Privacy Policy

Last updated: [DATE]

This policy explains how [HK COMPANY LEGAL NAME] Limited, trading as Elmwich (“Elmwich”, “we”, “us”), handles personal data in connection with elmwich.com (the “Site”), our services, and our business outreach. We are the data controller for the processing described here. Contact: hello@elmwich.com, [REGISTERED ADDRESS], Hong Kong.

We work with businesses, so most personal data we handle is business contact data of people acting in a professional capacity.

1. What we collect and why

Contact and enquiry data. When you use our contact form or email us: your name, work email, store URL, and message. Used to respond to you and, where relevant, to assess fit for our services. Legal basis: our legitimate interest in responding to enquiries, and steps taken at your request before a contract.

Purchase and engagement data. When you buy the Roadmap or start a retainer: your business details, billing information, and correspondence. Payments are processed by Stripe; we do not receive or store full card numbers. Used to deliver and administer the engagement, invoice, and keep required records. Legal basis: performance of a contract; legal obligations for accounting records.

Client analytics data. During an engagement, and only with access you grant, we process data from your Google Search Console and Google Analytics properties to perform the services. This is governed primarily by our Master Services Agreement with your business.

Site analytics. With your consent where required, we use Google Analytics 4 to understand how the Site is used (pages viewed, approximate location, device type). Legal basis: consent where required by law; otherwise our legitimate interest in understanding and improving the Site.

Advertising data. With your consent where required, we use Google advertising tags so we can show relevant ads (including remarketing) to Site visitors. Legal basis: consent.

Business outreach data. We sometimes contact people at ecommerce businesses about our services, using professionally relevant contact details from public sources and business data providers. We keep such outreach limited and relevant, identify ourselves honestly, include our postal address, and honor opt-outs immediately and permanently. Legal basis: our legitimate interest in reaching businesses our services are relevant to, balanced against your interests; consent where a jurisdiction requires it.

2. What we do not do

We do not sell personal data. We do not share personal data for cross-context behavioral advertising beyond the Google advertising tags described above, which operate only with consent where consent is required. We do not knowingly collect data from anyone under 18; the Site is not directed at children.

Service providers who process data for us: payment processing (Stripe), email and productivity (Google Workspace), website hosting (Hetzner, EU data centers), analytics and advertising (Google), scheduling and e-signature tools, accounting support, and cloud computing and data processing infrastructure used in delivering our services. Each provider processes data under contractual safeguards. We may also disclose data where required by law, or as part of a business transaction such as a merger, with notice where required.

4. International transfers

We are based in Hong Kong and use providers in the EU, the US, and elsewhere. Where data protected by EU or UK law is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses implemented by us or our providers.

5. Retention

Enquiries: up to 24 months after our last exchange. Engagement records and correspondence: for the engagement plus the period required for legal and accounting purposes (typically 7 years). Client analytics access is read-only and is removed at the end of an engagement; engagement data we hold is deleted on request or within 30 days of termination as described in our Master Services Agreement, except records we must keep. Outreach data: removed promptly on opt-out or when no longer relevant.

6. Your rights

Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent at any time (without affecting processing before withdrawal). To exercise any right, email hello@elmwich.com; we respond within the timeframe required by applicable law. If you are in the EU or UK, you may also complain to your local supervisory authority. California residents: we do not sell or share personal information as defined by the CCPA, and you may exercise access and deletion rights via the same email.

7. Cookies

See our Cookie Notice for the cookies and similar technologies used on the Site and how to control them.

8. Security

We use reasonable technical and organizational measures appropriate to the data we handle: encrypted connections, access controls, least-privilege access to client accounts (read-only wherever possible), and reputable infrastructure providers. No system is perfectly secure; if a breach affecting your data occurs, we will notify you as required by law.

9. Changes

We may update this policy from time to time. The “Last updated” date shows the current version. Material changes will be highlighted on the Site.