Privacy Statement

Last updated: June 2026

1. Introduction
   

   1. 33 Consulting Limited (“we”, “our”, “us”) is committed to protecting the privacy, confidentiality and security of individuals whose personal data we collect while operating our business and providing consultancy services.
      

   2. This Privacy Statement explains how we collect, use, store and disclose personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (“PDPO”).
      

   3. By using our website or providing personal data to us, you agree to the terms of this Privacy Statement.
      

2. Data User

   1. For the purposes of the PDPO, the data user is:
      
      33 Consulting Limited
      Unit 1603, 16th Floor
      The L. Plaza
      367 - 375 Queen's Road Central
      Sheung Wan, Hong Kong
      
      Email: privacy@33-consulting.com
      

3. Personal Data We Collect
   

   1. We may collect and process the following categories of personal data:
      

      1. Contact information such as your name, job title, company, email address and phone number.
         

      2. Information submitted through our website including enquiry forms or consultation requests.
         

      3. Business contact information provided during discussions or engagement processes.
         

      4. Information required for conflict checks onboarding and service delivery.
         

      5. Technical and analytics data, including IP address, browser type, device information (including potentially information of mobile devices), and cookies.
         

      6. Any information you voluntarily provide during communications with us.
         

   2. We do not intentionally collect sensitive personal data through our website and ask that you do not submit such information via online forms.
      

4. How We Use Personal Data
   

   1. We use personal data for the following purposes:
      

      1. Responding to enquiries and requests for information.
         

      2. Assessing whether we can contract with you, including conflict checks.
         

      3. Providing consultancy services and managing client relationships.
         

      4. Communicating with you about matters relevant to our services.
         

      5. Billing, administration and internal record-keeping.
         

      6. Improving our website, operations and user experience.
         

      7. Complying with legal, regulatory or professional obligations.
         

   2. We will not provide your personal data to third parties for direct marketing purposes or other unrelated purposes without your consent.
      

   3. We do not sell personal data.
      

5. Whether Provision of Data Is Voluntary or Mandatory
   

   1. Providing personal data is generally voluntary. However, certain information may be necessary for us to respond to your enquiry, assess whether we can act for you, or provide services. This information is marked with an asterisk. If you choose not to provide the required information, we may be unable to proceed with your request.
      

6.  Disclosure of Personal Data
   

   1. We may disclose personal data to the following categories of recipients, strictly on a need-to-know basis:
      

      1. IT and cloud service providers (e.g., email hosting, website hosting, scheduling tools).
         

      2. Professional advisers such as accountants or auditors.
         

      3. Third-party service providers engaged to support our operations.
         

      4. Regulatory authorities, law enforcement agencies or courts where required by law.
         

   2. All third parties are expected to handle personal data in accordance with applicable privacy obligations.
      

7. Data Retention
   

   1. We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or to meet legal, regulatory or professional requirements.
      

   2. Typical retention periods include:
      

      1. Enquiry and website contact data: generally retained for 12–24 months.
         

      2. Customer / client-related data: retained for statutory limitation periods (typically 6–7 years) or longer where required by law or professional obligations.
         

8. Data Security
   

   1. We take reasonable precautions to safeguard personal data against unauthorised access, loss, misuse or alteration. These measures include:
      

      1. Access controls and authentication measures.
         

      2. Secure cloud infrastructure.
         

      3. Encryption and secure transmission protocols where appropriate.
         

      4. Internal confidentiality obligations.
         

   2. No method of transmission or storage is completely secure, but we take steps consistent with industry standards to protect personal data.
      

9. Your Rights Under the PDPO
   

   1. Under the PDPO, you have the right to:
      

      1. Request access to personal data we hold about you.
         

      2. Request correction of inaccurate personal data.
         

      3. Enquire about our policies and practices relating to personal data.
         

   2. Requests should be submitted in writing to the contact details provided in Section 2. We may charge a reasonable fee for processing data access requests.
      

10. Cookies and Website Analytics
    

    1. Our website may use cookies and similar technologies to:
       

       1. Understand how visitors use the site.
          

       2. Improve functionality and user experience.
          

       3. Support security and performance.
          

    2. Most web browsers are initially set up to accept cookies. You can choose to ‘not accept’ cookies by changing or disabling cookies through your browser settings, although some website features may not function properly as a result.
       

    3. If we use third-party analytics tools (e.g., Google Analytics or Microsoft Clarity), these providers may collect data in accordance with their own privacy policies.
       

11. Professional Confidentiality
    

    1. Information shared with us in the context of seeking or receiving consultancy services is treated confidentially. These obligations arise from contract and professional standards and apply independently of the PDPO.
       

    2. Submitting information through our website does not create a lawyer–client relationship. Please do not submit confidential or sensitive information through online forms.
       

12. Updates to This Privacy Statement
    

    1. We may update this Privacy Statement from time to time. Any changes will be posted on this page with an updated “Last updated” date. Continued use of our website constitutes acceptance of the updated terms.
       

13. Contact Us
    

    1. If you have any questions about this Privacy Statement or wish to exercise your rights, please contact:

Victoria-Emile Smyth
Director, 33 Consulting Limited
privacy@33-consulting.com