Privacy Policy.

Last updated: ____________________ . This policy applies to www.imsg.com.hk and to the personal data IMSG Corporate Services Limited collects through it.

1. Who we areTBC · Vivien

IMSG Corporate Services Limited (“IMSG”, “we”, “us”, “our”) is a company incorporated in Hong Kong and a licensed trust or company service provider. Our TCSP licence number is TC004818 [RE-VERIFY]. Our registered office and place of business is Suite 4002A, 40/F, Tower 1, Lippo Centre, 89 Queensway, Admiralty, Hong Kong. You can reach us on +852 2127 4237, or at comsec@imsg.com.hk.

For the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) (the “Ordinance”) we are the data user in respect of the personal data described in this policy. We take our obligations under the Ordinance and the six Data Protection Principles in Schedule 1 to it seriously, and this policy is published partly to satisfy Data Protection Principle 5, which requires us to be open about our personal data policies and practices.

2. What personal data we collect, and howTBC · Vivien

From the forms on this website. When you book a consultation or send an enquiry we collect your name, your email address, your company name, the service you are asking about, a WhatsApp or telephone number if you choose to give us one, and whatever you choose to write in the question, message or notes field. If you ask for a consultation we also record the date and time slots you chose.

When you contact us directly. If you email, telephone or message us we hold what you send and a record of the exchange.

If you become a client. We collect the customer due diligence information the law requires us to obtain and verify — which will include identity documents, proof of address, and information about ownership and control of your company — together with the records needed to deliver the services you have engaged us for. Section 6 of this policy explains how long we must keep it.

Automatically, when you use the site. Hosting and security providers process technical request information needed to serve and protect the website. Optional analytics and advertising collection requires your consent. Section 8 explains the configured technologies and controls.

We do not deliberately collect personal data about children, and we do not seek to collect any of the categories of data — such as health data or identity card numbers — that go beyond what our services need, except where customer due diligence obligations require us to.

3. Whether you have to give it to usTBC · Vivien

Giving us your personal data through this website is entirely voluntary. If you choose not to, we simply will not be able to reply to you or arrange a consultation. If you engage us as a client the position changes: we are required by law to obtain and verify certain information about you before we can act, and if you do not provide it we cannot take you on or continue to act.

4. What we use it forTBC · Vivien

We use personal data collected through this website for the following purposes and for purposes directly related to them:

• replying to your enquiry and dealing with the matter you have raised;
• arranging, confirming and conducting consultations, including sending you a calendar invitation;
• preparing fee quotations and engagement letters;
• carrying out customer due diligence and the ongoing monitoring required of us as a licensed trust or company service provider, and meeting our other obligations under anti-money-laundering law;
• providing, administering and billing for the services you engage us for;
• keeping our own records, including our accounting records, and managing our internal administration;
• complying with any legal or regulatory obligation, responding to any court order, and establishing, exercising or defending legal claims;
• maintaining the security and proper operation of our systems and this website; and
• understanding how this website is used so that we can improve it.

Data Protection Principle 3 prevents us from using your personal data for a new purpose that is not the purpose we collected it for, or directly related to it, unless you consent. If we ever want to do that, we will ask you first.

5. Who we may pass it toTBC · Vivien

We do not sell personal data. We may transfer it to the following classes of person, and only so far as is necessary for the purposes in section 4:

• the directors, employees, contractors and professional advisers of IMSG;
• our service providers, including our information technology, email, hosting, website, calendar, document storage, backup and [ ____________________________ ] providers;
• where you engage us, third parties whose involvement your instructions require — for example the Companies Registry, the Inland Revenue Department, banks, auditors, offshore registered agents and registries in the British Virgin Islands, the Marshall Islands and the Cayman Islands, and any lawyer or other adviser you ask us to deal with;
• any regulator, law enforcement agency, court or government body, where we are required or permitted by law to disclose; and
• a purchaser or prospective purchaser of our business or its assets, subject to appropriate confidentiality protections.

Where we engage a service provider to process personal data on our behalf, the Ordinance requires us to use contractual or other means to prevent the data being kept longer than is necessary and to prevent unauthorised or accidental access, processing, erasure, loss or use. We do so.

6. How long we keep itTBC · Vivien

Data Protection Principle 2(2) requires us not to keep personal data longer than is necessary for the purpose it is used for, and section 26 of the Ordinance requires us to take all practicable steps to erase personal data that is no longer required. Against that, some of what we hold we are required by law to keep.

Enquiries that do not become engagements. IMSG has not set a fixed deletion period and retains these records until deletion. This retention practice remains subject to legal review and applicable personal-data obligations.

Client records — accounting. Section 51C of the Inland Revenue Ordinance (Cap. 112) requires records of business transactions to be kept for at least seven years from the completion of the transaction.

Everything else. We keep it for as long as it is needed for the purpose it was collected for, and then delete it. [SET OUT ANY OTHER SPECIFIC RETENTION PERIODS HERE: ____________________________________________________ ]

7. Direct marketingTBC · Vivien

We do not use enquiry details collected through this website for direct marketing, and do not provide them to others for their direct marketing.

8. Cookies, analytics and website technologyTBC · Vivien

Hong Kong has no statute equivalent to the European Union’s ePrivacy rules, and there is no Hong Kong law that requires a website to obtain a visitor’s consent before setting a cookie. What the Ordinance requires is that where a cookie or similar technology collects personal data, the collection must be for a lawful purpose directly related to our activities, must be necessary and not excessive, must be by fair means, and must be explained to you — which is what this section does.

