Privacy Policy

1. Data Controller

For the purposes of this website (www.evomesh.com.hk) and the services we provide, the data controller is:

2. What personal data we collect

We only collect data that is reasonably necessary for the purposes set out below, including:

2.1 Data you provide voluntarily

• Contact form: name, email address, company name, project type, project description, and any other details you choose to provide.
• Email correspondence: when you contact us with enquiries, quotes or business partnership requests — your name, role, email, phone (if provided).
• Client services: if you use our software development or AI Agent services, we may collect contract contact details, billing information, and project-related correspondence.

2.2 Data collected automatically

• Browsing data: IP address, browser type, operating system, referring page, pages visited, time on site, click data — all used to analyse traffic and improve the experience.
• Device information: language settings, time zone, screen resolution.
• Cookies and similar technologies: see section 8.

3. Purposes of collection and use

We collect and use your personal data for the following purposes:

• Responding to enquiries and quote requests: handling submissions via the contact form or email, providing proposals, arranging meetings.
• Service delivery: delivering software development, AI Agent, consulting and related services, including project management, client support, invoicing and payment.
• Website operation and improvement: analysing usage patterns, debugging, performance optimisation, A/B testing (if any).
• Security and anti-abuse: detecting and preventing fraud, spam, unauthorised access, DDoS and other attacks.
• Legal compliance: fulfilling contractual, tax, accounting and legal process obligations.
• Marketing: only with your explicit consent, we may send emails about new services, events or articles. You can unsubscribe at any time.

We will not use your personal data for purposes unrelated to the above without your explicit consent, except where required by law.

4. Legal basis

4.1 Hong Kong Personal Data (Privacy) Ordinance (PDPO)

Under the PDPO, our processing is based on the following data protection principles:

• collected fairly and lawfully;
• collected only for specified purposes;
• accurate and not retained longer than necessary;
• protected by appropriate security measures;
• purposes and policy stated at the time of collection.

4.2 EU General Data Protection Regulation (GDPR)

If you are located in the European Economic Area (EEA), we will only process your personal data where:

• you have given consent (e.g. submitting a contact form, subscribing to a newsletter);
• performance of a contract (e.g. delivering services or a quote you requested);
• legitimate interests (e.g. website security, anti-spam, service improvement), provided those interests do not override your privacy rights;
• legal obligation (e.g. tax, accounting, court orders).

5. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact enquiries: 24 months from last contact, to allow follow-up. After that, data is securely deleted or anonymised.
• Client contract relationships: 7 years from contract end, for tax, accounting and potential legal claims.
• Marketing communications: until you unsubscribe, or for 24 months of inactivity.
• Logs and analytics: server logs up to 30 days; Google Analytics data retained for 14 months.
• Legal requirements: where laws require longer retention, we retain accordingly.

6. Data sharing and third parties

We do not sell, rent or trade your personal data to third parties for marketing purposes. We may share data in the following circumstances:

6.1 Service providers (data processors)

We may share data with third-party vendors who help us operate our website and provide our services, including:

• Hosting and email: server providers, DNS providers;
• Analytics tools: Google Analytics 4;
• AI platform and API providers: large language model or infrastructure vendors used to deliver AI Agent services — only to the extent necessary for the service;
• Accounting and legal services: auditors, tax advisors, legal counsel.

All third-party providers are contractually bound to keep your data confidential, to process it only on our instructions, and not to use it for their own purposes.

6.2 Legal requirements

We may disclose personal data when required by law, court order, or government/regulatory authority, to protect the rights, property or safety of EvoMesh, its clients, or the public.

6.3 Business transfers

If EvoMesh is involved in a merger, acquisition, asset sale or restructuring, your personal data may be transferred as part of that transaction. We will notify you in advance.

7. Cross-border data transfers

Our servers and some of our service providers may be located outside Hong Kong (including but not limited to Singapore, the United States, and the European Union). These locations may have different data protection laws from Hong Kong.

