Privacy Policy

Effective date: 17 September 2026 · Version 1.0

This policy explains how we collect, use, store, disclose and protect personal data, in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO"). Please read it before using our services.

1. Personal data we collect

• Identity and contact data — name, phone number, email address, and (where you engage us for company secretarial or account opening work) identity documents such as Hong Kong Identity Card, passport, business registration documents and proof of address.
• Company data — company name, company number, business registration number, registered office address, directors, shareholders, secretaries and share capital, and filings we prepare or submit on your instructions.
• Documents you upload or send — contracts, forms, corporate records and any file you send us for signing, filing, certification, bookkeeping or storage.
• Electronic signature and audit data — the identity of the sender and each signer, the signer's phone number and verification method (for example WhatsApp or Telegram verification, one-time code, or device biometric confirmation), signing timestamps, IP address, device and browser information, and the document hash and audit trail generated when a document is signed. This data is collected to make the signature verifiable and to evidence who signed what, when and how.
• Communication data — messages you exchange with our AI assistants or staff on WhatsApp, Telegram, email or our web pages, and the contents of documents referenced in those messages.
• Payment data — the amount, date and reference of payments, and records provided by our payment service providers. We do not store full card numbers; card payments are processed by our payment service providers.
• Technical data — server logs, and minimal cookies or similar identifiers required to keep you logged in and to protect the service against abuse.

2. How we use personal data

• To provide, operate and support the services you request, including preparing and submitting documents, electronic signature, certification, bookkeeping and company secretarial support.
• To verify identity and the authority of persons acting for a company, and to meet obligations under applicable Hong Kong law (including the Companies Ordinance, the Business Registration Ordinance, and anti-money-laundering and counter-terrorist-financing requirements where they apply to us or to our licensed partners).
• To create and preserve the audit trail that makes an electronic signature verifiable.
• To communicate with you about your documents, filings, deadlines and account.
• To invoice you and reconcile payments.
• To improve the reliability and security of our services, and to prevent fraud and misuse.
• To send you service updates. We will only send marketing messages where you have consented, and you may withdraw that consent at any time.

3. Artificial intelligence processing

We use artificial intelligence to read and classify documents, to answer questions in chat, and to draft documents for human review. Some AI processing runs on our own hardware, and some relies on external providers acting as our service providers. Where an external AI provider is used, we use it to process the task at hand and we require it to be bound by confidentiality obligations. Automated output is reviewed by a human before it is used to make a decision that affects you or to file anything with a public authority. You will always be told when the person you are chatting with is an AI assistant.

4. Who we may share data with

• Companies Registry, Inland Revenue Department and other public authorities, where this is necessary to carry out a filing or service you have instructed.
• Licensed company secretarial, accounting, audit or legal professionals engaged to complete work on your instructions.
• Service providers who host our systems, deliver messages, process payments, or provide AI and document-processing capacity — acting under contract and only for our instructions.
• Professional advisers, insurers, and any person to whom disclosure is required or permitted by law.

We do not sell personal data. We do not disclose your data to unrelated third parties for their own marketing purposes.

5. Retention

We keep signed documents, filings and the related audit trails for as long as the document may need to be verified, and in any event for at least 7 years from the end of the year in which the matter is closed, to meet our record-keeping obligations and limitation periods. Account and contact data is kept while you remain a client and for 7 years afterwards. Documents you store with us may be deleted at your request where no law requires us to keep them. Chat transcripts are kept for a period sufficient to service and audit your account.

6. Security

We use encryption in transit (TLS) and at rest, signature-verification tokens that are tied to the individual signer, tamper-evident audit hash chains for signed documents, optional password protection of issued PDFs, access controls and logging on our systems, and separation of production data from our development environments. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and the Privacy Commissioner for Personal Data as required.

7. Your rights

Under the PDPO you have the right to:

• request access to the personal data we hold about you (we may charge a reasonable fee for a data access request);
• request correction of personal data that is inaccurate;
• withdraw consent to marketing at any time;
• ask us to delete data that we are not required by law to keep.

Requests should be sent to our data protection contact: carmen@bizec.app. We will respond within the period allowed by the PDPO.

8. Cookies

Our websites use only the identifiers needed to keep you signed in, remember your language preference and protect against abuse. We do not use third-party advertising cookies on our own pages.

9. Storage and cross-border processing

Your data is stored on systems operated by us and by our hosting and communication service providers, which may be located outside Hong Kong. Where data is transferred outside Hong Kong we take reasonable steps to ensure it receives a comparable standard of protection, and we remain responsible for it under the PDPO.

10. Changes to this policy

We may update this policy to reflect changes in our services or the law. The current version is always published on this page with its effective date.

11. Contact

BIZEC LIMITED · 21/F CMA Building, 64 Connaught Road Central, Central, Hong Kong · Business Registration No. 80767016
Email: carmen@bizec.app · WhatsApp / Tel: +852 9431 1106