Privacy Policy

1. Who we are

This Privacy Policy is issued by ICORP HK LIMITED ("iCorp.HK", "we", "us", "our"), a company incorporated in Hong Kong and licensed by the Companies Registry as a Trust or Company Service Provider. We are the data user (controller) of personal data collected through this website and in the course of providing our services.

2. What personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

2.1 Website enquiries and applications

• Name, email address, phone number, company name;
• The service you are interested in and the content of your message;
• For job applications: position, link to CV or professional profile, cover letter;
• The page from which the form was submitted and the time of submission.

2.2 Client onboarding and KYC (customer due diligence)

As a licensed TCSP we are required by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) to identify and verify our clients and their beneficial owners. For directors, shareholders, beneficial owners and authorised persons we collect:

• Full name, date and place of birth, nationality, gender;
• Identity document details and copies (passport, ID card);
• Residential address and proof of address;
• Occupation, employer, source of wealth and source of funds;
• Tax residency and tax identification numbers;
• Politically exposed person (PEP) status and sanctions screening results;
• Signatures, and where applicable, photographs or video-verification recordings.

2.3 Service delivery

• Information required for statutory filings, bank applications, visa applications, trademark filings and accounting (e.g. shareholdings, remuneration, bank statements, invoices);
• Correspondence with you and with third parties on your behalf;
• Billing and payment information.

2.4 Technical data

• IP address, browser type, device type, pages visited and referring URL — collected through server logs and any analytics tools described in section 8.

3. How and why we use personal data

4. Who we share personal data with

We share personal data only as necessary for the purposes above, and we require recipients to protect it appropriately. Recipients may include:

• Government authorities — the Companies Registry, Inland Revenue Department, Immigration Department, Intellectual Property Department and other Hong Kong or foreign authorities, where filings are required or where we are legally compelled to disclose;
• Banks and payment institutions — when you instruct us to support an account application;
• Professional partners — Hong Kong CPA (Practising) firms for statutory audits, solicitors, notaries, immigration and IP agents, and partner corporate service providers in other jurisdictions, when engaged for your matter;
• Service providers — IT hosting, cloud storage, accounting software (e.g. Xero), e-signature, identity verification and screening providers, courier companies, email and CRM systems — acting on our instructions;
• Successors — in the event of a merger, acquisition or restructuring of our business, under confidentiality obligations.

We do not sell, rent or trade personal data to third parties for their marketing purposes.

5. International transfers

Our clients, partners and service providers are located worldwide. Personal data may therefore be transferred to and stored in jurisdictions outside Hong Kong, including Singapore, Mainland China, the European Union, the United Kingdom and the United States. Where we transfer data abroad, we take reasonable steps to ensure it receives a level of protection comparable to that under the PDPO — for example through contractual clauses with recipients. For data subjects in the EU/UK, transfers are made under appropriate safeguards such as Standard Contractual Clauses.

6. How long we keep personal data

• KYC and client records: at least 5 years after the end of the business relationship or completion of the transaction, as required by the AMLO;
• Company statutory records and accounting records: at least 7 years, as required by the Companies Ordinance and Inland Revenue Ordinance;
• Enquiries that do not become client engagements: up to 24 months;
• Job applications: up to 12 months after the recruitment decision, unless you ask us to keep your details on file;
• Marketing consent records: for as long as the consent is valid plus 2 years.

After the retention period we securely delete or anonymise the data, unless a longer period is required by law or for the defence of legal claims.

7. How we protect personal data

We apply technical and organisational measures appropriate to the sensitivity of the data, including encrypted storage and transmission (TLS), access controls on a need-to-know basis, secure document-sharing portals, staff confidentiality obligations and training, and regular review of our systems and providers. No method of transmission over the internet is completely secure; if you suspect a security incident involving your data, please contact us immediately.

8. Cookies and analytics

This website uses only strictly necessary technical storage required for it to function (for example, remembering form state). We may use privacy-respecting analytics to understand how the site is used; where analytics tools set cookies that are not strictly necessary, we will ask for your consent through a cookie banner before activating them. You can control cookies through your browser settings; disabling cookies may affect the functioning of some features.

9. Your rights

Under the PDPO you have the right to:

• Access the personal data we hold about you and receive a copy (a reasonable fee may apply for data access requests under the PDPO);
• Correct personal data that is inaccurate;
• Opt out of direct marketing at any time, free of charge;
• Be informed of our policies and practices in relation to personal data.

If you are in the EU or UK, you additionally have rights to erasure, restriction, data portability and to object to processing based on legitimate interests, and the right to lodge a complaint with your local supervisory authority. Please note that we cannot delete data we are legally required to retain (see section 6).

To exercise any right, email business@icorp.hk with "Data request" in the subject line. We will respond within 40 days as required by the PDPO (or one month under GDPR). We may need to verify your identity before acting on a request.

You may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk) if you are not satisfied with our response.

10. Third-party links

Our website contains links to third-party websites (for example banks, government departments and map services). We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies.

11. Children

Our services are directed at businesses and adults. We do not knowingly collect personal data from persons under 18 except where necessary for a service you instruct (for example a dependant visa application for a child), in which case the data is provided by and processed on the instruction of the parent or guardian.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates the latest revision. Material changes will be communicated to existing clients by email or through a notice on this website.

13. Contact us

For any question about this Privacy Policy or our handling of personal data, please contact our Data Protection Officer: