Privacy Policy

1. Introduction & Commitment

Aphelion takes the privacy of our clients, website visitors, and contacts seriously. This Privacy Policy explains our practices in accordance with Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and applicable data protection principles. We collect and use personal data only as needed to provide our services, respond to enquiries, and fulfill our legal obligations.

If you have questions about this policy or how we handle your data, please contact us at [email protected].

2. Data We Collect

We collect personal data in the following ways:

• Contact form submissions: Name, email address, phone number (optional), and any message content you provide.
• Email correspondence: Communications you send us directly, including any personal details included in those messages.
• Project engagements: Data relevant to service delivery — which may include business contact details, and data you share as part of a project scope.
• Website analytics: Aggregated and anonymised usage data collected through analytics tools, including page views and session information.
• Cookies: Technical cookies used for site functionality and optional analytics cookies with your consent. See our Cookie Policy for details.

We do not collect sensitive personal data (such as health, financial account, or biometric data) through our website.

3. How We Use Your Data

We use personal data for the following purposes:

• Responding to enquiries and communicating about potential or active projects
• Delivering AI services agreed under contract with clients
• Managing our business operations and client relationships
• Improving our website and understanding how it is used
• Meeting our legal and regulatory obligations

We rely on the following legal bases for processing: your consent (for cookies and marketing communications); performance of a contract (for service delivery); legitimate interests (for business communications and security); and compliance with legal obligations.

4. Data Retention

We retain personal data only for as long as necessary for the purposes described above:

• Contact form data: up to 24 months from last contact, unless a project engagement is initiated
• Project data: for the duration of the project and up to 5 years thereafter for legal record-keeping purposes
• Email correspondence: up to 5 years from the date of communication
• Analytics data: retained in anonymised and aggregated form only

After the applicable retention period, data is securely deleted or anonymised.

5. Data Protection Measures

We implement appropriate technical and organisational measures to protect personal data, including:

• Encrypted data transmission (TLS/HTTPS) for all data transfers
• Access controls limiting personal data access to personnel with a direct need
• Secure storage with access logging
• Periodic review of data handling practices
• Data handling protocols agreed with clients before project commencement

In the event of a data breach affecting your personal data, we will notify you and the Office of the Privacy Commissioner for Personal Data (PCPD) as required by applicable law.

6. Third-Party Services

We may share data with third-party service providers for the following purposes:

• Website hosting and infrastructure providers
• Analytics services (where consent has been granted)
• Email and communication tools

We select third-party providers that maintain appropriate data protection standards and enter into data processing agreements where required. We do not sell personal data to third parties.

7. Cookies

Our website uses essential cookies required for basic functionality, and optional analytics cookies that are only placed with your consent. For detailed information about the cookies we use and how to manage your preferences, please see our Cookie Policy.

8. Your Rights Under the PDPO

Under Hong Kong's Personal Data (Privacy) Ordinance, you have the right to:

• Request access to personal data we hold about you
• Request correction of inaccurate personal data
• Withdraw consent to processing (where consent is the legal basis)
• Object to the use of your data for direct marketing
• Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD)

To exercise any of these rights, please contact us at [email protected]. We will respond within 40 days as required by the PDPO.

9. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies separately.

10. Children's Privacy

Our services are directed at business clients and are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. Where changes are material, we will take reasonable steps to notify affected parties. Continued use of our website or services after changes are made constitutes acceptance of the updated policy.

12. Contact

For privacy-related enquiries, please contact:

• Email: [email protected]
• Address: 39 Queens Road East, Wan Chai, Hong Kong

You may also contact the Office of the Privacy Commissioner for Personal Data (PCPD) at www.pcpd.org.hk if you have concerns about our data practices.