Privacy Policy

Introduction

Dravino is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, and protect information when you interact with our consulting services or visit our website.

This policy applies to all personal data processed by Dravino in connection with our business consulting services in Hong Kong. We are committed to compliance with the Personal Data (Privacy) Ordinance (PDPO) and other applicable data protection regulations.

For questions regarding this policy or our data practices, please contact us at [email protected].

Data Collection Information

What Personal Data We Collect

We collect the following categories of personal information:

• Contact Information: Name, email address, phone number, business address
• Professional Information: Job title, company name, industry sector
• Communication Records: Correspondence, meeting notes, inquiry details
• Engagement Information: Project details, deliverables, feedback
• Technical Information: IP address, browser type, device information (when visiting our website)

How We Collect Data

We collect personal data through the following channels:

• Direct interactions when you contact us or engage our services
• Information you provide through our website contact forms
• Professional meetings, calls, and email correspondence
• Cookies and analytics tools on our website (see our Cookie Policy)
• Publicly available business information and professional networks

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: When you provide explicit consent for specific processing activities
• Contract Performance: To deliver consulting services you have engaged us to provide
• Legitimate Interests: To operate our business, improve our services, and communicate about relevant opportunities
• Legal Compliance: To meet regulatory requirements and legal obligations

Data Retention Periods

We retain personal data for the following periods:

• Active Client Data: Duration of engagement plus 7 years for professional records
• Prospective Client Inquiries: 3 years from last contact
• Marketing Communications: Until consent is withdrawn
• Website Analytics: 26 months
• Legal and Tax Records: As required by Hong Kong regulations (typically 7 years)

Data Usage Explanation

How We Use Your Personal Data

We use personal information for the following purposes:

• Service Delivery: To provide consulting services, manage engagements, and deliver project outcomes
• Communication: To respond to inquiries, provide updates, and maintain professional relationships
• Business Operations: To manage contracts, process payments, and maintain business records
• Service Improvement: To analyze and enhance the quality of our consulting services
• Legal Compliance: To meet professional standards, regulatory requirements, and legal obligations

Data Sharing with Third Parties

We may share personal data with the following categories of recipients:

• Professional Service Providers: Accountants, lawyers, and other consultants as needed for service delivery
• Technology Vendors: Cloud storage providers, email services, and analytics platforms operating under strict confidentiality agreements
• Legal and Regulatory Authorities: When required by law or to protect legal rights

We do not sell, rent, or trade personal information to third parties for marketing purposes. All third-party service providers are contractually bound to protect your data and use it only for specified purposes.

Marketing Communications

With your consent, we may send you information about our consulting services, industry insights, and professional updates. You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link in any marketing email
• Contacting us at [email protected]
• Updating your communication preferences in writing

Data Protection Measures

Security Measures

We implement comprehensive security measures to protect personal data:

• Encryption: Data transmission via SSL/TLS encryption and encrypted storage for sensitive information
• Access Controls: Role-based access restrictions limiting data access to authorized personnel only
• Secure Infrastructure: Industry-standard cloud hosting with regular security updates
• Physical Security: Secure office premises with controlled access
• Staff Training: Regular privacy and security training for all team members

Data Breach Procedures

In the unlikely event of a data breach affecting personal information:

• We will assess the incident and take immediate steps to contain and mitigate the breach
• We will notify affected individuals without undue delay if the breach poses a risk to their rights
• We will report the breach to the Hong Kong Privacy Commissioner as required by law
• We will document the breach and our response for regulatory compliance

International Data Transfers

Our primary operations are based in Hong Kong. If we transfer personal data outside Hong Kong, we ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by data protection authorities
• Verification that recipient jurisdictions provide adequate data protection
• Specific consent for transfers where required

Cookies and Tracking

Our website uses cookies and similar technologies to improve user experience and analyze site usage. For detailed information about the cookies we use and how to manage your preferences, please review our Cookie Policy.

Essential cookies are necessary for website functionality and cannot be disabled. Optional cookies require your consent and can be managed through your browser settings or our cookie preference center.

Your Rights

Under Hong Kong's Personal Data (Privacy) Ordinance, you have the following rights:

Right to Access

You may request access to the personal data we hold about you. We will provide a copy of your data in a commonly used format within 40 days of receiving your request.

Right to Correction

You may request correction of inaccurate or incomplete personal data. We will update your information promptly upon verification.

Right to Erasure

You may request deletion of your personal data where we no longer have a legitimate basis to retain it, subject to legal and professional record-keeping requirements.

Right to Object

You may object to processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.

Right to Data Portability

You may request transfer of your personal data to another service provider in a structured, machine-readable format where technically feasible.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time. This will not affect the lawfulness of processing based on consent before withdrawal.

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: [email protected]
• Address: 5/F, Lee Garden One, 33 Hysan Avenue, Causeway Bay, Hong Kong

We will respond to your request within 40 days. We may request verification of your identity before processing certain requests to protect your personal information.

Third-Party Links

Our website may contain links to third-party websites, resources, or services. We are not responsible for the privacy practices of these external sites. We recommend reviewing the privacy policies of any third-party sites you visit.

When you click on third-party links, you leave our website and our Privacy Policy no longer applies. We do not control or endorse third-party content, services, or privacy practices.

Children's Privacy

Our consulting services are designed for businesses and organizations. We do not knowingly collect personal information from individuals under 18 years of age. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

Parents or guardians who believe we may have collected information from a minor should contact us immediately at [email protected].

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technologies, legal requirements, or business operations. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify existing clients by email if changes significantly affect how we process their data
• Post a notice on our website highlighting the updated policy

We encourage you to review this policy periodically to stay informed about how we protect your personal information. Continued use of our services after policy updates constitutes acceptance of the revised terms.

Contact Information

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with: