Legal

Privacy Policy

Last Updated: 15 January 2026

Penumbra ("we", "us", or "our") is committed to protecting the personal information of everyone who interacts with our services. This Privacy Policy explains what data we collect, why we collect it, how it is used, and what rights you have in relation to your data.

This policy applies to information collected through our website (penumbs.pro), enquiry forms, email communications, and the delivery of our consulting services.

If you have any questions about this policy, you can reach our data contact at [email protected].

1. Data We Collect

We collect personal data in two ways: information you provide to us directly, and information collected automatically when you visit our website.

Information You Provide

• Name and contact details submitted via our enquiry form (name, email address, phone number)
• Message content submitted through our contact form
• Communications you send to us by email
• Business information shared during client engagements

Information Collected Automatically

• IP address and general location
• Browser type and device information
• Pages visited and time spent on our site
• Referral source (how you arrived at our site)
• Cookie data (see our Cookie Policy for details)

2. How We Use Your Data

We use your personal data for the following purposes:

• Responding to enquiries and messages you submit
• Delivering consulting services agreed under a client engagement
• Sending information relevant to your enquiry or engagement (we do not send unsolicited marketing)
• Improving our website and understanding how visitors use it
• Complying with legal obligations under Hong Kong law

We rely on the following legal bases for processing your data: your consent (for analytics and marketing cookies), the performance of a contract (for client engagements), legitimate interests (for responding to enquiries), and legal compliance obligations.

3. Data Retention

Enquiry data is retained for up to 12 months from the date of last contact if no engagement follows. Client engagement data, including project documentation and communications, is retained for 7 years from project completion for accounting and legal compliance purposes. You may request earlier deletion subject to the conditions in Section 6.

4. Data Sharing

We do not sell your personal data. We share data only in the following limited circumstances:

• Service providers: Third-party tools used in website analytics and communications (e.g. Google Analytics). These operate under data processing agreements.
• Legal requirements: Where we are required to disclose information by Hong Kong law or court order.
• Business transfers: In the event of a merger or sale of our business, where we would notify you in advance.

Client data shared with us during project delivery is handled under a separate data handling agreement and is never used for any purpose other than the agreed project scope.

5. Data Protection Measures

We take the security of your personal data seriously. Our measures include:

• Encrypted connections (HTTPS) on all website communications
• Access controls limiting data access to authorised team members
• Confidentiality agreements for all team members and contractors
• Secure, access-controlled storage for client project data
• Deletion protocols applied when data retention periods expire

In the event of a data breach affecting your personal data, we will notify you and the relevant authority within the timeframe required by applicable law.

6. Cookies

Our website uses cookies to understand site usage and improve the visitor experience. You can manage your cookie preferences at any time via our Cookie Policy page. Essential cookies cannot be disabled as they are required for the website to function.

7. Your Rights

Under Hong Kong's Personal Data (Privacy) Ordinance (PDPO), and applicable principles of data privacy law, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to correction: Request that inaccurate or incomplete data is corrected.
• Right to deletion: Request erasure of your personal data, subject to any legal retention obligations.
• Right to object: Object to processing based on our legitimate interests.
• Right to withdraw consent: Withdraw consent to processing where consent was the legal basis.
• Right to complain: Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong if you believe your data has been handled improperly.

To exercise any of these rights, contact us at [email protected]. We will respond within 40 days as required by the PDPO.

8. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently.

9. Children's Privacy

Our services are intended for business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted data to us, please contact us and we will arrange deletion.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. For significant changes, we will notify affected individuals by email where we hold your contact details.

11. Contact

For any questions about this policy or how your data is handled:

• Email: [email protected]
• Address: 41 Haiphong Road, Tsim Sha Tsui, Kowloon, Hong Kong
• Phone: +852 3196 5847

For complaints, you may also contact the Office of the Privacy Commissioner for Personal Data (PCPD) at www.pcpd.org.hk.