Necessary storage. This site remembers your language and consent choices in browser storage. These preferences support the site’s operation; they should not be treated as a guarantee that a visit is anonymous.

Optional analytics. Google Analytics 4 is configured through Google Tag Manager to measure pages, visits and permitted interaction events after consent and release of the tracking configuration. The preview’s vendor tags remain paused and unpublished. The current account settings retain event data for two months and user data for fourteen months. Form text and search questions are not included in analytics events.

Advertising attribution. After you accept optional tracking, the site may store a reference, landing page, referring site and advertising click identifiers in browser storage for up to 90 days. These attribution details may accompany your enquiry and permitted measurement events. Rejecting or withdrawing consent stops this optional collection and clears the site’s stored attribution; it does not recall data already sent to providers.

Website resources. Site fonts, images and application files are served through IMSG’s hosting. Following a link to an external website, WhatsApp or a video-meeting provider connects you to that provider and its own privacy arrangements.

Optional advertising measurement. The configured Google and Meta integrations measure permitted page views and conversion events after consent and activation. They do not receive the text you type into enquiry forms or AI search. Customer-list uploads and automatic advanced matching are not enabled in the configured website integration.

AI-powered site search. If you use the search feature, the question you enter is sent to Cloudflare Workers AI so it can find relevant pages on this site. The search retrieves pages; it does not generate legal, tax or financial advice. IMSG does not include the question itself in analytics events or write it to the Worker application log.

Your choices. Use Cookie preferences in the footer to reject or withdraw optional tracking. Forms and site search remain available. You can also clear browser storage. Withdrawal affects future collection; it does not automatically erase information previously received by a provider.

9. Keeping it secureTBC · Vivien

If a data breach occurs that affects your personal data we will [SET OUT WHAT IMSG WILL DO. NOTE FOR THE REVIEWER: notifying the Privacy Commissioner is not mandatory in Hong Kong; it is voluntary, and the PCPD publishes guidance recommending it. Decide the policy and state it here: ____________________________________________ ].

10. Your right to see and correct your dataTBC · Vivien

Data Protection Principle 6, and Part 5 of the Ordinance, give you rights over your own personal data. You may:

• ask us whether we hold personal data of which you are the subject, and ask for a copy of it — this is a data access request under section 18 of the Ordinance;
• ask us to correct data you believe is inaccurate, once you have been given a copy of it — this is a data correction request under section 22;
• be given our reasons if we refuse either request, and object to that refusal.

How to make a request. Contact the Com Sec team at comsec@imsg.com.hk or write to IMSG Corporate Services Limited, Suite 4002A, 40/F, Tower One, Lippo Centre, 89 Queensway, Admiralty, Hong Kong. We may request information needed to verify your identity and process your access or correction request.

How long we take. We must respond within 40 days of receiving the request. That is the statutory period in sections 19(1) and 23(1) of the Ordinance and we treat it as a deadline, not a target. If we cannot comply in full within 40 days we will tell you in writing before the 40 days are up, explain why, comply so far as we are able to, and then comply in full as soon as practicable.

Fees. We do not charge for a data access request. [CONFIRM — IF IMSG DECIDES TO CHARGE, REPLACE WITH: “We may charge a fee for complying with a data access request. Section 28(3) of the Ordinance requires that the fee must not be excessive, and we will charge no more than the costs directly related to and necessary for dealing with your request.”] We cannot and do not charge for a data correction request; section 28(1) of the Ordinance does not permit it.

Refusals. There are circumstances in which the Ordinance requires or permits us to refuse — for example where we cannot comply without disclosing personal data about somebody else who has not consented. If we refuse we will tell you in writing and give our reasons, and we keep a log of refusals as section 27 requires.

11. Sending data outside Hong KongTBC · Vivien

[COMPLETE.] Personal data collected through this website is stored ____________________________________ . Where our service providers are located outside Hong Kong, or store data outside Hong Kong, your personal data will be transferred there.

Section 33 of the Ordinance, which would restrict transfers of personal data out of Hong Kong, was enacted in 1995 but has never been brought into operation. It is not currently binding on us. It could be brought into force in future, and the Privacy Commissioner encourages data users to adopt equivalent protections voluntarily; the Commissioner published recommended model contractual clauses for cross-border transfers in 2022.

What does bind us, wherever the data goes, is that we remain responsible for it. Where we engage a processor outside Hong Kong we use contractual or other means to prevent your data being kept longer than is necessary and to protect it against unauthorised or accidental access, processing, erasure, loss or use, as Data Protection Principles 2(3) and 4(2) require.

12. If you are unhappyTBC · Vivien

Please tell us first. Contact the Com Sec team at comsec@imsg.com.hk and we will look into it and reply.

You also have the right to complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong, which is the statutory regulator for personal data privacy in Hong Kong:

Section 66 of the Ordinance also allows an individual who suffers damage because of a contravention to bring a civil claim for compensation.

13. Changes to this policyTBC · Vivien

We may update this policy. The date at the top shows when it was last changed. If we make a change that materially affects how we use personal data we already hold, we will take reasonable steps to bring it to your attention rather than relying on you to notice.

14. LanguageTBC · Vivien

This policy is published in English, Traditional Chinese and Simplified Chinese, the Simplified version being derived from the Traditional. [IF THE ENGLISH VERSION IS TO PREVAIL:] If there is any inconsistency between them, the English version prevails. This does not affect your right under section 19(3)(c)(iii) of the Ordinance to be given a copy of your personal data in the language in which you make your request.