Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how Visionary Spark Limited, a Hong Kong limited liability company, collects, uses, stores, shares, and protects personal information obtained through www.visionary.christmas and our professional services. The website was developed and is maintained by the Visionary Spark engineering team with data privacy as a foundational requirement.

By accessing our website, you acknowledge you have read this policy. If you disagree, discontinue use. We may modify this policy at any time; continued use constitutes acceptance. This policy complies with Hong Kong's Personal Data (Privacy) Ordinance, the California Consumer Privacy Act, and applicable GDPR provisions. We are committed to transparency, purpose limitation, data minimization, and confidentiality.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide: contact form submissions, email correspondence, phone calls, service inquiry forms. Categories include your full name, business email, telephone number, job title, organization name, and any other information you include. When engaging our services, we may collect technical information under strict security protocols.

2.2 Automatic Collection

We automatically collect IP address, browser type, operating system, device type, referring pages, timestamps, pages viewed, clickstream data, and form interactions via server logs. Data retained for thirty days unless required for security investigations.

2.3 Third-Party Sources

We may receive information from business intelligence platforms, public registries, and referral partners, treated per this policy and applicable law.

3. How We Use Your Information

We use information to provide, maintain, and improve services including computer systems design, architecture consulting, cloud engineering, systems integration, cybersecurity, and managed IT operations. We communicate about project status, deliverables, and milestones throughout the engagement lifecycle. We respond to inquiries, process payments, manage billing, and fulfill accounting obligations. We send marketing communications where consented or permitted — opt-out available. We analyze website usage to improve user experience. We protect system security, monitor for unauthorized access, investigate incidents, detect fraud, enforce our Terms, and comply with legal obligations under Hong Kong law.

4. Legal Bases for Processing

Contractual Necessity, Legitimate Interests (operating our business, customer support, fraud protection, analytics, B2B marketing), Consent (where required under Hong Kong PDPO), Legal Obligation, and Vital Interests.

5. Disclosure

We do not sell personal information. We may share with service providers (cloud hosting, payment processing, CRM, email, analytics, professional advisors) under contractual obligations. We disclose as required by law. We may disclose in corporate transactions. Aggregated, de-identified information may be shared for lawful purposes.

6. Data Retention

Contact forms: two years. Client records: relationship duration plus seven years. Financial records: seven years per tax law. Server logs: thirty days. Anonymized data: indefinitely for trend analysis.

7. Data Security

We implement TLS 1.3, AES-256 encryption, multi-factor authentication, role-based access controls, vulnerability scanning, intrusion detection, endpoint detection and response, SIEM, and regular third-party assessments. Administrative safeguards include annual policy reviews, mandatory training, background checks, incident response, vendor risk management, and tested business continuity plans. In case of breach, we will notify per PDPO requirements.

8. Your Privacy Rights

Depending on your jurisdiction: access, data portability, correction, deletion, restriction of processing, opt-out of sale, non-discrimination. Hong Kong residents have rights under PDPO. Submit requests via Section 16. We acknowledge within ten business days; respond within applicable timeframes. Identity verification required.

9. Cookies

We use essential cookies (no consent required) and analytics cookies (anonymous interaction patterns). Configure browser settings to manage. Disabling essential cookies may affect functionality.

10. Children's Privacy

Our services are for business professionals, not intended for individuals under eighteen. We do not knowingly collect children's data.

11. International Data Transfers

Headquartered in Hong Kong; data may be processed in Hong Kong, the US, and other jurisdictions. Appropriate safeguards implemented per PDPO and applicable law.

12. Third-Party Services

We may link to third-party websites. We are not responsible for their privacy practices. Service providers undergo due diligence and contractual data protection obligations.

13. Do Not Track

We do not currently respond to DNT signals. Manage via browser cookie controls.

14. Data Breach Notification

In case of breach, we execute incident response, assess scope, and notify affected individuals and authorities per PDPO and applicable law.

15. Changes

We may update this policy. Material changes posted with new date and additional notice where required.

16. Contact Us

VISIONARY SPARK LIMITED
Attn: Privacy Officer
Room B, 21/F, Tower 8, The Yoho Hub
1 Long Lok Road, Yuen Long
Hong Kong

Email: contact@visionary.christmas
Phone: +1 (507) 832-4918