Privacy Policy

01 Who is responsible for your data

The data controller for the personal data described in this policy is INSTANT PAYMENTS LIMITED, trading as Webics Consulting, company registration number 79468211, registered at RM 701, Unit 127, 7/F, Twr B, New Mandarin Plaza, 14 Science Museum Rd, Tsim Sha Tsui, Hong Kong.

For any privacy question, request or complaint, contact our privacy team at info@webicsconsulting.online or by telephone on +852 13157549890. We answer privacy requests within 1 business day and resolve them within one month.

This policy covers our website, our proposal and enquiry process, and our client engagements. Where we handle personal data inside a client's own system, we act as a processor on that client's instructions and their privacy notice applies to their end users.

02 The data we collect

We do not deliberately collect special category data such as health, biometric, religious or political information, and we ask you not to send it. We do not knowingly collect data from anyone under 18; our services are directed exclusively at businesses.

03 Why we use your data and on what legal basis

Where we rely on legitimate interests, we have assessed that our interest in operating, securing and improving a professional services business does not override your rights and freedoms. You can ask us for that assessment at any time.

We do not sell personal data, we do not share it with data brokers, and we do not use it for automated decision-making or profiling that produces legal or similarly significant effects.

04 Marketing

We only send marketing email to business contacts who have asked to hear from us or who have an existing engagement with us, and every such message contains a one-click unsubscribe link. Withdrawing marketing consent does not affect emails that are necessary to run a live engagement, such as milestone notices or invoices.

05 Who we share data with

We share personal data only with the categories of recipient below, each bound by a written contract requiring confidentiality and appropriate security.

• Hosting and infrastructure providers that operate the servers on which this website and our email run.
• Email and productivity providers used for correspondence, documents and file transfer.
• Payment and invoicing providers that process invoices and card or bank payments. Card details are handled by them and never stored by us.
• Analytics providers, only where you have consented to analytics cookies.
• Professional advisers such as accountants, auditors and lawyers, where necessary.
• Subcontractors and specialist collaborators engaged on a specific project, limited to the data they need.
• Public authorities, where we are legally required to disclose.
• A successor entity, if our business is reorganised, merged or acquired; we would notify affected individuals.

06 International transfers

We are established in Hong Kong SAR and our clients and service providers are located in a number of countries, so personal data may be transferred outside your country of residence, including outside the European Economic Area and the United Kingdom.

Where such a transfer takes place, we put in place an appropriate safeguard: transfer to a jurisdiction recognised as providing adequate protection, or a contract incorporating the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum where relevant), together with any supplementary technical measures the transfer risk assessment identifies. You can request a copy of the safeguard used by contacting us.

07 How long we keep data

When a retention period ends we delete the data or irreversibly anonymise it. Data held in encrypted backups is removed on the normal backup rotation cycle, which does not exceed 90 days.

08 Your rights

Depending on where you are located, you may have some or all of the following rights. We apply them to every request we receive, regardless of location, as a matter of policy.

• Access — obtain confirmation of whether we hold data about you and receive a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have data deleted where we no longer have a lawful reason to keep it.
• Restriction — have processing paused while a dispute about accuracy or lawfulness is resolved.
• Portability — receive data you provided to us in a structured, machine-readable format, or have it sent to another controller.
• Objection — object to processing based on legitimate interests, and object to direct marketing at any time with no reason required.
• Withdraw consent — withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Complain — lodge a complaint with a supervisory authority.

To exercise a right, email info@webicsconsulting.online with the words "Privacy request" in the subject line and tell us which right you are exercising. We will acknowledge within 5 business days and respond within one month. We may ask for proof of identity so that we do not disclose data to the wrong person. Exercising your rights is free; we may charge a reasonable fee only for manifestly unfounded or excessive repeat requests, and we will tell you before doing so.

If you are in the EEA or UK you may complain to your national data protection authority. In Hong Kong SAR you may complain to the Office of the Privacy Commissioner for Personal Data (PCPD). We would appreciate the chance to resolve the matter directly first.

09 How we protect data

• TLS encryption on all connections to this website and to our email systems.
• Encryption at rest for laptops, backups and file storage.
• Role-based access on a need-to-know basis, with unique accounts and multi-factor authentication.
• Password manager use for all shared credentials; no credentials shared over plain email or chat.
• Client credentials issued with the minimum privilege required and revoked at handover.
• A preference for anonymised, redacted or synthetic data during design and testing.
• Written confidentiality and data protection obligations for every subcontractor.
• Periodic review of access rights, retention schedules and provider security posture.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to individuals, we will notify the relevant supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it, and we will notify affected individuals and affected clients directly where the risk is high.

10 Cookies and tracking

This website uses a small number of cookies. Non-essential cookies are set only after you consent, and you can change or withdraw that choice at any time. The full list, the purpose of each cookie and the instructions for controlling them are in our Cookie Policy.

11 Third-party links

Our website may link to external sites. We are not responsible for their content or privacy practices, and this policy does not apply to them. Please read their own notices before providing data.

12 Changes to this policy

We keep this policy under review and update it when our practices, providers or legal obligations change. The version published on this page is the version in force. Where a change materially affects how we use data about you, we will notify active clients and enquirers directly by email.

13 Privacy contact

Privacy enquiries and data subject requests: info@webicsconsulting.online. Telephone: +852 13157549890. Post: INSTANT PAYMENTS LIMITED, RM 701, Unit 127, 7/F, Twr B, New Mandarin Plaza, 14 Science Museum Rd, Tsim Sha Tsui, Hong Kong.