Privacy Policy

1. Introduction

Pylon Index ("we", "us", "our") is committed to handling personal data responsibly and in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO"). This Privacy Policy explains what personal data we collect, how we use it, and the rights available to you as a data subject.

If you have questions about this policy or wish to exercise your rights, contact us at [email protected].

2. What Data We Collect

We collect personal data in the following circumstances:

• Contact enquiries: Name, email address, telephone number, and message content submitted via the contact form on our website.
• Engagement communications: Email correspondence and documents exchanged during the scoping and delivery of analytical engagements.
• Website usage: IP address, browser type, pages visited, and visit duration, collected via analytics cookies where consent has been given.

We do not collect financial data, health data, or any special category data as defined under applicable law.

3. Legal Basis and Purpose of Processing

We process personal data on the following bases:

• Contract performance: Processing necessary to respond to enquiries and deliver scoped analytical engagements.
• Legitimate interests: Maintaining records of business correspondence and managing our operational and data security obligations.
• Consent: Analytics and marketing cookies are used only where you have provided consent via the cookie preference controls on our website.

4. Data Retention

Contact enquiry data is retained for 24 months from the date of the enquiry, or for the duration of an active engagement plus 36 months where an engagement follows.

Website analytics data is retained for 14 months, after which it is aggregated or deleted.

5. Data Sharing

We do not sell, rent, or share personal data with third parties for marketing purposes. Personal data may be disclosed to:

• Authorised personnel within Pylon Index involved in delivering the engagement or responding to the enquiry.
• Cloud storage and communication service providers operating under data processing agreements.
• Regulatory or law enforcement authorities where required by law.

Client operational data shared for analytical purposes is handled under separate written data transfer protocols and is not used or retained beyond the scope of the engagement.

6. Data Security

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include access controls, encrypted file transfer for engagement data, and regular review of data handling practices.

Where a data breach occurs that creates a risk of harm, we will notify affected individuals and, where required, the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong.

7. Cookies

We use cookies on our website. Essential cookies are required for basic site functionality. Optional cookies (analytics, marketing, and preference) are used only with your consent. You can manage your cookie preferences via the controls on our website or through your browser settings. For full details, see our Cookie Policy.

8. Your Rights Under the PDPO

Under the Personal Data (Privacy) Ordinance, you have the right to:

• Request access to personal data we hold about you (Data Access Request).
• Request correction of inaccurate personal data (Data Correction Request).
• Withdraw consent where processing is based on consent.
• Object to certain uses of your personal data.

To exercise these rights, write to us at [email protected] or at the address above. We will respond within 40 days as required by the PDPO.

You may also lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) at www.pcpd.org.hk.

9. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and this policy does not apply to them. We recommend reviewing the privacy policies of any external sites you visit.

10. Children's Privacy

Our services are directed at business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be available on this page. Material changes will be notified via a notice on our website. Continued use of our services after a change takes effect constitutes acceptance of the updated policy.

12. Contact

For privacy-related enquiries: [email protected]

Pylon Index, 27/F, 200 Hennessy Road, Wan Chai, Hong Kong