pun, Hong Kong. Our designated data contact can be reached at [email protected].
2. Data We Collect
Information you provide directly:
- Name and contact details (email address, phone number) submitted via our contact form
- Message content submitted through contact forms
- Business information provided during service enquiries or engagements
Information collected automatically:
- IP address and approximate geographic location
- Browser type and version
- Pages visited and time spent on each page
- Referring website and exit pages
- Cookie identifiers (see our Cookie Policy)
3. Legal Basis for Processing
We process personal data on the following bases:
- Consent: Where you have provided explicit consent (e.g., submitting a contact form or accepting cookies)
- Legitimate interests: For website analytics to improve our services and for responding to general enquiries
- Contractual necessity: Where processing is necessary to deliver services you have engaged us to provide
- Legal obligation: Where processing is required to comply with applicable laws
4. How We Use Personal Data
- To respond to contact form submissions and service enquiries
- To deliver and manage the AI services we have been engaged to provide
- To improve our website and service offerings based on usage patterns
- To comply with legal and regulatory obligations applicable to our business in Hong Kong
- To communicate service updates relevant to your engagement
We do not sell personal data to third parties. We do not use personal data for unsolicited marketing without explicit consent.
5. Data Retention
We retain personal data only for as long as necessary for the purpose it was collected. Contact form enquiries are retained for up to 24 months to facilitate follow-up. Client engagement data is retained for 7 years in line with standard commercial record-keeping obligations. Website analytics data is retained for up to 14 months.
6. Data Sharing
We may share personal data with the following categories of third parties, only where necessary:
- Website hosting and infrastructure providers
- Analytics service providers (e.g., Google Analytics — subject to their privacy terms)
- Professional advisors (legal, accounting) bound by confidentiality obligations
- Regulatory or law enforcement authorities where legally required
We do not share personal data with AI vendors or third-party commercial partners without your explicit consent.
7. Data Protection Measures
We implement appropriate technical and organizational measures to protect personal data, including encrypted data transmission (TLS), access controls limiting data access to authorized personnel, regular internal review of data handling practices, and incident response procedures for potential data breaches. In the event of a data breach that poses risk to affected individuals, we will notify the relevant parties in accordance with our obligations under the PDPO.
8. Cookies
We use cookies and similar technologies on our website. For detailed information, including how to manage your cookie preferences, please see our Cookie Policy.
9. Your Rights Under the PDPO
As a data subject under the PDPO, you have the right to:
- Request access to personal data we hold about you (subject to applicable exemptions)
- Request correction of inaccurate personal data
- Object to the use of your data for direct marketing
- Request information about the categories of personal data we hold and the purposes of use
- Withdraw consent where processing is based on consent
- Lodge a complaint with the Privacy Commissioner for Personal Data (PCPD) of Hong Kong
To exercise any of these rights, please contact [email protected]. We will respond within 40 days as required under the PDPO.
10. Third-Party Links
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their respective privacy policies.
11. Children's Privacy
Our services are directed to businesses and professionals. We do not knowingly collect personal data from individuals under 18 years of age. If you believe we have inadvertently collected such data, please contact us and we will delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via our website. Continued use of our website following any update constitutes acceptance of the revised policy.
13. Contact
Data protection enquiries: [email protected]
Address: 118 Connaught Road West, Sai Ying Pun, Hong Kong
Phone: +852 3629 4187
Privacy Commissioner for Personal Data (PCPD): www.pcpd.org.hk