Privacy Policy

ITR Consulting Limited, RM 611, 6/F, Fook Cheong Building, 63 Hoi Yuen Road, Kwun Tong, Hong Kong, is the data user (as defined in the PDPO) in respect of the personal data collected through the Site.

• Enquiry data. When you contact us (website form or email): name, email address, company, phone number, service of interest, and the content of your message. Company and phone are optional.
• Correspondence records. Copies of emails and messages exchanged with you, kept to handle and evidence your enquiry or engagement.
• Technical data. Standard server and CDN logs: IP address, browser type, device type, pages visited, and timestamps. This data is used for security, abuse prevention, and keeping the Site operational.

We do not collect payment card data, government identifiers, or special-category data through the Site.

Personal data is collected for purposes directly related to our function as an IT services provider (PDPO Data Protection Principle 1): responding to enquiries; quoting for and delivering services; recruitment correspondence where you contact us about a role; keeping records required by law; and protecting the security and integrity of the Site. We do not use your data for unrelated purposes without your consent (DPP 3), and we do not sell personal data.

We engage the following service providers, who process data only on our instructions:

• Resend — transactional email delivery for website form submissions.
• Cloudflare — CDN, caching, and web application firewall in front of the Site.
• Our hosting provider — servers that run the Site and store its logs.

Beyond processors, we disclose personal data only where required by law, regulation, or court order.

Some processors operate data centres outside Hong Kong. Where personal data leaves Hong Kong we apply contractual and technical safeguards (encryption in transit, processor obligations, least-privilege access). Note that section 33 of the PDPO (cross-border transfer restrictions) is not yet in force; we nonetheless apply its spirit to processor selection.

• Enquiry and correspondence records: for as long as needed to handle your enquiry or engagement, plus any period required by applicable limitation periods or tax/company records law.
• Technical logs: for a limited period sufficient for security monitoring and incident investigation.

Data that is no longer needed for any purpose above is deleted or irreversibly anonymised.

• Access. You may request a copy of the personal data we hold about you (a data access request). We may charge a reasonable fee as permitted by the PDPO.
• Correction. You may ask us to correct any personal data about you that is inaccurate.
• Information. You may ask what kinds of personal data we hold and for what purposes.
• Complaint. You may lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD), Hong Kong.

To exercise any right, email info@itrhk.com with “Privacy request” in the subject line. We will verify your identity before responding.

We protect personal data with encryption in transit (TLS), access controls limited to staff and processors who need it, and routine review of the systems listed in section 4. No method of transmission or storage is 100% secure; if a data breach affecting you occurs we will notify you and, where required, the PCPD.

The Site sets no advertising or third-party tracking cookies. Our CDN and security layer may set strictly necessary cookies to keep the Site functioning and protected. We do not operate behavioural advertising pixels.

Our services are directed at businesses and professionals. The Site is not intended for children, and we do not knowingly collect their personal data.

We may update this policy; the current version is always published on this page with its review status. Privacy questions, access requests, and corrections: info@itrhk.com.