LEGAL
Privacy Policy
01Who we are and what this policy covers
This Privacy Policy is issued by The Hong Kong Mill Group Limited ("HKM", "we", "us"), the data user responsible for personal data described here, and also serves as our Personal Information Collection Statement for the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO"). It explains how we collect, use, retain, disclose, and protect personal data in three distinct contexts, each governed differently: (a) visitors to thehongkongmill.com and persons who contact us; (b) publicly available information we process to produce intelligence outputs; and (c) data entrusted to us by clients under engagement. Please read the context relevant to you. This policy forms part of, and should be read together with, our Terms of Use.
02Data we collect and how we collect it
Visitors and enquirers. When you contact us, request materials, subscribe to a publication, or enter an engagement, we collect the details you provide: name, organisation, role, email address, telephone number (if given), and the content of your correspondence. Provision of this data is voluntary; without it we may be unable to respond to you or provide the requested service.
Technical and usage data. We use limited, privacy-preserving analytics to understand aggregate site usage (such as pages visited and approximate region). Where any non-essential cookie or similar technology is used, we request consent first — see clause 10.
Publicly available information (intelligence services). HKM processes information that is publicly accessible on digital platforms, forums, and markets to produce aggregate signal metrics — for example sentiment, dominant-emotion, volume, and growth-velocity readings. This processing is directed at understanding topics, narratives, and trends in aggregate. It is not directed at, and is not used for, profiling, identifying, locating, evaluating, or contacting any individual. Our outputs are statistical and thematic; incidental personal data appearing in public content is not extracted into our deliverables, and identifiers are not retained beyond what processing technically requires.
Client-entrusted data. Under semi-custom and custom engagements, clients may provide internal datasets which can contain personal data of their own customers or staff. In respect of such data we act on the client's documented instructions for the purposes of the engagement only, and handle it under the Air-Gap Principle in clause 05. Clients are responsible for ensuring they have the lawful basis to provide such data to us.
03Purposes of use
We use personal data only for: (a) responding to enquiries and providing requested materials and services; (b) administering engagements, subscriptions, invoicing, and records; (c) operating, securing, and improving the Site; (d) meeting legal, regulatory, audit, and risk-management obligations; and (e) where you have not objected, sending you HKM research summaries or service updates relevant to your professional context, from which you may opt out at any time. We do not use personal data for purposes unrelated to these without your prescribed consent as required by the PDPO.
04Direct marketing
We do not sell personal data, and we do not provide personal data to any third party for that party's direct marketing. Where we intend to use your contact details for our own direct marketing as defined under Part 6A of the PDPO, we will do so only in compliance with that Part, and you may require us to cease at any time, free of charge, by writing to hello@thehongkongmill.com.
05The Air-Gap Principle (client-entrusted data)
Client internal data is processed in isolation. It is never cross-referenced against external databases, never merged into our general analytical corpus, never used to train or improve any general model or methodology, never shared with any third party, and never retained beyond the term of the engagement. On completion, client internal data is securely deleted unless we receive the client's written instruction to the contrary. Consistent with our vendor-independence governance, no vendor-related party is permitted access to client-entrusted data outside the terms of a specific engagement. This principle is a non-negotiable term of every engagement, not a courtesy.
06Retention
We retain personal data no longer than necessary for the purpose for which it was collected: enquiry and relationship data for the duration of the relationship and a reasonable period thereafter for record-keeping and legal purposes; engagement records for the period required by law and prudent practice; aggregate intelligence outputs in de-identified, statistical form; and client-entrusted data strictly per the Air-Gap Principle. When retention is no longer justified, data is deleted or irreversibly anonymised.
07Disclosure
We disclose personal data only: (a) to service providers (such as hosting, email, and professional advisers) acting on our behalf under obligations of confidentiality and data protection; (b) where required by law, court order, or a regulator with lawful authority; (c) in connection with a corporate reorganisation, on terms preserving equivalent protection; or (d) with your consent. We require any recipient to use the data only for the purpose disclosed.
08Security
We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including access controls on a need-to-know basis, encryption in transit, segregation and isolation of client-entrusted datasets, logging of data-package versions, and contractual obligations on personnel and providers. No system is absolutely secure; if a data breach occurs that is likely to result in serious harm, we will notify affected persons and the Privacy Commissioner in line with prevailing guidance.
09Cross-border arrangements
Personal data is processed in Hong Kong. If any processing occurs outside Hong Kong (for example, through infrastructure providers), we adopt safeguards consistent with the PDPO and the Privacy Commissioner's recommended model contractual clauses, so that the data receives protection substantially similar to that under Hong Kong law.
10Cookies and similar technologies
Essential cookies necessary for the Site to function are used by default. Analytics or preference cookies are set only with your consent, which you may decline or withdraw without affecting your use of the Site. We honour the choice you make for as long as your browser retains it.
11Your rights
Under the PDPO you may: (a) request access to personal data we hold about you; (b) request correction of inaccurate data; (c) ascertain our policies and practices in relation to personal data; and (d) object to use of your data for direct marketing. Requests should be made in writing to hello@thehongkongmill.com. We may charge a reasonable fee for processing a data access request as permitted by the PDPO, and may need to verify your identity before acting on a request. We respond within the statutory timeframe (40 days).
12Automated processing and human judgement
Our analytical pipeline uses automated tools, including AI systems, to cluster and score aggregate public signals. No decision producing legal or similarly significant effects on any individual is made by automated means: our outputs describe topics and markets, not persons, and all strategic conclusions in deliverables are authored and signed by an HKM analyst.
13Minors
The Site and our services are directed at business and institutional users. We do not knowingly collect personal data from persons under 18; if you believe a minor has provided data to us, contact us and we will delete it.
14Third-party sites
The Site may link to third-party sites and platforms, including our social channels. Their privacy practices are their own; this policy does not apply to them, and we encourage you to review their policies.
15Changes
We may update this policy from time to time. Material changes will be reflected by a revised effective date on this page and, where appropriate for existing clients, notified directly. Continued use of the Site after a revision takes effect constitutes acceptance of the revised policy.
16Contact
Data Protection contact — enquiries, access, correction, and opt-out requests: hello@thehongkongmill.com. You also have the right to complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.