Privacy Policy

How One IBC Limited (Offshore Company Corp) collects, uses, shares and protects personal data on our website and client portal, and how to use your rights.

Applies to: HK, EU/EEA, UK, SG, VN, US, Other

In plain language

• One IBC Limited in Hong Kong (brand Offshore Company Corp) is responsible for your personal data. Write to privacy@offshorecompanycorp.com.
• We collect what you type into our website forms, checkout, chat and client portal, plus security data such as your sign-in devices.
• When you become a client, Hong Kong anti-money laundering law requires us to check who you are. You upload identity and ownership documents to our encrypted document vault in the portal.
• We keep client and KYC records for at least 5 years after our relationship ends, because the law requires it. We cannot delete them earlier.
• We never see or store your full card number. You enter card details on our payment providers' hosted payment pages or fields.
• Our AI assistant, Ask OCC, is a computer program, not a person. We keep chats for 30 days, or 24 months if you send us an enquiry from the chat, and our sales staff may read them to follow up. It does not decide whether we accept you as a client.
• We send marketing emails only if you opt in. You can change this in the preference centre or with the unsubscribe link at any time.
• Our service providers are mainly in Singapore and the United States. You can ask to see, correct or delete your data.

This summary helps you read the document. If it differs from the full text below, the full text applies.

1. Who we are and what this notice covers

This website and client portal are run by One IBC Limited, a company in Hong Kong that trades as Offshore Company Corp (OCC). We hold Trust or Company Service Provider licence TC001305 from the Hong Kong Companies Registry. Our head office is Unit 1411, 14/F, COSCO Tower, 183 Queen's Road Central, Sheung Wan, Hong Kong.

One IBC Limited decides why and how your personal data is used. In data protection law that makes us the "data user" (Hong Kong), the "controller" (EU and UK), the "organisation" (Singapore) and the "personal data controller" (Vietnam).

One IBC Limited and One IBC Pte. Ltd (Singapore, ACRA registered filing agent no. FA20180115) are sister companies in One IBC Group. Our Terms of Service name the company that carries out each part of a service (the "performing company"): One IBC Pte. Ltd in Singapore, One IBC America, Inc. in the United States or Công ty TNHH One IBC Việt Nam (One IBC Vietnam Co., Ltd) in Vietnam. A performing company uses your data only to carry out that work, and may also be responsible for it under its own local law. One IBC Limited stays your contact for every privacy request.

This notice covers offshorecompanycorp.com and everything behind it: our forms, call booking, checkout, the Ask OCC assistant, the client area at /myaccount (My account) (accounts, document vault, identity checks, company formation and company secretarial records), the emails we send, and cookies.

For any privacy question or request, email privacy@offshorecompanycorp.com or write to our office address above.

2. Personal data we collect

We collect only the data we need for the service you ask for. Fields marked optional are optional. The list depends on how far you go with us: a visitor who sends one question gives us much less than a client who forms a company.

• Enquiries (contact, quote, call booking, price list, shortlist, partner forms): your name, email, phone or WhatsApp number, country of residence, what you need, your message, and for calls the time slot, time zone and language. Partners also give firm details.
• Checkout and orders: proposed company names, business activity, your name as on your passport, email, phone, country of residence, payment method, order details, invoices and the time you accepted our terms.
• Payments: the payment status and a reference from our payment processor or bank. We do not receive or store full card numbers or card security codes.
• Client portal account: your name and email, sign-in links we email you, your two-step sign-in method (an authenticator app secret or a passkey's public key; we never receive your fingerprint or face data from a passkey), and your signed-in devices with browser type, approximate location from IP address and sign-in times.
• Team members: if your account lets several people work on the same company, the name, email and role of each person you invite, and who did what in the account.
• Identity and due diligence (KYC/CDD): passport or national ID, proof of address, date of birth, nationality, residential address, and the same details for directors, shareholders, beneficial owners (UBOs) and company secretaries. Also whether a person is a politically exposed person (PEP), the results of sanctions, PEP and adverse media screening, and our risk rating.
• Company records: statutory registers of directors, members, beneficial owners and secretaries, share details, company documents we prepare or you upload, and filings with registries.
• Emails: which service, security and marketing emails we sent you, whether they were delivered or bounced, your email preferences, and unsubscribe records.
• Account history: notes, calls, tasks and messages our staff record about your enquiry or account in our customer records system.
• Ask OCC assistant: the questions you type and the answers you receive (with numbers that look like card, IBAN, passport or ID numbers removed), the language, the page you chat from, the packages and prices shown to you (your cart), any rating you give, and a buying-intent score. See section 7.
• Your choices: whether you agreed to be contacted, your marketing choice, the version of this notice shown to you and the time.
• Campaign data (only where your cookie choice allows it): the advert or campaign that brought you to us, such as UTM tags, advertising click IDs, the landing page and the referring website.
• Technical data: your IP address is used to limit abuse and protect your account. With website forms we store only a one-way hash of it. Our hosting provider also sees standard request data such as browser type in its logs.

3. Identity documents and sensitive data

As a licensed Trust or Company Service Provider, we must identify and verify our clients and their beneficial owners before we act for them, and keep checking them while we do. That is why we ask for identity documents and ownership details in the client portal. We do not ask for these on the public website pages.

Screening against sanctions, PEP and adverse media lists can show information about criminal allegations or convictions, or a person's public or political role. We use it only to meet our anti-money laundering duties and to decide whether we can act, and only trained staff can see it.

For electronic identity checks (eKYC) we use Veriff, an independent identity verification provider. Veriff compares a selfie or short video with your ID photo (a liveness check), which involves biometric data. We ask for your explicit consent first and offer another way to verify you, such as a certified copy of your documents. Veriff carries out the check under its own terms and privacy notice.

We do not ask for health data, religious beliefs or sexual orientation. Please do not include this kind of information, or bank or card details, in forms, the chat or uploaded files unless we ask for a specific document. If you do, we will use it only to reply to you, or delete it.

4. Why we use your data and our legal basis

We use your data only for the purposes below. For people in the EU, EEA and UK, we also name the legal basis under Article 6 of the GDPR and UK GDPR. For people in Vietnam, see section 18.

• To answer your enquiry, prepare a quote or hold a call: steps you ask for before a contract (Art. 6(1)(b)). One follow-up on the same enquiry: our legitimate interest in completing it (Art. 6(1)(f)).
• To take your order, form and administer your company, keep its statutory registers, file with registries, invoice you and take payment: to perform our contract with you (Art. 6(1)(b)), and to meet company law duties in the place your company is registered.
• To run your portal account, sign you in safely, show you your devices and let your team members work together: to perform our contract (Art. 6(1)(b)) and our legitimate interest in keeping accounts secure (Art. 6(1)(f)).
• To verify identity, screen against sanctions and PEP lists, rate risk and monitor the relationship (KYC/CDD): our legal obligations under Hong Kong's Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). For people in the EU, EEA and UK, where no EU or UK law requires this, we rely on our legitimate interest in meeting our Hong Kong legal duties and preventing financial crime (Art. 6(1)(f)), and on Art. 6(1)(c) where EU or UK law applies. We process data about criminal offences only as the law allows (Art. 10). Biometric data, if used, only with your explicit consent (Art. 9(2)(a)).
• To keep client, KYC, order and payment records after the relationship ends: our legal obligations under AMLO and tax law. See section 12.
• To send service and security emails (sign-in links, order updates, invoices, security alerts): to perform our contract (Art. 6(1)(b)) and our legitimate interest in account security (Art. 6(1)(f)). You cannot opt out of these while you have an account.
• To send marketing emails: your consent (Art. 6(1)(a)).
• To keep our customer records accurate and plan follow-ups: our legitimate interest in running our business (Art. 6(1)(f)).
• To measure how the site is used and which adverts work: your consent where we ask for it first (Art. 6(1)(a)). See the cookie policy.
• To protect the site and portal from spam, bots, fraud and abuse: our legitimate interest in security (Art. 6(1)(f)).
• To answer questions in the Ask OCC assistant: steps you ask for before a contract (Art. 6(1)(b)) and our legitimate interest in quick, accurate answers (Art. 6(1)(f)). To check and improve the quality of its answers, and to score buying intent so our sales staff can follow up on the most promising conversations first: our legitimate interest in improving our service and following up on genuine interest in it (Art. 6(1)(f)). You can object at any time.
• To handle privacy requests and complaints, and to defend legal claims: legal obligations (Art. 6(1)(c)) where EU or UK law applies, otherwise our legitimate interest (Art. 6(1)(f)).

