Privacy Policy

Introduction

Arbour is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and protect your data when you interact with us.

We operate in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong and maintain practices consistent with international privacy standards including GDPR principles.

What Personal Data We Collect

Data You Provide Directly

When you contact us through our website, email, or phone, we collect:

Name and contact information (email, phone number)
Business affiliation and role
Information about your legal matter or inquiry
Any documents or materials you choose to share

Data Collected Through Our Website

When you visit our website, we may collect:

Your IP address and browser information
Pages you visit and time spent on our site
Referral source and search terms
Cookie preferences and analytics data

Data from Third Parties

We may receive your information from referral sources, business partners, or publicly available business registries when relevant to potential service provision.

How We Use Your Information

We process your personal data for the following purposes:

Providing legal services and responding to your inquiries
Client communication and engagement management
Billing, invoicing, and payment processing
Maintaining client records and case files
Compliance with legal and regulatory obligations
Improving our website and service delivery
Marketing communications (only with your consent)

Legal Basis for Processing

We process your information based on:

Your explicit consent
Necessity for performance of legal services contract
Compliance with legal obligations
Legitimate interests in managing our business

Data Retention

We retain your personal information as long as necessary for the purposes outlined above and in accordance with legal requirements:

Client engagement files: 7 years after engagement completion (or as required by law)
Marketing communications: Until you opt out
Website analytics: 24 months from collection
Inquiry records: 2 years unless matter progresses

Sharing Your Information

We do not sell your personal information. We may share it only in the following circumstances:

With other professionals assisting us in serving you (with your knowledge)
With government authorities when required by law
With third-party service providers (cloud storage, email, banking) under confidentiality agreements
As permitted by attorney-client privilege and professional rules

All service providers are contractually bound to maintain confidentiality equivalent to our own standards.

Data Security

We implement comprehensive security measures to protect your information:

Secure SSL/TLS encryption for website communications
Access controls limiting data to authorized personnel
Regular security reviews and updates
Secure storage with appropriate redundancy
Confidentiality agreements with all staff
Professional indemnity insurance covering data breaches

While we maintain high security standards, no system is completely immune to unauthorized access. We encourage you to use strong passwords and notify us immediately of any suspected breach.

Cookies and Website Analytics

We use cookies to enhance your website experience:

Essential cookies for site functionality
Analytics cookies to understand usage patterns
Optional marketing cookies for retargeting (requires consent)

You can manage cookie preferences through our Cookie Policy page. Disabling non-essential cookies will not affect your ability to use our website.

Your Privacy Rights

You have the following rights regarding your personal information:

Right to Access: Request a copy of data we hold about you
Right to Correction: Request correction of inaccurate or incomplete information
Right to Erasure: Request deletion of your data (subject to legal obligations)
Right to Data Portability: Request your data in a portable format
Right to Object: Object to processing for marketing or legitimate interests
Right to Withdraw Consent: Withdraw any previously given consent

To exercise these rights, contact us at [email protected]. We will respond within 30 days (or as required by law).

International Data Transfers

As a Hong Kong-based firm, we primarily store data in Hong Kong. If we transfer data internationally (including to EU), we ensure appropriate safeguards including Standard Contractual Clauses and other legally recognized mechanisms.

Data Breach Notification

In the event of a data breach affecting your information, we will:

Notify you without undue delay (within 72 hours where required)
Provide details of the breach and steps we're taking
Offer guidance on protective measures
Notify relevant regulatory authorities as required

Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices. We encourage you to review their privacy policies before providing information.

Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect information from minors. If we discover such collection, we will delete it promptly.

Policy Updates

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes by email or website notice. Your continued use of our services constitutes acceptance of the updated policy.

Contact Us

For privacy-related questions, requests, or concerns, please contact:

Data Protection Officer
Arbour
Unit 1612, 16/F, Berkshire House
25 Westlands Road, Quarry Bay
Hong Kong
[email protected]
+852 3421 8567

Regulatory Contacts

If you have concerns about our privacy practices, you can lodge a complaint with:

Privacy Commissioner for Personal Data (Hong Kong)
Tel: 2827 8888
Email: [email protected]
Website: www.pcpd.org.hk