Privacy Policy

1. Introduction and Scope

1.1This Privacy Policy explains how Lumora Projects Co Limited (“we”, “us” or “our”), a company incorporated in Hong Kong, collects, uses, discloses and protects personal data.

1.2It applies to the lumoraprojectsco.com website (the “Site”) and to our advisory and consulting services, including enquiries, calls and consultations arranged through the Site. Read it together with our Website Terms of Use.

1.3If you are a client and have signed engagement terms with us, those terms govern the privacy commitments we make to you and prevail over this Policy if they conflict.

2. Information We Collect

2.1Contact and enquiry data: name, email address, phone number, country of residence and anything you include in an enquiry, form submission or booking.

2.2Client engagement data: if you become a client, the business, financial and identification information needed to deliver our services, as described in your engagement documents.

2.3Call and video data: recordings, transcripts and notes of calls, as described in section 5.

2.4Technical data: IP address, device identifiers, browser type, pages visited, and cookies used for Site operation and analytics.

2.5We do not ask for, and do not intentionally collect, special category or sensitive data such as health information. Please do not send it to us unless we ask for it in writing.

2.6Most personal data comes from you. We may also receive it from a person who refers you to us, or from publicly available sources, in which case this Policy applies in the same way.

2.7If you give us personal data about another person, you confirm you are authorised to provide it and have made this Policy known to them.

2.8The Site is intended for users aged 18 and over. If we learn that we hold personal data about a person under 18, we delete it.

3. How We Use Your Information

3.1We use personal data to respond to enquiries and schedule consultations; to deliver our services and prepare deliverables; to process information through our software and AI tools as described in section 4; to meet our legal obligations; to send marketing where you have agreed to receive it, which you can stop at any time; and to operate, secure and improve the Site and our services.

3.2Before we use your personal data in direct marketing we tell you what we intend to use and obtain your consent, as the Personal Data (Privacy) Ordinance requires. You may withdraw that consent at any time and we stop.

3.3We may create de-identified or aggregated information and use it for any lawful purpose. We do not attempt to re-identify it.

4. Artificial Intelligence and Automated Processing

4.1We use AI and automated data-processing tools to help operate our business, including to review enquiries, process documents, prepare drafts and summaries, and transcribe and analyse calls. Personal data you provide may be processed by these tools and the third-party providers that power them. We take reasonable steps to keep that processing secure and to ensure your information is not used to train third-party public AI models.

4.2AI outputs may contain errors. A suitably skilled person reviews material AI-assisted output before we rely on it, and automated tools do not make significant decisions about you without human involvement.

4.3We process your personal data through these tools because it is necessary to respond to your enquiry, to perform our agreement with you, or for our legitimate interest in operating and improving our services. Where the law requires your consent, we ask for it separately and you may withdraw it at any time by written notice. Withdrawing consent does not affect processing carried out before you withdraw it, and we will tell you whether it affects the services we can provide.

5. Calls and Recordings

5.1Calls with us may be recorded, transcribed and analysed, including by AI tools, for quality assurance, training, service delivery, compliance and dispute resolution. You will be notified at or before the start of a recorded call, and continuing after that notice is consent to the recording. If you do not consent, say so at the start of the call or end the call.

5.2Recordings and transcripts are kept for up to 12 months and then securely deleted, unless a longer period is required for legal, billing or dispute-resolution purposes.

6. How We Share Your Information

6.1We share personal data with the professionals and service providers engaged in delivering our services; with software, hosting, communications, analytics, AI and payment providers that process data on our behalf under confidentiality and security obligations; with our related entities and staff for the purposes in this Policy; and with courts, regulators and authorities where required by law. We do not sell your personal data.

6.2We can provide a current list of the main service providers that process personal data for us on request.

7. Cross-Border Transfers

7.1Our operations are cross-border. Personal data may be transferred to, stored in and processed in countries other than your country of residence, including Hong Kong and the countries where our staff, service providers and partners operate. Where we transfer personal data across borders, we take reasonable contractual and security safeguards consistent with the Hong Kong Privacy Commissioner’s recommended model contractual clauses. Where we transfer personal data out of the United Kingdom or the European Economic Area, we use the transfer mechanism that law requires, such as the UK International Data Transfer Agreement, the UK Addendum, or the European Commission's standard contractual clauses.

7.2We make these transfers because they are necessary to provide our services, or on the basis of the safeguards described above. Where the law requires your consent to a transfer, we ask for it separately.

8. Data Retention

8.1Enquiry data is kept while we assess or respond to your enquiry and for up to 24 months after our last contact, then deleted or de-identified. Client and business records are kept for up to 7 years after the engagement ends, or longer where required for tax, legal, accounting or compliance purposes. Call recordings are kept as described in section 5.

9. Your Privacy Rights

9.1We handle personal data under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong. You may request access to or correction of your personal data by contacting us as set out in section 14. We may need to verify your identity before we act. We respond within the time the law that applies to you requires, which is one month for requests under the UK or EU GDPR, extendable by two months for complex requests if we tell you why. If you are not satisfied, you may complain to the Privacy Commissioner for Personal Data (pcpd.org.hk) or the privacy regulator in your jurisdiction.

9.2If you are in Australia, we handle personal information consistently with the Australian Privacy Principles, and you may complain to the Office of the Australian Information Commissioner (oaic.gov.au). Where you consent to us disclosing your personal information to an overseas recipient, Australian Privacy Principle 8.1 will not apply to that disclosure, and we will not be accountable under the Privacy Act 1988 (Cth) for how that recipient handles your information.

9.3If you are in the EEA or the UK, we process personal data on the legal bases of consent, performance of a contract, legal obligation or legitimate interests. You have the right to access your personal data and to have it corrected, erased, or its processing restricted. You may object to processing based on our legitimate interests and to direct marketing at any time, ask us to transfer your data to another provider, and withdraw any consent you have given. You may complain to your local supervisory authority.

9.4If you are in the United States, your rights depend on the privacy law of your state. Where a state law applies to you, such as those of California, Colorado, Connecticut, Texas, Utah or Virginia, you may have rights to know what personal information we hold, to access, delete or correct it, and to opt out of any sale of it or sharing of it for targeted advertising. We do not sell personal information for money and will not discriminate against you for exercising your rights. We treat recognised opt-out signals, including Global Privacy Control, as opt-out requests.

10. Security

10.1We use administrative, technical and physical safeguards appropriate to the sensitivity of the information we hold, including encryption in transit and access controls, and require our service providers to maintain comparable protections. No system is completely secure. If a data breach affects your personal data, we will notify you and the relevant regulator where required by law.

11. Cookies

11.1The Site uses cookies for essential operation, performance and analytics, and may use them for advertising if we enable it. You can control non-essential cookies through your browser settings or any cookie preferences tool we provide. Disabling them may affect how the Site works.

12. Changes to This Policy

12.1We may update this Policy by posting the updated version on the Site and updating the date above. Material changes will be highlighted on the Site or notified to you where we hold your contact details.

13. Governing Law

13.1This Policy is governed by the laws of the Hong Kong Special Administrative Region, to the maximum extent permitted by the laws that apply to you. Nothing in this Policy limits any right you have under a privacy law that applies to you and cannot be excluded.

14. Contact

14.1Privacy enquiries and requests: Lumora Projects Co Limited (Privacy Officer), Room 1203, 12/F, Tower 3, China Hong Kong City, 33 Canton Rd, Tsim Sha Tsui, Kowloon, Hong Kong. Email: support@lumoraprojectsco.com.