Privacy Policy

Last Updated: January 25, 2026

At Heritagetiims, we recognize the importance of protecting personal information. This Privacy Policy explains how we collect, use, share, and protect data when you interact with our business consulting services in Hong Kong. We are committed to transparency and maintaining appropriate safeguards for personal data entrusted to us.

Data Collection Information

Personal Data We Collect

We collect personal data necessary to provide our consulting services and communicate with clients and prospective clients. Information collected includes:

• • Name and contact details (email address, phone number, business address)
• • Organization name and position/title
• • Information provided through inquiry forms and consultation requests
• • Communication records related to our advisory engagements
• • Business information relevant to consulting services provided

How We Collect Data

We collect personal data through several methods:

• • Direct submission via contact forms on our website
• • Email communications and phone inquiries
• • Engagement agreements and consulting project work
• • Website analytics and cookies (see Cookie Policy for details)
• • Professional networking and referrals

Legal Basis for Processing

We process personal data under the following legal bases:

• • Consent: When you voluntarily provide information through inquiry forms or communications
• • Contract: When necessary to perform consulting services under engagement agreements
• • Legitimate Interests: For business operations, improving services, and maintaining client relationships
• • Legal Compliance: When required to meet regulatory and professional standards

Data Retention

We retain personal data for the duration of our business relationship and for periods required by professional standards and Hong Kong law. Specifically:

• • Active client data: Retained during engagement and for six years following completion
• • Inquiry data: Retained for two years from initial contact if no engagement proceeds
• • Marketing communications: Retained until consent withdrawal or unsubscribe request

Data Usage and Sharing

How We Use Personal Data

Personal data is used for the following purposes:

• • Providing consulting services and advisory work
• • Communicating about engagements, proposals, and service delivery
• • Responding to inquiries and consultation requests
• • Improving our services and understanding client needs
• • Meeting professional obligations and regulatory requirements
• • Sending relevant business information and updates (with consent)

Data Sharing with Third Parties

We do not sell personal data. We share information only in limited circumstances:

• • Service Providers: With technology platforms that support our operations (email services, website hosting, analytics tools)
• • Professional Advisors: When necessary for legal, accounting, or professional consultation
• • Legal Requirements: When required by law, regulation, or legal process
• • Client Authorization: When specifically authorized by you for project purposes

Marketing Communications

We may send informational communications about our services, industry insights, or relevant business updates to clients and contacts who have provided consent or with whom we have an existing business relationship. You may opt out of marketing communications at any time by contacting us at [email protected] or using unsubscribe links in emails.

Data Protection Measures

Security Measures

We implement appropriate technical and organizational measures to protect personal data:

• • Encryption of data in transit using SSL/TLS protocols
• • Secure storage systems with access controls and authentication
• • Regular security assessments and software updates
• • Employee training on data protection and confidentiality
• • Confidentiality agreements with service providers

Data Breach Procedures

In the event of a data breach affecting personal information, we will assess the risk and notify affected individuals and relevant authorities as required by Hong Kong privacy law. Notifications will be made without undue delay and will include information about the nature of the breach and steps being taken to address it.

International Data Transfers

Our operations are based in Hong Kong. Some service providers we use may process data outside Hong Kong. When data is transferred internationally, we ensure appropriate safeguards are in place through contractual commitments and data processing agreements that require equivalent protection standards.

Cookies and Website Analytics

Our website uses cookies and similar technologies to improve user experience and understand website usage. We use:

• • Essential Cookies: Required for website functionality and security
• • Analytics Cookies: To understand how visitors interact with our website
• • Preference Cookies: To remember your settings and choices

For detailed information about our cookie usage, types of cookies, and how to manage your preferences, please see our Cookie Policy.

Your Privacy Rights

Under Hong Kong's Personal Data (Privacy) Ordinance, you have several rights regarding your personal data:

Access and Portability

You have the right to request access to personal data we hold about you. We will provide a copy of your data in a commonly used format. You may also request transfer of your data to another organization where technically feasible.

Correction and Erasure

You may request correction of inaccurate personal data or erasure of data we no longer have legitimate grounds to retain. We will respond to such requests within thirty days, subject to our legal and professional obligations.

Objection and Restriction

You may object to processing of your personal data for marketing purposes or where processing is based on legitimate interests. You may also request restriction of processing in certain circumstances, such as while we verify accuracy or assess your objection.

Withdrawal of Consent

Where processing is based on consent, you may withdraw consent at any time. This does not affect the lawfulness of processing based on consent before withdrawal.

Exercising Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond within thirty days and may request additional information to verify your identity before processing requests. There is no fee for exercising these rights unless requests are manifestly unfounded or excessive.

Right to Lodge Complaint

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong. Contact information: Enquiry/Complaint Hotline: +852 2827 2827 | Address: 12/F, Sunlight Tower, 248 Queen's Road East, Wan Chai, Hong Kong.

Additional Information

Third-Party Websites

Our website may contain links to external sites. We are not responsible for the privacy practices or content of third-party websites. We encourage you to review the privacy policies of any external sites you visit.

Children's Privacy

Our services are directed to businesses and professional contacts. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have collected data from a minor, we will take steps to delete such information.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Material changes will be communicated through our website or direct notification to active clients. The "Last Updated" date at the top of this policy indicates when it was most recently revised. Continued use of our services after changes indicates acceptance of the updated policy.

Contact Information

For questions, concerns, or requests related to this Privacy Policy or our data practices, please contact: