Privacy Policy
This policy explains what personal data Riva Alliance Limited handles when you visit this website or write to us, why, and what rights you have. It follows the standard of the EU General Data Protection Regulation (GDPR) and the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (PDPO).
Who is responsible for your data
Riva Alliance Limited decides how and why your personal data is used. In GDPR terms it is the controller; in PDPO terms it is the data user.
- Company
- Riva Alliance Limited
- Registered office
- Office No 26, 10/F, Beverley Commercial Centre, 87-105 Chatham Road South, Tsim Sha Tsui, Hong Kong
- Privacy questions
- contact@riva-alliance.example
- Data access and correction requests
- Riva Alliance Limited, Office No 26, 10/F, Beverley Commercial Centre, 87-105 Chatham Road South, Tsim Sha Tsui, Hong Kong, or by email to contact@riva-alliance.example
What data we handle
- If you email us: your email address, your name, your company and whatever you write in the message.
- If you use the contact form: the name, email address, company and message you enter. The form is not connected to our mailbox yet. It sends the fields to our web server, which checks them and discards them immediately; nothing is stored or forwarded to a mailbox. We will update this policy before the form starts delivering messages.
- When you open the site: the technical data any web server receives from a browser, namely the IP address, the date and time of the request, the page requested, and the browser and device type.
- In your browser: one local storage entry that holds your cookie choice. The Cookie Policy describes it.
The site has no analytics, advertising or social media tools. We do not build visitor profiles and do not obtain data about you from other sources. We do not ask for sensitive data such as health or identity document details, and ask you not to send any.
Why we use it and on what legal basis
- Purpose
- Reading and answering your message, and discussing a possible deal with your company
- Data
- Contact details and the content of your message
- Legal basis under the GDPR
- Our legitimate interest in answering business enquiries and dealing with the companies we trade with (Article 6(1)(f)). Where you write on your own behalf as a sole trader and would yourself be a party to the contract: steps taken at your request before entering into a contract (Article 6(1)(b))
- Purpose
- Delivering the website and keeping it secure
- Data
- Technical data
- Legal basis under the GDPR
- Our legitimate interest in running a working and secure website (Article 6(1)(f))
- Purpose
- Remembering your cookie choice
- Data
- The local storage entry
- Legal basis under the GDPR
- Our legitimate interest in respecting your choice without asking again on every page (Article 6(1)(f)). This storage is strictly necessary and does not need consent
- Purpose
- Meeting legal obligations and dealing with legal claims
- Data
- Whichever of the data above is relevant
- Legal basis under the GDPR
- Compliance with a legal obligation (Article 6(1)(c)), and our legitimate interest in establishing or defending legal claims (Article 6(1)(f))
Under the PDPO, we collect personal data only for the purposes listed above, which relate directly to our business, and we do not use it for a new purpose without your consent. We do not use personal data for direct marketing.
Who receives your data
Your data is handled by Riva Alliance Limited. The provider that hosts this website processes technical data on our behalf so that the site can be delivered to you.
We do not sell personal data and do not pass it to anyone for their own marketing. We may disclose data where a law, a court or a public authority requires it. If we start using other service providers that handle personal data, we will name them here first.
Transfers outside your country
Riva Alliance Limited is a Hong Kong company. If you write to us from another country, your message is received and handled outside that country, including in Hong Kong.
For visitors in the European Economic Area: your data is collected directly by Riva Alliance Limited in Hong Kong. Hong Kong is not covered by an adequacy decision of the European Commission. We handle your data in line with the Hong Kong Personal Data (Privacy) Ordinance and protect it with the measures described in this policy.
How long we keep it
- Emails and the correspondence that follows: for as long as the enquiry or the deal it concerns is being dealt with, and after that for as long as we need them to meet legal obligations or to deal with legal claims. Then we delete them.
- Contact form entries: not kept. While the form is not connected, our web server discards them as soon as it has checked them.
- Technical data: only for as long as it is needed to deliver the site and keep it secure.
- Your cookie choice: 12 months in your browser, or until you change it or clear the site data.
Your rights
You can ask us to:
- confirm whether we hold personal data about you and give you a copy;
- correct data that is inaccurate;
- erase your data;
- restrict how we use it;
- stop using it where we rely on a legitimate interest;
- give you the data you provided in a portable format;
- withdraw your consent where processing relies on it (at present we do not rely on consent for any processing).
Access and correction are rights under both the PDPO and the GDPR. The others apply where the GDPR applies to you, and some of them have conditions set by law.
To use a right, write to contact@riva-alliance.example, or by post to Riva Alliance Limited, Office No 26, 10/F, Beverley Commercial Centre, 87-105 Chatham Road South, Tsim Sha Tsui, Hong Kong. We may ask for information that confirms who you are. We answer data access and data correction requests under the PDPO within 40 days, and requests under the GDPR within one month. The PDPO allows a fee for complying with a data access request, which must not be excessive; if a fee applies, we will tell you the amount first.
Complaints
If you think we have mishandled your data, please write to us first so that we can put it right. You can also complain to a regulator:
- in Hong Kong, the Office of the Privacy Commissioner for Personal Data: www.pcpd.org.hk;
- in the European Economic Area, the data protection authority of the country where you live or work.
Whether you have to provide data, and automated decisions
You do not have to give us any personal data. If you write to us without an email address, we cannot reply.
We do not make decisions about you by automated means and we do not profile visitors.
Security
The site is served over an encrypted connection (HTTPS), loads no scripts from other companies and sets browser security headers. We limit access to correspondence to what is needed to answer you. No way of sending data over the internet is completely secure, so please do not send confidential documents by email or through the form.
Changes to this policy
We update this policy when the site or the law changes. The date at the top of the page shows when the current version took effect.
Language
This policy is published in English and in Traditional Chinese. If the two versions differ, the English version prevails.