Privacy Policy

1. Introduction

Bamboo Loop ("we", "us", "our") is committed to handling personal data responsibly and in compliance with Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"). This Privacy Policy describes what personal data we collect, why we collect it, how we use and protect it, and what rights you have regarding your data.

If you have questions about this policy, contact us at [email protected] or by writing to 14 Fuk Wing Street, Sham Shui Po, Kowloon, Hong Kong.

2. Data We Collect

We collect personal data through the following means:

• Contact forms: name, email address, phone number, and any message content you submit.
• Client engagements: organisation name, contact details of named contacts, and documents shared with us as part of a scoped engagement.
• Website analytics: anonymised usage data including pages visited, time on page, and device type.
• Cookies: see our Cookie Policy for details on the types of cookies used.

We collect only the information necessary for the purposes described below. We do not collect sensitive personal data (such as identity document numbers or financial account details) through our website.

3. Why We Collect and Use Personal Data

We process personal data for the following purposes and on the following legal bases:

• Responding to enquiries: when you submit a contact form, we use your name and contact details to respond. Legal basis: your consent in submitting the form.
• Delivering services: during an engagement, we process contact and document data as necessary to provide the agreed service. Legal basis: contractual necessity.
• Service communications: we may send updates relevant to your engagement. Legal basis: legitimate interest or contractual necessity.
• Website improvement: anonymised analytics data helps us understand how visitors interact with our site. Legal basis: legitimate interest.
• Legal compliance: we retain records as required by applicable law. Legal basis: legal obligation.

4. Data Sharing

We do not sell personal data. We may share data with the following categories of third parties, strictly for the purposes stated:

• Service providers: hosting, email delivery, and analytics providers operating under data processing agreements.
• AI model providers: only for the purpose of delivering the agreed service, under terms that prohibit use of client data for model training.
• Legal or regulatory bodies: where required by law or lawful request.

Where data is processed by third parties outside Hong Kong, we take reasonable steps to ensure equivalent data protection standards apply.

5. Data Retention

We retain personal data for as long as reasonably necessary:

• Enquiry data: up to 12 months from last contact, unless a client relationship develops.
• Client engagement data: up to 5 years from engagement close, for contractual and legal record purposes.
• Analytics data: retained in anonymised form for up to 26 months.

When data is no longer required, it is deleted or anonymised.

6. Data Security

We take data security seriously and apply appropriate technical and organisational measures, including:

• Encrypted data transmission (TLS) for all website communication.
• Access controls limiting who can view client data within our team.
• Written prohibitions in all client agreements against using client documents to train AI models.
• Regular review of third-party service providers' security posture.

In the event of a data breach that may affect your rights, we will notify affected individuals and, where required, the Office of the Privacy Commissioner for Personal Data (PCPD) Hong Kong, in a timely manner.

7. Cookies

We use cookies on our website. Please see our Cookie Policy for a full description of the types of cookies used, their purpose, and how to manage your preferences.

8. Your Rights Under PDPO

Under the Personal Data (Privacy) Ordinance (Cap. 486), you have the right to:

• Access: request a copy of personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Objection: object to processing of your personal data for direct marketing purposes.
• Withdrawal of consent: where processing is based on consent, withdraw that consent at any time. Withdrawal does not affect processing carried out before the withdrawal.

To exercise any of these rights, contact us at [email protected]. We will respond within 40 days as required by the PDPO. We may require you to verify your identity before processing the request.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data Hong Kong at www.pcpd.org.hk.

9. Third-Party Links

Our website may include links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before sharing personal data with them.

10. Children's Privacy

Our services are directed at organisations and business professionals aged 18 and above. We do not knowingly collect personal data from individuals under 18. If we become aware that we have collected such data, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. Material changes will be communicated by email to active clients where appropriate. Continued use of our website after changes constitutes acceptance of the updated policy.

12. Contact

For any privacy-related enquiries:
Bamboo Loop
14 Fuk Wing Street, Sham Shui Po, Kowloon, Hong Kong
Email: [email protected]
Phone: +852 2816 4375