Where we transfer personal data across borders, we put in place appropriate safeguards, including:

• ensuring the recipient's location provides an adequate level of data protection;
• Standard Contractual Clauses (SCCs);
• requiring data encryption and access controls;
• by using our services, you acknowledge and agree to such transfers.

8. Cookies and analytics

8.1 What are cookies?

Cookies are small text files stored on your computer or mobile device to remember your preferences or improve your browsing experience.

8.2 What cookies do we use?

• Necessary cookies: essential for basic website functionality (e.g. navigation state, form anti-duplicate submission). Without these cookies the website may not work properly.
• Analytics cookies: help us understand how visitors use the site so we can improve it. We use Google Analytics 4 with IP anonymization enabled.
• Third-party cookies: if you follow external links on the site, the destination sites may set their own cookies, governed by their own privacy policies.

8.3 How to manage cookies

You can delete or block cookies at any time through your browser settings, though this may affect some website functions. You can also opt out of GA collection via the Google Analytics opt-out browser add-on ↗.

9. Your rights

Under applicable data protection laws, you may have the following rights:

• Right of access: to obtain a copy of the personal data we hold about you.
• Right to rectification: to request correction of inaccurate or incomplete personal data.
• Right to erasure / right to be forgotten: to request deletion of your personal data, subject to legal exceptions.
• Right to restriction of processing: to request that we restrict processing of your personal data.
• Right to data portability: to receive the personal data you provided to us in a machine-readable format.
• Right to object: to object to processing of your personal data based on legitimate interests.
• Right to withdraw consent: to withdraw consent you previously gave us at any time (withdrawal does not affect the lawfulness of processing based on consent before withdrawal).
• Right to lodge a complaint with a supervisory authority: if you are unhappy with how we handle your personal data, you have the right to complain to the relevant privacy regulator (e.g. the Office of the Privacy Commissioner for Personal Data in Hong Kong).

To exercise any of these rights, please email privacy@evomesh.com.hk. We will respond within 30 days. For complex cases we may need additional time and will keep you informed of progress.

10. Data security

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, use, disclosure, alteration or destruction, including:

• HTTPS transport encryption (TLS 1.2/1.3);
• password hashing (bcrypt or equivalent);
• server-level firewalls, regular security updates;
• access controls (least-privilege principle);
• staff privacy training;
• periodic security audits and penetration testing (where appropriate to the project).

Please note, however, that no data transmission over the Internet can be guaranteed to be 100% secure, and we cannot guarantee absolute security.

11. Children's data

Our website and services are not directed at children (defined as under 18 under Hong Kong law, or under the relevant age in other jurisdictions). We do not knowingly collect personal data from anyone under 18. If you believe we may hold a child's data, please contact privacy@evomesh.com.hk and we will delete it promptly.

12. As a Meta Technology Provider

Where EvoMesh acts as a "Meta Technology Provider" for Meta Platforms, Inc. and its affiliates ("Meta"), we may process end-user data provided to or generated by our customers through Meta Business Tools (e.g. Meta Pixel, Conversions API, WhatsApp Business Platform, etc.).

With respect to such processing:

• we process data only on our customers' instructions and for the purpose of providing the service;
• we do not use such data for our own marketing or analytics;
• we implement appropriate technical and organisational security measures;
• we assist our customers in fulfilling their data protection obligations, including responding to data subject rights requests;
• we delete or return such data as required by applicable law and our customer contracts.

If you are an end user of an EvoMesh customer and wish to exercise your rights, please contact the relevant customer directly (as the data controller). If you are unsure of the controller identity, email privacy@evomesh.com.hk and we will help you identify the right contact.

13. Changes to this policy

We may update this privacy policy from time to time to reflect changes in law, operations or our services. The revised version will be posted on this page with an updated date. Where changes are material, we will provide notice through the website or by email.

Your continued use of our website or services constitutes acceptance of the updated policy.

14. Contact us

If you have questions about this privacy policy, wish to exercise your rights, or have a privacy-related complaint, please contact:

We take every enquiry seriously and will respond within 30 days.