Privacy Policy

1. Introduction

Ink Stone ("we", "us", "our") is committed to protecting the personal data of individuals who interact with us. This Privacy Policy explains what personal data we collect, how we use it, and the rights you have in relation to it. Our practices are governed by the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO"). Where relevant, we also observe the principles of the General Data Protection Regulation ("GDPR") for individuals in the European Economic Area.

If you have questions about this policy, please contact us at: [email protected]

2. Data We Collect

We collect personal data in the following ways:

2.1 Information You Provide

• Name, email address, and phone number submitted through our contact form
• Message content included in form submissions
• Correspondence by email or telephone
• Information provided during initial consultation calls or meetings

2.2 Information Collected Automatically

• Pages visited, time spent on pages, and navigation paths (via analytics cookies where consent is given)
• Browser type, operating system, and approximate geographic location derived from IP address
• Referral source (the website or search engine that brought you to our site)

2.3 Client Engagement Data

During the course of an engagement, we may process institutional data — archival materials, manuscripts, catalog records — provided by client institutions. This data is processed solely for the purpose of delivering the contracted service and is governed by the data handling terms in each engagement agreement.

3. How We Use Your Data

• Responding to enquiries: We use contact form data to respond to your questions and to follow up on initial enquiries.
• Service delivery: During an active engagement, we use relevant contact data to communicate with institutional representatives.
• Analytics: Where you have consented to analytics cookies, we use aggregate, anonymised data to understand how this website is used and to improve it.
• Legal obligations: We may process data where required by law or to establish, exercise, or defend legal claims.

We do not use personal data for unsolicited marketing, and we do not sell personal data to third parties.

4. Legal Basis for Processing

Under the PDPO, we collect and use personal data only for the purpose for which it was provided and with the knowledge of the data subject. For individuals in the EEA, our legal bases are: your consent (for analytics cookies); the performance of a contract (for service delivery); legitimate interests (for responding to enquiries and managing our business); and compliance with legal obligations.

5. Data Retention

• Enquiry data: Retained for up to 24 months from the date of the enquiry, then deleted unless an engagement has commenced.
• Engagement data: Retained for the duration of the engagement plus three years, to meet contractual and legal obligations.
• Analytics data: Aggregated and anonymised; raw data retained for no more than 14 months.
• Institutional materials: Returned or deleted as specified in the engagement agreement, typically within 30 days of engagement conclusion.

6. Data Security

We implement technical and organisational measures appropriate to the sensitivity of the data we hold. These include encrypted data storage and transmission, access controls limiting data access to those who need it for their role, regular review of our data handling practices, and procedures for responding to data breaches, including notification to the Office of the Privacy Commissioner for Personal Data (PCPD) where required.

7. Cookies

We use essential cookies to keep this website functioning and, where you consent, analytics cookies to understand how the site is used. Full details of the cookies we use, their purpose, and how to manage your preferences are set out in our Cookie Policy.

8. Third-Party Services

We may use the following third-party services:

• Google Analytics: Where analytics cookies are accepted, we use Google Analytics (data processed by Google LLC). Google's privacy terms apply.
• Email services: We use a managed email platform to send and receive correspondence. Messages are stored securely and not used for any purpose other than communication.
• AI infrastructure: During service delivery, client institutional data may be processed through AI services operating under strict data handling agreements. No client data is used for third-party model training.

We do not embed social media tracking pixels or advertising networks on this website.

9. Your Rights

Under the PDPO, you have the right to:

• Request access to personal data we hold about you (Data Access Request)
• Request correction of inaccurate personal data
• Object to processing of your personal data in certain circumstances
• Withdraw consent to optional data processing (such as analytics cookies) at any time

For EEA individuals, additional rights under GDPR may apply, including the right to erasure, restriction, and data portability. To exercise any of these rights, contact us at [email protected]. We will respond within one month.

If you are dissatisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data Hong Kong (pcpd.org.hk).

10. Children's Privacy

Our services are directed at institutional clients and their professional representatives. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently received such data, please contact us and we will delete it promptly.

11. External Links

This website may contain links to external websites. We are not responsible for the privacy practices of those sites and recommend reviewing their privacy policies directly.

12. Changes to This Policy

We may update this policy from time to time. Where changes are material, we will notify active engagement clients by email. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of this website after any update constitutes acceptance of the revised policy.

13. Contact

For privacy-related queries:

Email: [email protected]

Address: Ink Stone, 8 Hollywood Road, Central, Hong Kong

Office hours: Monday to Friday, 9:00 am – 6:00 pm HKT