Privacy Policy

ZZ Keys Limited (Business Registration Number 79310020) is the data user responsible for the personal data described in this policy. We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong and the six data protection principles set out in it.

1. What this website itself collects

This website is a set of static files. It has no database, no server-side application, no account system, no analytics tracking and no advertising pixels. It does not set any cookies of its own. Browsing these pages does not create a record we can see or retrieve.

Two things do happen when a page loads, and you should know about both:

• Hosting logs. Whoever hosts these files receives standard web server request data, which typically includes your IP address, the page requested, the time of the request, your browser type and the referring page. This is created by the hosting infrastructure rather than by us, and we use it only to keep the site available and secure.
• Google Fonts. The typefaces used on this site are loaded from Google's font service. That request tells Google your IP address and basic browser information. Google states that it does not use font requests to build advertising profiles and sets no cookies for this purpose, but the request does leave your browser and it is not one we can make on your behalf.

2. The enquiry form

The enquiry form on the contact page does not submit anything to us or to any third party. When you press the button, your browser assembles the answers into a draft email and opens it in your own mail application. Nothing leaves your device until you choose to press send. If you close the draft, nothing has been shared and nothing has been stored.

Once you send that email, we receive it in the same way as any other email, and the contents become subject to section 3 below.

3. Personal data we collect through contact and engagements

We collect personal data in three situations.

3.1 When you contact us

Your name, email address, telephone number, employer or company name, job role, the annual revenue band you choose to disclose, and whatever you write in your message. We collect this because we cannot answer an enquiry without it. Providing a phone number and revenue band is optional and refusing does not prevent us replying.

3.2 During an engagement

Names, job titles, work contact details and role responsibilities of your staff; notes and recordings of interviews where the participant has agreed to be recorded; commercial and operational information about your business, which may incidentally include personal data such as employee performance context, customer names or supplier contacts. We collect this because a diagnostic or build engagement cannot be performed without looking at how real people do real work.

3.3 For billing and statutory records

Billing contact details, company registration details, invoices, payment records and correspondence relating to them. We are required to retain accounting records under Hong Kong law.

4. Purposes and legal basis

We use personal data only for the following purposes:

• Responding to enquiries and arranging introductory calls
• Preparing written scopes, quotations and engagement letters
• Delivering the consulting, mentorship or educational services agreed
• Invoicing, collecting payment and maintaining accounting records
• Meeting legal, regulatory and tax obligations in Hong Kong
• Defending or establishing legal claims where necessary

We do not use your personal data for direct marketing. We do not send newsletters, promotional campaigns or automated sequences to people who have contacted us, and we do not provide personal data to any third party for their own marketing purposes. If that ever changes, we will ask for your consent first, separately and explicitly, as the Ordinance requires.

5. Interview recordings

Where an engagement involves interviews, we record only with the explicit spoken agreement of the person being interviewed, recorded at the start of the session. Anyone may decline without giving a reason and without it affecting the engagement. Recordings are used to write accurate notes and are deleted within ninety days of the engagement ending unless the client instructs otherwise in writing.

Findings we report to a client are written to describe processes rather than individuals. Where an individual's account is essential to a finding, we attribute it by role rather than by name unless that person has agreed to be named.

6. Who we share personal data with

We do not sell personal data. We do not trade, rent or exchange it. We share it only with:

• Service providers we depend on to operate, which currently means our email provider, our document and file storage provider, our accounting software provider, our video conferencing provider and our website host. Each processes data on our instructions only.
• Our professional advisers, such as accountants and lawyers, where they need it to advise us.
• Government or regulatory authorities, where we are legally required to disclose.

During an engagement, we work inside your own systems wherever possible, which means your operational data stays under your control rather than being copied into ours.

7. Transfers outside Hong Kong

Some of the service providers listed above store data on servers outside Hong Kong, including in the United States, the European Union and Singapore. Where personal data is transferred outside Hong Kong, we satisfy ourselves that the provider applies protections comparable to those required by the Personal Data (Privacy) Ordinance, and we bind them by contract to process the data only on our instructions.

8. How long we keep it

• Enquiries that do not become engagements: deleted within twelve months of the last message.
• Interview recordings: deleted within ninety days of the engagement ending.
• Engagement working files and deliverables: retained for two years after the engagement ends, then deleted, unless you ask us to delete them sooner.
• Contracts, invoices and accounting records: retained for seven years, as required by Hong Kong law.

9. Security

We keep the number of places your data sits deliberately small. Access is limited to people who need it for the engagement. Devices used for client work are encrypted and password protected, accounts use multi-factor authentication, and client files are held in access-controlled storage rather than in shared mailboxes.

No method of transmission or storage is completely secure, and we do not claim otherwise. If a breach occurs that is likely to cause you real harm, we will tell you and the Office of the Privacy Commissioner for Personal Data without undue delay, describe what happened, and tell you what we are doing about it.

10. Your rights

Under the Personal Data (Privacy) Ordinance you may:

• Ask whether we hold personal data about you
• Request a copy of that data
• Require us to correct data that is inaccurate
• Withdraw any consent you have given, including consent to be recorded
• Ask us to delete data we no longer have a lawful reason to keep

Send requests to hello@zzkeyslimited.com with enough detail for us to identify the data. We will respond within forty days, which is the statutory period. We may charge a reasonable fee for supplying a copy of data, as the Ordinance permits, and we will tell you the amount before doing the work.

If you are not satisfied with how we have handled a request, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.

11. Children

Our services are sold to businesses and to adults. We do not knowingly collect personal data from anyone under eighteen. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

If we change this policy we will update the date at the top of this page. Material changes affecting people we are actively working with will also be communicated by email. The version published here is the version that applies.

13. Contact

Questions, requests and complaints about personal data should go to:

ZZ Keys Limited
Attention: Privacy
Unit E01, 10/F, Wong King Industrial Building
2-4 Tai Yau Street, San Po Kong, Hong Kong
Email: hello@zzkeyslimited.com
Telephone: +1 (831) 308-5159
Business Registration Number: 79310020

14. A note on legal review

This policy is written to describe our actual practices in plain language. It is not a substitute for advice from a qualified Hong Kong legal adviser, and it should be reviewed by one before being relied upon in a dispute or a client contract.