Privacy policy

This policy covers personal data we process through our public website, our contact and enquiry forms, and any direct communication you start with us by email.

Engagements with clients are governed by a separate written agreement and, where relevant, a data processing agreement. Those documents take precedence for client-specific processing activities.

We only collect data you give us, plus a small amount of technical data needed to run the site.

Under the Hong Kong Personal Data (Privacy) Ordinance, we collect and use personal data only for purposes directly related to our activities: to reply to your enquiry, to run and secure the site, to measure aggregate site performance, and to meet legal or accounting obligations. We do not use personal data for a new purpose without your consent.

The table below also maps each purpose to a GDPR lawful basis for EEA visitors.

We use a small number of strictly necessary cookies to run the site. Any non-essential cookies load only after you opt in.

You can change your preferences at any time from the cookie settings panel, also linked from the footer.

We share data only with service providers that help us run the site. They act as processors under written agreements with appropriate data protection safeguards. We do not sell personal data.

• Form processor: Web3Forms receives contact form submissions on our behalf.
• Email host: Google Workspace hosts our inbox and routes replies to you.
• Analytics: Plausible Analytics produces aggregated usage reports.
• Hosting and CDN: Cloudflare serves the site and stores access logs.

Our service providers may process personal data outside Hong Kong, including in the European Economic Area, the United Kingdom, and the United States. When personal data is transferred, we take reasonable steps in line with section 33 of the PDPO to ensure a comparable level of protection. For EEA data subjects, we rely on the European Commission Standard Contractual Clauses and, where needed, supplementary technical and organizational measures.

We use commercially reasonable measures to protect personal data, including:

• Encryption in transit using TLS for all site traffic
• Access controls and unique accounts for team members who handle data
• Logging and monitoring to detect unusual activity
• Regular review of subprocessors and their security posture
• A documented process to handle data subject requests and incidents

If a personal data breach is likely to result in real risk of harm, we will notify the Privacy Commissioner for Personal Data (PCPD), Hong Kong, in line with PCPD guidance, and notify affected individuals without undue delay. Where the breach affects EEA data subjects, we will also comply with Art. 33 and Art. 34 GDPR, including notification to the competent supervisory authority within 72 hours where required.

Under the Hong Kong Personal Data (Privacy) Ordinance (PDPO), you have the right to know whether we hold personal data about you, to request a copy of that data, and to request correction of any data that is inaccurate. To make a data access or correction request, email privacy@velioraltd.com. We respond within the statutory 40-day period. You may lodge a complaint with the Privacy Commissioner for Personal Data (PCPD), Hong Kong (pcpd.org.hk).

If you are in the EEA (GDPR)

If you are located in the European Economic Area, you also have the following rights under the EU General Data Protection Regulation:

• Be informed about how we process your data, which is what this policy is for.
• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of data we no longer need to keep.
• Restriction of processing in specific situations.
• Object to processing based on legitimate interest.
• Portability of data you provided to us, in a structured machine-readable format.

To exercise any GDPR right, email privacy@velioraltd.com. We respond within one month. EEA data subjects also have the right to lodge a complaint with the supervisory authority in their country of residence.

This site is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@velioraltd.com and we will delete it.

We may update this policy as our service or applicable law changes. The dates at the top of the page reflect the latest version. For material changes we will provide a clearer notice on the site.

For any privacy question or request, please use the details below.

You can also review our terms and conditions.