5. Data about other people

When you order a company, you usually give us details of other people: directors, shareholders, beneficial owners, company secretaries and colleagues you invite to your account. Please give them a copy of this notice or a link to it before you do. We may contact them directly to verify their identity, as the law requires.

6. Marketing

We send marketing only if you tick the optional marketing box. The box is never ticked for you, and your request is handled the same way whether you tick it or not.

If you agree, we will use your name and email address to send you news, guides and offers about company formation, company secretarial, bookkeeping and compliance support, bank-account introduction support, and related corporate services from Offshore Company Corp. We send marketing by email only.

You can withdraw your consent at any time, free of charge, with the unsubscribe link in every marketing email, in the email preference centre, or by writing to privacy@offshorecompanycorp.com. We then stop and keep your email on a suppression list so we do not contact you again by mistake.

We do not sell your personal data, and we do not give it to other companies for their own marketing.

Messages about your own request or order, such as a quote, a booking confirmation or an invoice, are service messages, not marketing. If you give us a Singapore phone number, we will not send you marketing calls or messages to it unless you have given clear consent or we have checked the Singapore Do Not Call Registry.

7. Ask OCC, our AI assistant

Ask OCC is an AI assistant, not a person. When it is switched on, it may use a large language model called Claude, provided by Anthropic. It answers from our published prices and facts, and it can make mistakes. Its answers are general information, not legal or tax advice.

When you use it, we send your messages in that conversation and basic page context (such as the jurisdiction or service you are viewing) to our server and, when the AI model is on, to Anthropic to produce an answer. Anthropic acts as our service provider (processor) for this. We do not send your name or email to Anthropic unless you type them into the chat. Please do not type passport, bank or card details.

What we store: every conversation is stored on our servers. We keep your questions and our answers, the language, the page you chat from, the packages and prices the assistant showed you (your cart) and any rating you give. Before we store a message, we remove numbers that look like card numbers, IBANs, or passport and ID numbers. Email addresses and phone numbers you type stay in the conversation. Your browser keeps a random session ID for that tab; we store only a one-way hash of it, to link your messages and limit how many you can send per hour. Where your cookie choice allows, we also keep the campaign that brought you to us.

How long: we delete a conversation 30 days after your last message. If you send us an enquiry from the chat (for example, you ask us to email a summary, save a quote or call you), the conversation becomes part of that enquiry and we keep it for 24 months after your last message, like other enquiries. Some conversations are also copied into a review queue where our staff check the quality of the answers: those you rated down, where you asked for a person, where the assistant could not answer or refused, or that led to an enquiry, plus a random sample. The copy is deleted when the conversation is deleted. If our staff have already reviewed it, we keep only their rating and correction and, to test the assistant, your first question with email addresses and phone numbers removed. When the assistant could not answer a question, we also keep that question, with email addresses and phone numbers removed, so our content team can add the missing answer (see section 11).

Why: to answer you, to check and improve the quality of the answers, and to follow up on sales interest. For that last purpose, our server gives each conversation a buying-intent score from what you ask, for example prices, a package choice, how to pay or how soon you can start. When the score is high and you have not sent us an enquiry, the conversation is listed for our sales team, who may read it and, if you typed an email address or phone number, reply to your question. Our legal basis is our legitimate interest in answering questions well and in following up on genuine interest in our services (GDPR Art. 6(1)(f)).

Who can read it: only authorised OCC staff (sales, compliance, operations and administrators) through our admin system, including the review queue. Our content team also sees the unanswered questions, with email addresses and phone numbers removed. We do not sell conversations or give them to anyone for their own marketing.

The score only decides which conversations our staff look at first. Ask OCC suggests jurisdictions, packages and prices. Neither makes any decision that has a legal or similarly significant effect on you, such as accepting or refusing you as a client. Those decisions are made by our staff after our KYC checks. You can ask to talk to a person at any time.

You can object to this use or ask us to delete a conversation at any time, free of charge: use "Your privacy rights" in the site footer or email privacy@offshorecompanycorp.com. To help us find the conversation, tell us roughly when you chatted and what you asked, or the email or phone number you typed. If you object, we stop using the conversation for sales follow-up and delete it, including any copy in the review queue, unless it is part of an enquiry or client record we must keep.

8. Cookies and similar technologies

We use strictly necessary cookies to run the site and checkout. We use analytics and marketing cookies only as your cookie choice allows. Wherever you are, they stay off until you accept them. You can change your choice at any time with "Cookie settings" in the footer.

Our cookie policy lists every cookie and storage item we use, what it is for and how long it lasts.

9. Who we share your data with

We share personal data only with the companies below. Our service providers act on our instructions (processors). The other recipients use the data for the purpose described. Some providers are used only when a feature is switched on.

• Our group and performing companies: One IBC Pte. Ltd (Singapore), our sister company in One IBC Group, and, when our Terms name them for your service, One IBC America, Inc. (United States) and One IBC Vietnam Co., Ltd (Vietnam). They receive only the data needed to carry out that service. We do not share data within our group for marketing.
• Website, portal hosting and server functions: Vercel Inc. (United States; servers in the region we choose).
• Database: Neon (Postgres), hosted on Amazon Web Services in Singapore (ap-southeast-1). It holds enquiries, accounts, orders, invoices and our customer records.
• One IBC's own record and backup systems: we also keep client records and backups in database systems operated by One IBC. They are hosted and managed in line with the data protection and record-keeping laws of the country where they are stored.
• Document storage: a cloud object storage provider holds only files we have encrypted; the provider cannot read them.
• Email delivery: Amazon Simple Email Service (Amazon SES), run by Amazon Web Services in its Singapore region (ap-southeast-1), for service, security and marketing emails.
• Call booking: Cal.com (United States).
• Messaging apps: WhatsApp (Meta) and other messaging services, when you choose to contact us on them. Your messages are also handled under that service's own terms.
• Bot protection: Cloudflare Turnstile (United States).
• Card and wallet payments: our payment providers, including PayPal. You enter your card details on their hosted payment fields or pages, so we never see your full card number. They act under their own terms for fraud prevention and legal duties, and tell us whether the payment succeeded.
• Bank transfers: our bank, which receives your payment reference and sender details.
• AI assistant: Anthropic PBC (United States), as our processor, when the Claude model is switched on. It receives the messages of an Ask OCC conversation to produce the answers.
• Identity verification and screening: Veriff (electronic identity verification) and World-Check, a screening database provided by LSEG (sanctions, politically exposed person and adverse media screening). Each receives only what the check needs and handles it under its own terms and privacy notice.
• Analytics and advertising (only after you accept those cookies): Google (Tag Manager, Analytics, Ads).
• Company registries, licensed local partners, registered agents, company secretaries and banks in the place where your company is formed or where you ask us to introduce you. They receive what that service needs and use it under their own rules. Some company registers are open to the public where the law requires it.
• Regulators, law enforcement, financial intelligence units, courts and professional advisers, when the law requires it or to protect our legal rights. The law may stop us from telling you about some of these disclosures.
• A buyer or successor, if our business is sold or reorganised, under the same protections as this notice.

