EN
Client Portal Free consultation

Privacy Policy

Effective：2026-11-13 · Version 1.0

1. Who we are

This website, hkesc.com.hk, is operated by HKCSC LIMITED (香港企業服務中心有限公司) (Business Registration No. 76839255) under the names “Hong Kong Enterprise Service Centre (HKESC)” and “香港企業服務中心” (“we”, “us”). We hold a Trust or Company Service Provider licence issued by the Companies Registry (licence no. TC010205, valid until 14 May 2028), which the public can check on the Companies Registry’s TCSP register.

We are a data user under the Personal Data (Privacy) Ordinance (Cap. 486) (the “PDPO”) and handle personal data in line with the six Data Protection Principles in Schedule 1. Contact details are in section 11.

2. Personal data we collect

We collect only what is necessary and not excessive for providing our services:

  1. Enquiry and contact data: how we should address you, phone, WhatsApp number, WeChat ID, email, the type of client you are (e.g. talent-visa holder, e-commerce seller), the service you are interested in, the centre you want to visit, your expected start date and your message.
  2. Quotation, engagement and payment data: billing details, services quoted and engaged, quotation and service agreement records, transaction records.
  3. Customer due diligence (CDD) data: under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and Companies Registry guidelines, we must collect identity documents, proof of address, date of birth, nationality, occupation, source of funds and corporate structure for directors, shareholders, ultimate beneficial owners and authorised persons. This data is not collected through the website form; it is collected securely at engagement.
  4. Company secretarial and statutory records: information filed with the Companies Registry, Inland Revenue Department and other authorities for incorporations, annual returns, changes and deregistrations.
  5. Technical data: server logs (e.g. IP address — we store only an irreversibly hashed value, never the raw IP — browser type and time of visit) for operating and securing the website and preventing abuse. Where enabled, we use cookie-free Cloudflare Web Analytics to count overall visits; it is not used to identify individuals.

When you contact us using the website’s WhatsApp or WeChat buttons, a message is pre-filled with the address of the page you are viewing so we know which service you are asking about. You can edit or delete it before sending.

If you do not provide data marked as required, we may be unable to reply, provide services or complete statutory due diligence.

3. Purposes

  1. Replying to enquiries, providing quotations, arranging visits and consultations;
  2. Issuing quotations and service agreements, processing payments, issuing receipts and providing services;
  3. Meeting statutory obligations for customer due diligence, anti-money laundering, sanctions screening, record keeping and, where applicable, suspicious transaction reporting to the Joint Financial Intelligence Unit;
  4. Filing documents with the Companies Registry, Inland Revenue Department and other authorities on your behalf;
  5. Referring you, with your consent, to banks, law firms or accounting firms;
  6. Arranging office space, registration addresses and meeting rooms;
  7. Operating, securing and improving the website and our services;
  8. Handling complaints, disputes and legal claims;
  9. Complying with laws, regulations, court orders and regulators’ requirements;
  10. Direct marketing, only with your separate, express consent (section 7).

We will not use your data for a new purpose unrelated to the above without your prescribed consent.

4. Who we may transfer data to

We may transfer data for the above purposes to the following classes of persons:

Providers are contractually required to process data only on our instructions, keep it secure and delete it when no longer needed (Data Protection Principles 2(3) and 4(2)). We do not sell personal data, and we do not provide it to others for direct marketing without your separate consent.

5. Where data is stored and cross-border transfers

Data submitted through the website form is stored in a cloud database provided by Cloudflare and may be processed outside Hong Kong. WhatsApp messages are subject to Meta/WhatsApp’s terms; WeChat messages are processed by Tencent and may be stored and processed in mainland China under Tencent’s terms. Transfers to mainland China (for example, follow-up by our Qianhai affiliate) are made only when necessary and in line with applicable law, and we require the recipient by contract to provide protection comparable to the PDPO (for example, using the Privacy Commissioner’s recommended model contractual clauses for cross-border data transfer). Where data is transferred from mainland China to Hong Kong, we follow the applicable mainland rules, including the Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong) where applicable.

6. Users in mainland China (PIPL)

Where we provide services to you in mainland China and the Personal Information Protection Law of the PRC applies, we will handle your personal information as that law requires — including, where the law requires, obtaining your separate consent for processing sensitive personal information or providing it outside mainland China — and respect your statutory rights to access, copy, correct, delete and withdraw consent.

7. Direct marketing (PDPO Part 6A)

We intend to use your name or how we address you, phone number, email, WhatsApp number, WeChat ID and service records to send you information, offers and event notices about office space, company secretarial, accounting, tax and related corporate services.

8. Retention

After the retention period we securely delete or anonymise the data.

9. Security

We use reasonable technical and organisational measures, including HTTPS encryption, access controls, staff confidentiality obligations and regular backups. No internet transmission is completely secure; if a data breach occurs we will handle it in line with the Privacy Commissioner’s Guidance on Data Breach Handling and Data Breach Notifications and, where appropriate, notify the Privacy Commissioner and affected individuals.

10. Changes

This policy is published on the website. We may revise it from time to time; revised versions will be posted with an updated effective date, and material changes will be notified reasonably.

11. Access, correction and contact

You may request access to or correction of your personal data, or withdraw direct marketing consent, in writing (including by email or WhatsApp) to our Data Protection Officer:

We will respond within 40 days of receiving your request. Under section 28 of the PDPO we may charge a fee for data access requests that is not excessive (limited to directly related and necessary costs); correction requests are free.

12. Language

This policy is available in Traditional Chinese, Simplified Chinese and English. If there is any inconsistency, the Traditional Chinese version prevails.

Personal Information Collection Statement (website enquiry form)

The information you provide in the website enquiry form is used only to reply to that enquiry, arrange visits and provide quotations (section 3, item 1), and is handled as described in sections 4 to 8. Name, contact method, service of interest and client type are required; without them we cannot reply. You have the right to request access to and correction of your personal data; see section 11 for details and contacts. We will not use form data for direct marketing without your separate consent. Please do not enter identity document numbers or upload documents in the form.

WhatsApp us ☎

Chat with an adviser on WeChat

Chat with an adviser on WeChat

Open WeChat, tap Scan and scan the QR code to add our adviser

Add us on WeChat

Or long-press the QR code in WeChat, or save it and scan from your album.

Save QR code