What we do with your data.

What we collect

If you submit the enquiry form, we collect what you type into it:

• Your name, work email, company and role
• Phone or WhatsApp number, if you choose to give one (optional)
• Team size, the service you are interested in, budget range and preferred start timing
• Your written answers describing the operational problem, how you handle it today, and the outcome you want

What is collected automatically

Alongside the form we record a small amount of technical context so we can respond sensibly and filter automated spam:

• The page you submitted from and the language version you were using
• A utm_source value if you arrived through a tracked link, otherwise the value website
• How long the form was open before submission, used only to detect bots
• A hidden field that humans never see, used only to detect bots

Why we use it

To assess whether your project is a fit, to reply to you, and — if it is a fit and you choose a slot — to create a calendar invitation with a video link. That is all. We do not add you to a mailing list, we do not pass your details to a sales team, and we do not sell or rent personal data to anyone.

Giving us your data is voluntary

You do not have to complete the form. If you would rather not, email justin.chiu@broadlink-advisory.com directly. If you leave the required fields blank the form will not submit, and we will not be able to assess or respond to an enquiry.

Who else handles it

We do not have our own servers. The following providers process data on our behalf:

• Google (Sheets, Gmail, Calendar and Meet) — stores the enquiry record, sends the notification, and creates the booking
• Composio — the integration layer that connects this website to those Google services
• Vercel — hosts this website and runs the form and booking endpoints
• Google Analytics 4 — measures aggregate website usage

Data leaving Hong Kong

Those providers operate infrastructure outside Hong Kong, including in the United States. By submitting the form you accept that your data will be transferred to and processed in those locations. We only use established providers that offer contractual data protection terms.

How long we keep it

Enquiry records are kept for 24 months from your last contact with us, then deleted. If a project goes ahead, the related records are kept for as long as we need them for the engagement and for any legal, tax or accounting obligation that applies afterwards.

Analytics and cookies

This site uses Google Analytics 4 to understand aggregate traffic — which pages get read, roughly where visitors come from. It sets cookies in your browser. We do not use advertising cookies and we do not run remarketing.

You can opt out for every site you visit by installing the Google Analytics Opt-out Browser Add-on, or by blocking cookies in your browser settings. Blocking them will not stop the enquiry form from working.

Security

Access to the enquiry records is limited to Justin Chiu. Data is transmitted over HTTPS and held in access-controlled Google accounts. No system is perfectly secure, but we keep the number of people and tools touching your data deliberately small.

Your rights

Under the Personal Data (Privacy) Ordinance (Cap. 486) you may ask whether we hold personal data about you, request a copy of it, and ask us to correct anything inaccurate. You may also ask us to delete it.

Email justin.chiu@broadlink-advisory.com and we will respond within 40 days, as the Ordinance requires. We may need to verify your identity first. There is no charge for a straightforward request.

If you are not satisfied with how we handle your request, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.

Changes

If this policy changes we will update the date at the top of this page. Material changes to how we use existing data will be notified to affected people by email.

Contact

Broad Link Advisory Limited, Hong Kong. Data access and correction requests: justin.chiu@broadlink-advisory.com