This policy covers visitors, prospects, and service enquiries. Personal data we process for a client inside a project is also governed by that service agreement, the client’s instructions, and applicable law.
1. Data user and applicable law
Personal data collected through this website, official WhatsApp, or the contact form is handled by the Hong Kong company Trafficholic Limited (brand: trafficholic; Business Registration No. 81174345; registered office: Unit C6, 9/F, Grandion Plaza, No. 932 Cheung Sha Wan Road, Lai Chi Kok, Kowloon, Hong Kong) as the data user. The main law is the Personal Data (Privacy) Ordinance (Cap. 486, “PDPO”) and its six data-protection principles.
If you are in the EU, the UK, or another place whose law (such as the GDPR or UK GDPR) applies because of how you interact with this site, we will, where reasonably practicable, apply the same emphasis on transparency, data minimisation, security, and data-subject rights. This policy is not legal advice.
2. Personal data we collect
Data you give us: name, WhatsApp or phone, email, company or brand, industry, website or social links, enquiry topic, message, budget or timing if you provide them, and the record of follow-up. This usually happens when you use the contact form, WhatsApp, email, or send material for a quote.
Technical data collected automatically: IP address, browser and device type, approximate region, pages viewed, referring URL, interaction such as clicks, cookies or similar identifiers, server logs, and security events. We use these to run the site, keep it secure, measure performance, and, where applicable, understand analytics.
We do not seek: sensitive categories such as health data, biometrics, or full payment-card numbers. Do not send unnecessary sensitive data through a public form or WhatsApp. If a service must handle a special category, we will explain the purpose separately.
3. Why we collect it, including WhatsApp and leads
Purposes include: replying to enquiries and arranging a conversation; judging fit and preparing a quote; performing or preparing a contract; project communication, delivery, and support; accounts, disputes, and legal compliance; improving the site, content, and services; sending service-related updates where you agree or the law allows; and detecting abuse, fraud, and security threats.
WhatsApp and leads: if you leave contact details by WhatsApp or a form, we treat the conversation as a business enquiry for follow-up, quoting, and, if you become a client, delivery. We do not sell enquiry lists to unrelated third parties for unsolicited promotion. You can ask us to stop non-essential follow-up. Messages required for a service or contract may still be sent.
Grounds, depending on the situation: responding to your request or taking pre-contract steps; performing a contract; a legal duty; our legitimate interests (site security, basic analytics, improving the service, balanced against your rights); and consent where it is required (for example non-essential cookies or promotional messages).
4. Cookies, analytics, and tracking
The site may use necessary cookies (session, security, load balancing) and analytics or performance tools to understand pages and improve the experience. Depending on settings, a provider outside Hong Kong may process pseudonymous or aggregated data.
You can refuse or delete cookies in your browser. Blocking some cookies may affect how the site works. If we later add non-essential advertising trackers, we will offer a clearer choice where the law requires it.
5. Processors, tools, and transfers
To run the site and reply to enquiries we may use hosting or a CDN, WordPress infrastructure, WhatsApp (Meta), email or notifications, cloud files, analytics, security, AI or automation tools, and accounting or professional advisers. Those providers should process data only on our instructions and under contract or platform terms.
Some servers or support teams may be outside Hong Kong. Where data leaves Hong Kong, we assess the provider’s security and contract terms where that is reasonably practicable. WhatsApp conversations are also governed by WhatsApp and Meta’s own privacy terms.
We do not sell personal data. Disclosure is limited to service providers, professional advisers, parties you authorise, or a legal, regulatory, or court requirement.
6. Data we process for clients
If trafficholic runs a website, social account, ads, CRM, form, or WhatsApp flow for a client and therefore handles that client’s end users or prospects, the client is usually the data user and trafficholic acts on written instructions. The client must have a lawful basis, a privacy notice, and any consent or notification required, and must give accurate instructions.
We apply reasonable security and least-privilege access. After a project we delete, return, or anonymise data as the agreement says, except where the law requires retention. Regulated industries such as healthcare or finance may need extra contract terms. Raise that before work starts.
7. Retention and security
Enquiry and lead data is generally kept until follow-up is finished, moved into a project file if you become a client, or deleted when you ask and there is no legal reason to keep it. Project, accounting, dispute, and legal records may be kept longer. Technical logs are kept for a shorter period needed for security and operations.
We use reasonable technical and organisational measures, including access control, HTTPS, least privilege, and supplier checks. No internet transmission or electronic storage is absolutely secure. Do not send highly sensitive data over an unsafe channel.
8. Your rights
Under the PDPO you can usually ask to access and correct personal data we hold about you. Depending on the law that applies, you may also ask to restrict or object to some processing, to delete data where there is no legal reason to keep it, to receive data in a portable form, to withdraw consent (without affecting processing that was already lawful), and to complain to a regulator.
In Hong Kong the regulator is the Office of the Privacy Commissioner for Personal Data (PCPD). EU or UK users may complain to their local authority. We may need to verify your identity and will reply within the legal time. Some requests may be refused or charged where the law allows, for example if a request is clearly unfounded or repeated.
9. Children
This site is for businesses and people making commercial decisions. It is not directed at children. If you believe we have collected a child’s personal data by mistake, contact us so we can delete it.
10. Updates
We may update this policy when practice, tools, or the law change. The new version is published on this page with a new “last updated” date. For a material change we may also give a notice on the site or by another reasonable method.
11. Contact for privacy requests
For access, correction, deletion, or another privacy request, use the contact page or WhatsApp +852 6898 8500 and mark the message “privacy request”. General questions can also come by WhatsApp or email where one is published.
If you send a user-data deletion request from Meta or Facebook app settings, or you need that process explained, see the user data deletion page.
Questions about these policies?
Contact trafficholic