Privacy Policy

Who we are and what this policy covers

1. This policy is issued by VERDAQ Limited (business registration number: 79073216), a company incorporated under the laws of Hong Kong, with its registered office at Suite 4002A, 40/F, Tower 1, Lippo Centre, 89 Queensway, Admiralty, Hong Kong (VERDAQ, we, us or our). VERDAQ is a global intelligence and strategic advisory firm. For the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) (the PDPO), we are the data user responsible for the personal data described in this policy.

2. This policy, which includes our Personal Information Collection Statement, explains how we handle personal data collected through verdaq.com (the Site), when you contact us, attend our events, subscribe to our publications or apply to work with us.

3. Personal data processed in the course of a client engagement, or through a licensed platform, is governed by the relevant engagement or licence agreement and by section 12 of this policy.

4. We are committed to complying with the six Data Protection Principles in Schedule 1 to the PDPO, which cover how personal data is collected, kept accurate and retained, used, secured, made transparent, and made available for access and correction.

Personal data we collect

Information you give us

• Identity and contact details: name, job title, organisation, email address, telephone number and country.
• Enquiry details: the content of messages and forms you submit, and records of our correspondence with you.
• Event and subscription details: registrations, attendance, dietary or accessibility needs you choose to tell us, and your communication preferences.
• Recruitment details: CV, employment and education history, references and other information you provide when applying.

Information collected automatically

• Technical data: IP address, browser type and version, device type, operating system, time zone and language settings.
• Usage data: pages viewed, time spent, referring website, links clicked and the date and time of your visit.
• Cookie data, as described in section 9.

Information from other sources

• Professional information that is publicly available, such as company websites, professional networking profiles and corporate registries, used to understand who we are dealing with.
• Information from event co-hosts, referrers or recruitment agencies, where you have agreed to it being shared with us.
• Results of conflict, sanctions and know-your-client screening carried out before we accept an engagement.

We collect only what is adequate and not excessive for the purpose. Please do not send us sensitive personal data, such as health, biometric or financial account information, through the Site.

Why we collect and use your data

This section is our Personal Information Collection Statement. We collect and use personal data by lawful and fair means for the following purposes, and for directly related purposes:

1. responding to your enquiries and requests, and communicating with you;

2. assessing whether we can act for a prospective client, including conflict, eligibility, sanctions and know-your-client checks;

3. proposing, contracting for and delivering our Strategic Advisory, Intelligence and AI & Technology services, including platform trials and demonstrations;

4. organising events and sending publications or updates you have asked for;

5. direct marketing, where you have consented, as described in section 4;

6. assessing job applications and managing recruitment;

7. operating, maintaining, securing and improving the Site, including detecting and preventing fraud, abuse and security incidents;

8. understanding how the Site is used through aggregated analytics; and

9. complying with legal, regulatory and professional obligations, responding to lawful requests from authorities, and establishing, exercising or defending legal claims.

Fields marked as required on our forms are needed for the purpose stated. If you do not provide them, we may not be able to respond to your enquiry, register you for an event or consider your application. Other fields are voluntary.

We will not use your personal data for a new purpose, meaning one that is not the same as or directly related to the purpose for which it was collected, without your prescribed consent, unless an exemption under the PDPO applies.

Direct marketing

1. With your consent, we intend to use your name, job title, organisation, email address, telephone number and country, and your stated interests, to send you information about our advisory, intelligence and AI & technology services, our platforms, our research and insights, and our events.

2. We will not use your personal data for direct marketing unless you have given your consent, as required by Part 6A of the PDPO. We ask for consent separately, for example through an unticked box, and you are free not to give it.

3. We do not sell personal data, and we do not provide your personal data to any third party for that party's own direct marketing.

4. You can withdraw your consent at any time, free of charge, by using the unsubscribe link in any marketing email, or by writing to info@verdaq.com. We will stop sending you marketing promptly and keep a minimal record of your request so that we continue to respect it.

Who we share it with

We keep personal data confidential. We may disclose it, only so far as needed for the purposes in section 3, to the following classes of transferees:

• VERDAQ affiliates and offices, for internal administration and to deliver services across jurisdictions;
• service providers acting on our behalf, such as website hosting, cloud storage, IT support, email delivery, analytics, event management and recruitment systems;
• professional advisers, such as lawyers, auditors and insurers;
• regulators, courts, law enforcement agencies and other public authorities, where we are required or permitted by law;
• a buyer, successor or other party in connection with a merger, acquisition, restructuring or sale of all or part of our business, subject to confidentiality obligations; and
• any other person with your consent.

Where we use a data processor, we use contractual or other means to prevent the data from being kept longer than necessary and to protect it from unauthorised or accidental access, processing, erasure, loss or use, as required by Data Protection Principles 2(3) and 4(2).

