Privacy Policy

We collect personal data that you provide directly when you contact us, request a meeting, subscribe to our updates, or otherwise engage with us through this website. The categories of personal data we may collect include:

• Identification and contact data — name, job title, organisation, email, phone or messaging-app handle, country.
• Engagement data — information you provide about your business, regulatory situation, or the topic you wish to discuss.
• Communications data — messages you exchange with us by email, contact form, or messaging app.
• Technical data — IP address, device and browser characteristics, referring URL, pages viewed (collected via cookies; see our Cookie Notice).

Providing personal data is voluntary. However, if you do not provide the information marked as required on a form, we may be unable to respond to your enquiry or provide the service requested.

We use your personal data only for purposes directly related to or compatible with the original purpose of collection, in line with DPP3 of the PDPO. Specifically, we use it to:

• Respond to your enquiries and arrange meetings or calls.
• Provide governance, regulatory, and institutional-readiness advisory services that you have requested.
• Send you newsletters, regulatory notes, or updates that you have explicitly opted in to receive.
• Maintain our internal records, including conflicts checks, engagement files, and accounting.
• Operate, secure, and improve this website.
• Comply with applicable laws, regulations, professional standards, lawful requests by competent authorities, and our internal compliance obligations.

We will only use your name and contact details for direct marketing of our advisory services, events, or publications if you have given us your prior consent (typically by subscribing to our newsletter). You may withdraw your consent at any time, free of charge, by following the unsubscribe link in any marketing email or by contacting us using the details below. Once we receive your opt-out, we will cease using your data for direct marketing.

We do not sell your personal data. We may disclose it to the following classes of recipients on a need-to-know basis:

• Service providers acting under contract — including IT, hosting, analytics, and email-delivery providers, bound by confidentiality and data-processing terms.
• Professional advisers — auditors, legal counsel, or insurers, where reasonably necessary.
• Authorities and regulators — when required by law, court order, or a lawful regulatory request.
• Successors — in connection with a merger, acquisition, or reorganisation, subject to confidentiality undertakings.

Some recipients may be located outside Hong Kong. Where personal data is transferred outside Hong Kong, we apply contractual or other safeguards to ensure a level of protection comparable to that under the PDPO.

In line with DPP2 of the PDPO, we keep your personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal and professional obligations, to resolve disputes, and to enforce our agreements. Engagement-related data is typically retained for at least seven years from the conclusion of the engagement, consistent with professional record-keeping standards. Marketing records are kept until you opt out.

We take all practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss, or use, in line with DPP4 of the PDPO. These measures include access controls, encryption in transit, secure hosting, vendor due diligence, and staff confidentiality undertakings. No internet transmission is fully secure, however, and we cannot guarantee absolute security.

Subject to the PDPO, you have the right to:

• Request access to the personal data we hold about you (a "data access request").
• Request correction of personal data that is inaccurate.
• Withdraw any consent you have given for direct marketing or other purposes.
• Be informed of the classes of persons to whom your personal data may be transferred.

We may charge a reasonable fee for complying with a data access request, as permitted by the PDPO. To exercise any of these rights, please contact us using the details below. If you are not satisfied with how we have handled your personal data, you may also lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).

This website uses cookies and similar technologies. Please see our Cookie Notice for details on the categories of cookies we use, their purposes, and how you can control them through your browser.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. The "Last updated" date below will indicate when the policy was most recently revised. Material changes will be highlighted on this page or through other appropriate channels.

For data-access requests, correction requests, opt-out instructions, or any other questions about this Privacy Policy, please contact us at info@courageintl.com or via WhatsApp at (+852) 5336 0154. Address correspondence to: COURAGEOUS HL LIMITED, attention: Privacy Officer.