Confidentiality & Data Protection Policy

This Confidentiality and Data Protection Policy (the "Policy") sets out how Alser Limited ("Alser", "we", "us" or "our") safeguards the confidentiality and privacy of the personal and business information we collect, use and store in the course of running our web-development studio. It is written to comply with the Personal Data (Privacy) Ordinance (PDPO) of Hong Kong and to reflect recognised international data-protection standards.

1. Purpose

Alser provides full-stack software and web-development services to business clients. In delivering those services, and in operating our website, we handle information about the people who contact us, about the businesses we work with, and about our own team. This Policy explains the commitments we make when we process that information and the safeguards we apply to keep it confidential and secure.

2. Scope

This Policy applies to all employees, contractors, partners and clients of Alser. It governs the handling of information collected through our website (alserstudio.com), through our project engagements and through our business communications. It covers, without limitation:

• the personal data of website visitors, clients, their representatives, partners and personnel;
• business and operational information relating to our studio; and
• confidential and proprietary information arising from the web-development engagements we carry out for our clients.

3. Definitions

Personal Data means any information relating to an identified or identifiable natural person.

Confidential Information means any non-public information — whether oral, written or electronic — that is disclosed in connection with our business or our engagements, including a client's source code, designs, credentials, business plans and the data they entrust to us.

Processing means any operation performed on data, including its collection, storage, use, disclosure and destruction.

4. Principles of Data Protection

We adhere to the following principles whenever we process data:

• Lawfulness, fairness and transparency — data is processed in a lawful, fair and transparent manner.
• Purpose limitation — data is collected for specific, explicit and legitimate purposes and is not further processed in a way incompatible with those purposes.
• Data minimisation — only the data necessary for the purposes of processing is collected and retained.
• Accuracy — data is kept accurate and, where necessary, up to date.
• Storage limitation — data is retained only for as long as necessary for the purposes for which it was collected.
• Integrity and confidentiality — appropriate technical and organisational measures are in place to protect data against unauthorised access, alteration or destruction.

5. Data We Collect & Use

5.1 Website visitors and enquiries. When you get in touch through the enquiry form on our website or by email, we collect the details you choose to provide — typically your name, your email address and the content of your message — so that we can respond to your enquiry and, where relevant, discuss a potential engagement. Supplying this information is voluntary, but if you choose not to provide it we may be unable to reply.

The website itself does not use analytics or advertising cookies, and we do not build marketing profiles of the people who visit it. For details of the limited, strictly functional cookies our site may use, please see our Cookies Policy.

5.2 Client and engagement data. To deliver our services under a project engagement, we process information relating to our business clients and their authorised representatives — such as contact details, project requirements, correspondence and any materials, accounts or credentials a client shares with us so that we can design, build, deploy and maintain the software or website they have commissioned. Where a client entrusts us with data belonging to their own users or customers, we process that data solely on the client's instructions and only for the purposes of the engagement.

5.3 Personnel data. We hold a limited amount of personal data about our own people — our employees and contractors — where this is necessary to administer the working relationship. Such data is treated as confidential and used only for those purposes.

6. Confidentiality Obligations

6.1 Employees and contractors. Everyone working for or with Alser is bound by confidentiality obligations and receives guidance on sound data-protection practice. Confidential Information and Personal Data are accessed only where doing so is necessary to perform an assigned task.

6.2 Third parties. Any third party that handles Confidential Information or Personal Data on our behalf is bound by contractual obligations to keep that information confidential, to process it only on our instructions and to comply with applicable data-protection law.

7. Security Measures

7.1 Technical measures. We apply industry-standard safeguards — including encryption in transit, access controls and secure storage — to protect the information in our care against loss and unauthorised access.

7.2 Organisational measures. Access to data is restricted to authorised personnel on a need-to-know basis, and our handling practices are reviewed so that they remain fit for purpose.

7.3 Incident response. In the event of a data breach, we will act promptly to contain and assess it and will notify affected parties and the relevant authorities where we are required to do so by law.

8. Your Rights

Subject to the PDPO and other applicable law, you have the following rights in respect of your Personal Data:

• Access — to request a copy of the Personal Data we hold about you.
• Correction — to have Personal Data that is inaccurate or incomplete corrected.
• Erasure — to request deletion of your Personal Data in certain circumstances, save where we are permitted or required to retain it.
• Restriction — to ask that our processing of your Personal Data be restricted in defined cases.
• Objection — to object to the processing of your Personal Data on legitimate grounds.

To exercise any of these rights, please write to us at hello@alserstudio.com. Where a request concerns data we process on behalf of a client, we may need to refer you to that client, who acts as the party responsible for that data.

9. Data Retention

We keep Personal Data and business information only for as long as is necessary to fulfil the purposes for which it was collected — for example, to respond to an enquiry, to deliver and support an engagement, or to meet a legal, regulatory or tax obligation that applies to us. Once the applicable retention period has ended, we securely delete the data or render it anonymous.

10. International Data Transfers

Alser works with clients and service providers in a number of countries, and information may therefore be transferred to and processed outside Hong Kong. Where this happens, we take appropriate steps to ensure that the information continues to receive a suitable level of protection, including through contractual safeguards with the parties involved.

11. Monitoring and Compliance

11.1 Responsibility. Alser has appointed a person responsible for data protection who oversees compliance with this Policy and with applicable data-protection law, and who serves as the point of contact for questions and requests.

11.2 Review. We review our data-handling practices from time to time to confirm that they remain aligned with this Policy and with the standards it reflects.

12. Policy Updates

This Policy is reviewed periodically and whenever there is a significant change in applicable law, regulation or our business practices. Any updated version will be published on this page with a revised effective date.

13. Contact

For any question, concern or request relating to this Policy or to your Personal Data, please contact us at hello@alserstudio.com, or write to us at One Capital Place 7B, 18 Luard Road, Wan Chai, Hong Kong.