Legal
Privacy Policy
Last Updated: 15 January 2026 · Obsidium · 68 Yee Wo Street, Causeway Bay, Hong Kong
Obsidium ("we", "us", "our") is committed to protecting the personal information of individuals who interact with our website and services. This Privacy Policy explains what data we collect, how we use it, and the rights you hold over it. Our practices are aligned with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO").
1. Data Controller
The data controller for personal information collected through this website is Obsidium, 68 Yee Wo Street, Causeway Bay, Hong Kong. For privacy-related enquiries, contact us at [email protected].
2. What Personal Data We Collect
We collect the following categories of personal information:
- Contact data: name, email address, phone number — submitted via our enquiry form
- Communications: messages or notes you include in form submissions
- Technical data: IP address, browser type, device type, pages visited, and session duration — collected automatically through analytics tools when you visit our website
- Cookie preferences: your stated choices regarding non-essential cookies
We do not collect sensitive personal data (as defined under the PDPO) through this website.
3. How We Collect Data
- Directly from you when you complete the contact form on our website
- Automatically through cookies and analytics tools as you navigate our website (see our Cookie Policy for details)
- Through email or telephone communications you initiate with us
4. How We Use Your Data
We process your personal data for the following purposes:
- Responding to your enquiries and providing information about our services
- Managing the contractual relationship if you engage us for a project
- Improving the performance and content of our website through aggregate analytics
- Maintaining records of communications for service continuity purposes
- Complying with legal obligations under Hong Kong law
We do not use your contact data for unsolicited marketing communications without your express agreement.
5. Legal Basis for Processing
We process personal data on the following bases:
- Your consent: for non-essential cookies and any marketing communications
- Legitimate interests: for website analytics and communication follow-up related to your enquiry
- Contractual necessity: when managing a service engagement with you
- Legal obligation: where processing is required to comply with applicable Hong Kong law
6. Data Retention
We retain personal data for as long as necessary for the purpose it was collected:
- Enquiry form submissions: up to 24 months from last contact, unless a project engagement follows
- Project-related data: 7 years from project completion, in line with general commercial record-keeping standards
- Analytics data: in aggregated, anonymised form only, with no individual retention limit
- Cookie consent records: 12 months
7. Data Sharing
We do not sell personal data. We may share data with:
- Service providers: analytics and email tools that operate under data processing agreements
- Legal authorities: when required by law, court order, or to protect our legal rights
- Professional advisers: lawyers and accountants who are bound by professional confidentiality obligations
We do not transfer personal data outside of Hong Kong without appropriate safeguards in place, in accordance with Section 33 of the PDPO.
8. Data Protection Measures
We maintain appropriate technical and organisational measures to protect personal data, including:
- Secure HTTPS encryption for all website communications
- Access controls limiting who within Obsidium can view personal data
- Procedures for responding to data breaches, including notification to affected individuals where required by law
- Regular review of our security practices
9. Cookies
We use cookies to support website functionality and analytics. For a full explanation of the cookies we use and how to manage your preferences, please see our Cookie Policy.
10. Your Rights Under the PDPO
Under Hong Kong's Personal Data (Privacy) Ordinance, you have the right to:
- Request access to personal data we hold about you (Data Access Request)
- Request correction of inaccurate personal data
- Withdraw consent where processing is based on consent
- Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD): www.pcpd.org.hk
To exercise any of these rights, contact us at [email protected]. We will respond within 40 days as required by the PDPO.
11. Third-Party Links
Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently.
12. Children's Privacy
Our services are intended for business use by individuals aged 18 and over. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page reflects the most recent revision. Material changes will be communicated where required.
14. Contact Us
For privacy-related questions or to exercise your rights:
- Email: [email protected]
- Address: Obsidium, 68 Yee Wo Street, Causeway Bay, Hong Kong