Transfers outside Hong Kong

1. VERDAQ operates globally, and some of our affiliates and service providers are located outside Hong Kong. Your personal data may therefore be transferred to, stored in or accessed from places outside Hong Kong.

2. When we transfer personal data outside Hong Kong, we take all reasonable precautions and exercise due diligence to ensure it is protected to a standard comparable to the PDPO. This includes contractual safeguards that follow the Recommended Model Contractual Clauses for cross-border transfers issued by the Privacy Commissioner for Personal Data, access controls and encryption.

3. Data protection laws in other places may differ from those in Hong Kong. Where those laws give you additional rights, we will respect them.

How long we keep it

We keep personal data no longer than is necessary for the purpose for which it is used, in line with section 26 of the PDPO and Data Protection Principle 2(2). We then delete it securely or anonymise it. Typical periods are:

We may keep data longer where needed to comply with a legal obligation, resolve a dispute or enforce our agreements.

How we protect it

1. As an intelligence firm, we treat information security as a core discipline. We take all practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use, as required by Data Protection Principle 4. Measures include encryption in transit and at rest, role-based access controls, multi-factor authentication, staff confidentiality obligations and training, network monitoring, and vetting of service providers.

2. No method of transmission over the internet is completely secure. Please take care when sending us information, and use the secure channels we provide during an engagement.

3. If a data breach occurs that is likely to cause real risk of harm, we will notify affected individuals and the Privacy Commissioner for Personal Data as soon as practicable, in line with the Commissioner's guidance.

Cookies and similar technologies

Cookies are small text files stored on your device when you visit a website. We use the following categories:

When you first visit the Site, a privacy consent banner asks you to opt in to or opt out of non-essential cookies. Analytics and preference cookies are set only if you opt in, and strictly necessary cookies are used either way, including one that records your choice for 12 months, after which we will ask you again. We do not use advertising or cross-site tracking cookies.

You can change your choice at any time through the Privacy settings link here or in the Site footer, and you can block or delete cookies through your browser settings. Blocking strictly necessary cookies may affect how the Site works.

Your rights

1. Access. Under section 18 of the PDPO you may ask whether we hold personal data about you and request a copy of it. You can use the Data Access Request Form (OPS003) published by the Privacy Commissioner for Personal Data, or write to us with enough detail for us to locate the data.

2. Correction. Under section 22 you may ask us to correct personal data that is inaccurate. Where we have disclosed the data to a third party in the previous 12 months, we will tell them of the correction where practicable.

3. Marketing. You may withdraw consent to direct marketing at any time, free of charge, as described in section 4.

4. Response time and fees. We will respond to access and correction requests within 40 days of receipt. We may charge a fee for complying with an access request, which will not be excessive, and we will tell you the amount before proceeding. We do not charge for correction requests.

5. Verification and refusal. We may need to verify your identity before acting on a request. We may refuse a request where the PDPO permits, for example under section 20 or where an exemption in Part 8 applies, and if we do, we will tell you why in writing.

6. Complaints. If you have concerns, please contact our Data Protection Officer first, so we can try to resolve them. You also have the right to complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong, at www.pcpd.org.hk.

Artificial intelligence and automated processing

1. We do not use personal data collected through the Site to train or fine-tune artificial intelligence models.

2. We do not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects. Where we use AI tools to help with tasks such as screening or analysis, a qualified person reviews the result.

3. Personal data processed through our licensed platforms, or bespoke AI systems we build for clients, is governed by the relevant client agreement. In those cases our client is usually the data user and we process data on its instructions.

Data processed in our intelligence and advisory work

1. In delivering intelligence, due diligence, investigative and advisory services, we may process personal data about individuals connected with the matters we are instructed on, such as the owners, directors or representatives of organisations. This data is not collected through the Site.

2. We do this only for legitimate purposes agreed with our clients, using lawful and fair means, principally from public records, open sources and information provided by clients. We apply the Data Protection Principles to this work, subject to any exemptions that lawfully apply under Part 8 of the PDPO, such as those relating to the prevention or detection of crime, legal proceedings and due diligence in corporate transactions.

3. If you believe we hold personal data about you in connection with our work, you may contact our Data Protection Officer. We will handle your request in accordance with the PDPO, while respecting our legal and confidentiality obligations to clients.

Children

The Site is intended for business and professional audiences and is not directed at anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy to reflect changes in law, guidance or our practices. The updated version will be posted on this page with a new effective date. If the changes are significant, we will make that clear on the Site or contact you directly where appropriate.

Contact our Data Protection Officer

For access or correction requests, to withdraw marketing consent, or for any question about this policy, please contact:

If this policy is translated into Chinese or any other language, the English version prevails in case of any inconsistency.