10. Transfers outside your country

We are in Hong Kong, our database and our sister company are in Singapore, performing companies are in the United States and Vietnam, and several providers are in the United States. To form a company abroad we must also send details to the registry and agents in that country. One IBC also operates its own record and backup systems, which may be hosted in other countries; we tell you which on request. Your data may therefore be processed outside the place where you live.

Where the law requires a safeguard, we use one of these: for the EU and EEA, the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), or the EU-US Data Privacy Framework (Decision (EU) 2023/1795) for US providers certified under it; for the UK, the International Data Transfer Agreement or UK Addendum, or the UK Extension to the Data Privacy Framework; for Singapore, contracts that give a comparable standard of protection; for Hong Kong, contract terms based on the Privacy Commissioner's recommended model clauses; for Vietnam, the cross-border transfer impact assessment the law requires, kept up to date.

When we send details to a registry or agent in the country where you asked us to form your company, and no other safeguard is available, the transfer is necessary to perform the contract you asked for (GDPR Art. 49(1)(b)).

You can ask us for more information about the safeguard used for a transfer, or a copy of it, at privacy@offshorecompanycorp.com.

11. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires. Then we delete it or remove the details that identify you.

• Enquiries, quote requests, call bookings, price lists and partner applications that do not lead to an order: 24 months after our last contact, then anonymised.
• Ask OCC conversations: 30 days after the last message, then deleted. A conversation that becomes part of an enquiry (you send us an enquiry from the chat): 24 months after the last message, like the enquiry. The sales follow-up record of a conversation, and any copy of it in our staff review queue, is kept for the same period as the conversation. After that, a review our staff completed keeps only their rating and correction and the first question with email addresses and phone numbers removed.
• Questions Ask OCC could not answer: the question, with email addresses, phone numbers and card, IBAN, passport and ID numbers removed, is kept for 12 months after it was last asked, then deleted.
• Saved carts and resume links: the link works for 30 days; we delete the cart 90 days after the link expires.
• Checkouts you start but do not submit: 12 months, then your contact details are removed.
• Client records, including KYC/CDD documents, screening results, risk ratings, orders, invoices and payments: at least 5 years after our business relationship ends, as Hong Kong anti-money laundering law requires. Longer only if a law, investigation or legal claim requires it.
• Access logs for the document vault: for as long as we keep the document they relate to.
• Statutory registers and company documents: while we act for the company, then for as long as the company law of the company's country requires.
• Biometric data from a liveness check: handled and deleted by the identity verification provider under its own retention rules. We keep only the result.
• Portal account and device records: while your account is open. Sign-in and security logs: 12 months.
• Email delivery log (metadata only, such as the date, the type of email and whether it was delivered, not the content): 24 months. Unsubscribe and suppression records: for as long as we need to respect your choice.
• Privacy requests and complaints: 3 years after we close them.
• Cookies: see the cookie policy for each cookie.

12. Keeping records and deleting data

As a licensed Trust or Company Service Provider, we must keep customer due diligence and transaction records, including copies of identity documents and screening results, for at least 5 years after the business relationship ends (Anti-Money Laundering and Counter-Terrorist Financing Ordinance, Cap. 615, Schedule 2, section 20).

If you ask us to delete data we must keep under that duty, we will delete what we can and restrict the rest, so it is used only for the legal purpose. We will tell you what we kept and why. We delete or anonymise it when the retention period ends.

Some company records must be kept or filed under the company law of the place where your company is registered, and public registers are controlled by the registry, not by us.

If you never became a client, the AMLO duty does not apply, and we will delete your enquiry when you ask, unless we need it for a legal claim.

