MarketHK Privacy Policy

1.Roles: data user and processor

For account, billing, site analytics and platform operations data, iGears Technology Limited is typically the data user. For contacts, consent records, message content / metadata and delivery events that customers upload or instruct us to process, the customer is typically the data user and we act as a data processor on the customer’s instructions. Enterprise customers should sign a DPA separately.

• Operator: iGears Technology Limited
• Product: MarketHK (Notify / Verify / Managed)
• Jurisdiction: Hong Kong SAR

2.Categories of data we process

Depending on how you use the Service, we may process the following (not all items are always collected):

• Account and identity: name, email, display name, password hash / login MFA, roles, workspace membership
• Organisation and billing: company name, plan, Stripe customer / subscription IDs, wallet balance and ledger, invoice-related data
• Contacts and consent: customer-imported contacts, tags, language, consent / opt-out status and timestamps
• Messaging operations: templates, campaign settings, approvals, send / fallback jobs, delivery / bounce / complaint events and metadata
• Verification (Verify / TOTP): enrolment challenges, verify outcomes and audit events; authenticator private keys are not kept in cleartext long-term
• Technical and security: IP, device / browser summaries, logs, rate limits and abuse signals
• Support and sales: consultation forms and tickets (do not submit passwords, OTPs or API secrets)

3.How we collect data

Data may come from: what you provide directly (registration, configuration, imports, forms); what you or your systems submit via API / integrations; what the Service generates automatically (logs, delivery events, audit); and status events returned by infrastructure / channel partners. We do not ask you to paste customer message bodies or credential secrets into public forms.

4.Purposes of use

We use personal data where relevant and necessary, including to:

• Provide, maintain and improve MarketHK (accounts, workspaces, orchestration, approvals, analytics, wallet)
• Send or verify via Email / SMS / WhatsApp and similar channels on customer instructions
• Authenticate users, enforce MFA, prevent fraud and abuse, and respond to security incidents
• Bill, collect payment, invoice, and manage usage and plans
• Provide support and product notices (non-marketing account notices)
• Comply with law, lawful regulatory / law-enforcement requests, and establish or defend legal claims

5.Direct marketing and commercial electronic messages

If we market MarketHK / iGears to you directly, we handle consent and unsubscribe in line with the PDPO and the Unsolicited Electronic Messages Ordinance (UEMO) where applicable. When customers use MarketHK to send marketing or commercial electronic messages to their recipients, customers must obtain required consents, provide sender information and unsubscribe facilities, and honour do-not-call / suppression rules. The platform consent ledger and suppression tools do not replace the customer’s legal duties.

6.Sharing and third parties

We do not sell personal data. We may share data as needed with: infrastructure, payment and channel partners required to operate the Service (only when the relevant feature is used); channel / recipient networks on customer instructions; professional advisers under confidentiality; and authorities where required by law or to protect rights and safety. In Enterprise BYO mode, the customer’s own providers may process recipient data directly; the customer is responsible for reviewing those providers’ privacy terms. A detailed partner list is not published on this website; enterprise customers may obtain it under a signed DPA or on written request.

7.Cross-border transfer and storage

MarketHK runs primarily on cloud infrastructure. Personal data may be processed or backed up outside Hong Kong. We use reasonable contractual and technical measures, and customers should consider their own compliance needs when choosing regions / providers. Before general commercial launch, enterprise customers may request written confirmation of primary data regions.

8.Retention

We retain data on a need-to-keep basis: account and billing data for the life of the account and applicable legal retention; consent and send audit records for a reasonable period for disputes and compliance checks; message bodies / recipient detail with minimisation — routing jobs should not keep cleartext bodies permanently; support records for a reasonable period after closure, then deletion or anonymisation. Customers may request export or deletion of contact data they control, subject to legal holds and backup cycles.

9.Security measures

We apply measures proportionate to risk, including encryption in transit, encrypted provider secrets, tenant isolation, RBAC, login MFA for owners / admins, dual-control approvals, signed webhooks, log masking, rate limits and emergency send pause. See the Security overview. No system is perfectly secure; report suspicious account activity promptly via support.

10.Your rights

Under the PDPO and other applicable law, you may request access to and correction of personal data we hold, and where appropriate request erasure, restriction or objection. Contact data inside a workspace is usually controlled by the customer (data user); recipients should exercise rights with that customer first, and we will assist within our processor role. After identity checks, we respond within a reasonable time. You may also complain to the Privacy Commissioner for Personal Data (PCPD).

11.Cookies and similar technologies

The site and console may use necessary cookies / local storage for session login, language preference and security. We may use limited analytics to understand product usage. If we add non-essential tracking later, we will update this Policy and provide choices where required.

12.Children

The Service is for business users and is not directed at persons under 16. If we learn we collected a child’s personal data without appropriate consent, we will take reasonable steps to delete it.

13.Changes to this Policy

We may update this Policy from time to time. Material changes will be posted on the website and / or notified via the account. Continued use means you are aware of the updated Policy (unless a contract says otherwise).

14.Contact us

For privacy and data-subject requests, contact us via the consultation / support channel and mark the message “Privacy request”. Do not paste passwords, OTPs, API secrets or bulk customer message content into public forms. Postal / registered office details are available in formal contracts or on request.