Privacy Policy

1. Who We Are

GVDworks is a trading name of GVD Holdings (HK) Limited (BR 78025335), registered at Unit 2A, 17/F, Glenealy Tower, No. 1 Glenealy, Central, Hong Kong S.A.R. ("we", "us", "our").

Data Controller

GVD Holdings (HK) Limited is the data controller for personal data collected through this website and in connection with our services. For privacy enquiries, contact us at [email protected].

2. Data We Collect

Information you provide

• Name and email address when you submit our contact form or schedule a call.
• Company name and role, if you provide them.
• Any message content you send through our forms.

Information collected automatically

• IP address, browser type, device type, and operating system.
• Pages viewed, referring URL, and session duration via privacy-respecting analytics.
• Cookies strictly necessary for site functionality (see Section 6).

3. How We Use Your Data

• To respond to your enquiries and provide our services.
• To send occasional updates if you have opted in (you can unsubscribe at any time).
• To analyse site usage in aggregate and improve our website.
• To comply with legal obligations.

We do not sell, rent, or trade your personal data to third parties.

4. Legal Basis for Processing

Where the EU/UK General Data Protection Regulation or the Hong Kong Personal Data (Privacy) Ordinance applies, we process personal data on the following bases:

• Consent — when you submit a contact form or subscribe to updates (GDPR Art. 6(1)(a)).
• Performance of a contract / pre-contractual steps — to respond to your enquiry (GDPR Art. 6(1)(b); directly related purpose under PDPO DPP1).
• Legitimate interest — to operate, improve, and secure our website (GDPR Art. 6(1)(f); PDPO DPP1).
• Legal obligation — to comply with applicable laws (GDPR Art. 6(1)(c); PDPO DPP1).

5. Third-Party Services

We use a limited number of third-party services that may process data on our behalf:

• Vercel — hosting and edge delivery.
• Railway — application hosting.
• Resend — email delivery service for contact form responses only.
• Notion — scheduling and internal tooling.
• Google Fonts — loaded locally (no external requests).

Each provider is bound by their own privacy policies and data processing agreements. These providers process data on our behalf under appropriate data processing agreements.

6. Cookies

We use only essential cookies required for site functionality (e.g., locale preference). We do not use advertising or tracking cookies. No cookie consent banner is required because we do not set non-essential cookies. If this changes in the future, we will implement a consent mechanism in compliance with the EU ePrivacy Directive, Thailand PDPA, and applicable laws before any non-essential cookies are set.

7. Data Retention

We retain contact form submissions and correspondence for up to 24 months after our last interaction, unless a longer period is required by law. Technical logs are retained for up to 90 days. Analytics data is stored in aggregate form and cannot be linked to individuals. We do not retain personal data longer than necessary for its stated purpose.

8. Your Rights

8.1 General Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your data.
• Withdraw consent at any time.
• Object to or restrict processing.
• Data portability.
• Lodge a complaint with a supervisory authority.

8.2 California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (Cal. Civ. Code Sec. 1798.100 et seq.) provides you with the right to: know what personal information we collect and how it is used; request deletion of your personal information; correct inaccurate personal information; and opt out of the sale or sharing of personal information. We do not sell or share personal information as defined by the CCPA. We will not discriminate against you for exercising your rights.

8.3 Thailand Residents (PDPA)

If you are located in Thailand, the Personal Data Protection Act B.E. 2562 (2019) provides you with the right to: access your personal data; request correction, deletion, or restriction of processing; withdraw consent; request data portability; and lodge a complaint with the Personal Data Protection Committee (PDPC). Cross-border transfers of your personal data are conducted with appropriate safeguards under Section 28 of the PDPA.

8.4 Hong Kong Residents (PDPO)

Under the Personal Data (Privacy) Ordinance (Cap. 486), you have the right to request access to and correction of your personal data. We will not use your personal data for direct marketing without your explicit prior written consent, in accordance with Part VIA of the Ordinance. We do not use personal data for direct marketing purposes. We will never send you unsolicited marketing communications without your explicit prior consent.

To exercise any of these rights, email [email protected]. We will respond within 30 days (or within the timeframe required by applicable law).

9. International Transfers

As we operate across multiple jurisdictions (Hong Kong, Netherlands, Thailand, United States), your data may be transferred to and processed in countries outside your country of residence. Where such transfers occur, we ensure appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs) (Commission Implementing Decision (EU) 2021/914) for transfers from the EU/EEA.
• PCPD recommended Model Contractual Clauses for transfers from Hong Kong.
• Adequate protections as required under Section 28 of the Thailand PDPA for cross-border transfers.
• EU-US Data Privacy Framework adequacy decision where applicable.

10. Security

We implement reasonable technical and organisational measures to protect your personal data, including HTTPS encryption, access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure.

11. Children

Our services are not directed at individuals under 16. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page with an updated effective date. Continued use of the site after changes constitutes acceptance.

13. Contact

GVD Holdings (HK) Limited
Unit 2A, 17/F, Glenealy Tower, No. 1 Glenealy
Central, Hong Kong S.A.R.
[email protected]