13. How we protect your data

We use technical and organisational measures that fit the risk. They include:

• Encrypted connections (HTTPS with HSTS) for every page, form and portal screen.
• Security headers that limit which outside scripts can run on our pages.
• Portal sign-in by one-time email links, with two-step sign-in by an authenticator app or a passkey. You can see your signed-in devices and sign them out.
• Each file in the document vault is encrypted on its own (AES-256-GCM with envelope encryption). Files are opened only through signed links that expire after a short time, and every access is logged.
• Access for our staff only through named accounts, with roles that limit what each person can see and change. Only staff who need identity documents for their work can open them.
• Rate limits and a bot check on forms, sign-in and the chat. IP addresses from website forms stored only as a one-way hash with a secret key.
• Names, emails and phone numbers are kept out of our application logs.
• No card data on our systems: you enter card details on the hosted payment fields or pages of our payment providers, who are responsible for card security under the PCI DSS standard.

14. If something goes wrong

If a personal data breach happens, we act to contain it and assess the risk. Where the law requires, we tell the regulator and the people affected within the legal time limit. For example, the GDPR and UK GDPR require notice to the regulator within 72 hours where a breach is likely to risk people's rights, Vietnam requires notice to the Ministry of Public Security within 72 hours, and Singapore requires notice to the PDPC within 3 calendar days after we assess that a breach is notifiable. In Hong Kong we notify the Privacy Commissioner and affected people where there is a real risk of harm, following the Commissioner's guidance.

15. Your rights

Depending on where you live, you can ask us to:

• Tell you whether we hold data about you and give you a copy.
• Correct data that is wrong or incomplete.
• Delete your data, subject to section 12.
• Restrict how we use your data, or object to our use of it. You can always object to marketing, and we will stop.
• Give you the data you provided in a common machine-readable format, or send it to another organisation (EU, EEA and UK).
• Withdraw your consent at any time. This does not affect what we did before you withdrew it.
• Explain how a decision was made, and let a person review it. We do not make decisions about you by automated means alone that have legal or similarly significant effects. Screening tools flag possible matches, and our staff decide what to do.
• Complain to us or to a regulator (see sections 16 and 17).

16. How to make a request or complaint

Email privacy@offshorecompanycorp.com, or use "Your privacy rights" in the site footer, which opens our contact form with a privacy request. Clients can also see and download their documents in the portal.

Requests are free. We may ask for information to confirm your identity before we act, and we will use it only for that purpose. We will not ask you to send a passport or other identity document through the public contact form.

We reply within the time your law allows. That is within 40 days for Hong Kong access and correction requests, within one month for the GDPR and UK GDPR (we may extend this by up to two further months for complex requests and will tell you why), and as soon as reasonably possible, normally within 30 days, for Singapore. For Vietnam, we acknowledge your request within 2 working days and then act within the limits in Decree 356/2025/ND-CP.

If you complain to us about how we use your data, we acknowledge the complaint within 2 business days and send you a full reply within 30 days. If you are not satisfied, you can go to a regulator.

Anti-money laundering law may stop us from telling you about some checks or reports, or from giving you some screening information. If so, we will give you everything else.

17. Regulators

You can complain to the data protection regulator where you live or work, or where you think the problem happened. For example:

• Hong Kong: Office of the Privacy Commissioner for Personal Data (pcpd.org.hk).
• EU and EEA: the supervisory authority in your country, listed by the European Data Protection Board (edpb.europa.eu).
• United Kingdom: Information Commissioner's Office (ico.org.uk).
• Singapore: Personal Data Protection Commission (pdpc.gov.sg).
• Vietnam: Ministry of Public Security, Department of Cybersecurity and High-Tech Crime Prevention (A05).

18. Extra information for people in Vietnam

Vietnam's Law on Personal Data Protection No. 91/2025/QH15 and Decree 356/2025/ND-CP apply to foreign organisations that process the personal data of people in Vietnam.

We ask for your consent in a clear, separate way for each purpose. Silence, inaction or a pre-ticked box is never consent. Sending a form or starting a chat is consent to use your data to answer that request. Marketing emails and analytics or advertising cookies each need their own consent.

Some data we process is sensitive personal data under Vietnamese law: images of ID cards, bank and financial data, information on criminal records from screening, biometric data (where you use the electronic identity check) and online behaviour tracking such as advertising cookies. In the portal we ask for separate, explicit consent before we collect it, except where the law allows us to process it without consent. We use advertising cookies only if you accept marketing cookies.

Your data is transferred to Hong Kong, Singapore, the United States, the country where your company is formed and any other country where One IBC hosts its own record and backup systems, as described in section 10. We keep a cross-border transfer impact assessment as the law requires.

If you withdraw consent or ask us to delete data, we may no longer be able to provide our service, and anti-money laundering law may require us to keep some records. We will tell you if that is the case.

Ask OCC uses artificial intelligence to answer questions. It suggests options only and does not make decisions about you. Before you chat, the chat window tells you that we store the chat for 30 days (24 months if you send us an enquiry) and that our staff may read it to improve answers and follow up on your interest, as described in section 7. You can object to this use or ask us to delete the chat at any time through "Your privacy rights" in the site footer or by email to privacy@offshorecompanycorp.com, and we will handle your request as described in that section.

19. Visitors in the United States

If you are in the United States, you can use the rights described in this notice. We do not sell personal data. Where a US state privacy law applies to us, we answer the requests that law gives you the right to make; write to privacy@offshorecompanycorp.com. If your browser sends a Global Privacy Control signal, we treat it as a refusal of marketing cookies. You can use the rights described in this notice wherever you live.

20. Children

Our services are for adults forming and running companies. The website is not aimed at anyone under 18, and we do not knowingly collect data from children. If you think a child has sent us data, contact us and we will delete it.

21. Contact for people in the EU and UK

If you are in the EU, EEA or UK, you can contact us directly about anything in this notice at privacy@offshorecompanycorp.com. We answer in English. If we appoint a representative in the EU or the UK under Article 27 of the GDPR and UK GDPR, we will name them here.

22. Changes to this notice

We will update this notice when our services or the law change. Forms record the version you saw. If we make an important change, we will say so on the website, and where the law requires, we will ask for your consent again.

Sources

• Personal Data (Privacy) Ordinance (Cap. 486), Hong Kong e-Legislation
• Guidance on Direct Marketing, Office of the Privacy Commissioner for Personal Data, Hong Kong
• Guidance on Recommended Model Contractual Clauses for Cross-border Transfer of Personal Data, Office of the Privacy Commissioner for Personal Data, Hong Kong
• Data Breach Notification, Office of the Privacy Commissioner for Personal Data, Hong Kong
• Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), Hong Kong e-Legislation
• Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex
• Commission Implementing Decision (EU) 2021/914 on standard contractual clauses, EUR-Lex
• Commission Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework), EUR-Lex
• Directive 2002/58/EC (ePrivacy Directive), EUR-Lex
• Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex
• Data Protection Act 2018, legislation.gov.uk
• Data (Use and Access) Act 2025, legislation.gov.uk
• Privacy and Electronic Communications (EC Directive) Regulations 2003, legislation.gov.uk
• Data Protection (Adequacy) (United States of America) Regulations 2023, legislation.gov.uk
• How to deal with data protection complaints, Information Commissioner's Office
• Personal Data Protection Act 2012, Singapore Statutes Online
• Personal Data Protection Act overview, Personal Data Protection Commission Singapore
• Luật Bảo vệ dữ liệu cá nhân số 91/2025/QH15, Cổng Thông tin điện tử Chính phủ (vanban.chinhphu.vn)
• Nghị định số 356/2025/NĐ-CP (31/12/2025) quy định chi tiết Luật Bảo vệ dữ liệu cá nhân, Cổng Thông tin điện tử Chính phủ (vanban.chinhphu.vn)
• California Consumer Privacy Act (Civil Code Title 1.81.5), California Legislative Information
• Organized and Serious Crimes Ordinance (Cap. 455), Hong Kong e-Legislation

Laws and regulator guidance this document follows. They explain our obligations; they are not legal advice for your situation.

One IBC Limited · HK TCSP Licence TC001305 · Unit 1411, 14/F, COSCO Tower, 183 Queen's Road Central, Sheung Wan, Hong Kong