Skip to content

    Privacy Policy

    How we collect, use and protect your personal data

    1. General Provisions

    1.1. This Privacy Policy ("Policy") describes how Genium Technology Limited ("Genium Group", "we", "us"), a company incorporated in Hong Kong, collects, uses and protects personal data on the website genium-group.com and its subdomains ("Website"), and through our contact, scoping and project-delivery channels.

    1.2. This Policy is issued in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of the Laws of Hong Kong ("PDPO") and other applicable Hong Kong data protection laws.

    1.3. Our sister brand Genium Infrastructure (genium-infra.com) operates as a separate data controller under its own privacy policy published on that site. This Policy does not apply to that property.

    1.4. By using the Website or engaging us, you agree to the processing of your personal data as described in this Policy. If you do not agree, please do not use the Website or contact us through these channels.

    2. Personal Data We Collect

    2.1. We collect the following categories of personal data:

    2.1.1. Contact & Project Inquiry Data: data you provide via our contact and "Book a Free Call" forms — name, work email, phone (optional), company, industry (optional), services of interest, and your message.

    2.1.2. Website Chat & WhatsApp Conversation Data: the messages, queries and attachments you send when you initiate a conversation with us through our website chat widget or our WhatsApp business number, along with associated metadata (timestamps, message status, phone number/profile name where applicable).

    2.1.3. Meeting Booking Data: name, email, scheduling preferences and any context you provide when booking a discovery or scoping meeting through our calendar system.

    2.1.4. Technical Data: IP address, browser type, device type, operating system, access timestamps, pages viewed, referrer URL and similar information collected automatically when you visit the Website.

    2.1.5. B2B Visitor Identification Signals: company-level and intent signals derived from third-party visitor identification providers (e.g. Warmly), used to understand which organisations visit our Website. Internal Genium Group traffic is filtered out.

    2.1.6. Marketing Attribution Data: UTM parameters (utm_source, utm_medium, utm_campaign) and referral information used to measure marketing effectiveness.

    2.1.7. Engagement & Delivery Data: during active client projects, information shared by you in the course of scoping, designing and delivering the work, including any business data you choose to share with us.

    3. Purposes of Processing

    3.1. We process personal data for the following purposes:

    3.1.1. Responding to inquiries received through forms, website chat, WhatsApp and email.

    3.1.2. Scoping and delivering projects — preparing proposals, statements of work, designs, code, integrations and documentation.

    3.1.3. Meeting scheduling — coordinating discovery, scoping and project meetings.

    3.1.4. CRM and pipeline management — tracking leads, opportunities and accounts so we can follow up appropriately.

    3.1.5. Service improvement and analytics — understanding how the Website is used and improving our content and offering.

    3.1.6. Legal and regulatory compliance — meeting obligations under Hong Kong law.

    3.2. We do not sell your personal data, and we do not provide your business data or conversation content to third-party AI providers for the training of their public models.

    4. Legal Basis

    4.1. We rely on the following legal bases under the PDPO and applicable principles:

    • Consent: when you submit a form, start a chat, message us on WhatsApp or book a meeting, you consent to us processing the personal data you provide for the purpose of responding to and following up on that inquiry.
    • Performance of contract: processing necessary to deliver projects under signed proposals or statements of work.
    • Legitimate business interests: limited B2B outreach to work email addresses about relevant services, analytics, and improvement of our Website and offering, balanced against your rights.
    • Legal obligation: compliance with applicable Hong Kong law.

    5. Cookies & Tracking

    5.1. The Website uses cookies and similar technologies, including:

    5.1.1. Essential cookies — required for core functionality such as session management and security. These cannot be disabled.

    5.1.2. Analytics cookies — to understand how visitors interact with the Website (page views, sessions, sources, device type). Collected on an aggregated or anonymised basis.

    5.1.3. UTM & attribution parameters — captured from URLs to measure marketing performance.

    5.2. You may manage cookies through your browser settings. Disabling certain cookies may affect Website functionality.

    6. Third-Party Processors

    6.1. We engage trusted third parties to operate and support the Website and our services. Each is bound by appropriate contractual safeguards. They include:

    • Supabase — database, authentication and storage for our CRM and admin tooling.
    • Web3Forms — secure delivery of form submissions to our email and CRM.
    • OpenRouter and AI model providers — for AI-assisted responses in our chat and admin tooling. Inputs are processed for the purpose of generating a response and are not used to train public foundation models.
    • WhatsApp Business API providers (WaSender) — to send and receive messages on our WhatsApp business number.
    • Google Calendar — meeting scheduling and conflict detection.
    • Warmly — company-level visitor identification for B2B intent signals.
    • Hosting and CDN providers — to serve the Website.

    6.2. We do not disclose your personal data to third parties except: (a) to the processors listed above to the extent needed to deliver our services; (b) where required by Hong Kong law, court order or the Privacy Commissioner for Personal Data; (c) to professional advisors under confidentiality; or (d) with your consent.

    7. AI-Assisted Communications Disclaimer

    7.1. Some of our customer-facing channels — including the website chat widget and WhatsApp — may be assisted by AI to provide initial responses, summarise inquiries and route messages to the right person. You can request a human at any time.

    7.2. AI-generated replies may contain inaccuracies and must not be relied on as professional advice. Commercial terms are only binding once confirmed in a signed written proposal.

    8. Data Security

    8.1. We implement appropriate technical and organisational measures to protect personal data, including:

    • Encryption of data in transit (TLS) and at rest using industry-standard protocols.
    • Role-based access controls and least-privilege principles for internal tooling.
    • Row-level security on database tables to keep client and lead data isolated.
    • JWT and admin-role checks on sensitive backend functions.
    • Regular backups, monitoring and review of access logs.
    • Internal training on data protection and confidentiality.

    9. Data Retention

    9.1. We retain personal data only for as long as necessary to fulfil the purposes set out in this Policy, or as required by law.

    9.2. CRM and lead data are retained while there is a reasonable prospect of engagement, plus a reasonable archival period thereafter for record-keeping and dispute defence. Project records are retained for the duration of the engagement and a reasonable period after completion.

    9.3. You may request deletion of your personal data at any time. We will respond to valid requests within the timeframes required by the PDPO.

    10. Your Rights under the PDPO

    10.1. Data subjects have the right to:

    10.1.1. Access their personal data and information about its processing (section 18 of the PDPO).

    10.1.2. Correction of inaccurate or incomplete personal data (section 22 of the PDPO).

    10.1.3. Withdraw consent to direct marketing at any time (section 35C of the PDPO).

    10.2. To exercise these rights, please contact us using the details in Section 14. We will respond to valid requests within 40 days as required by the PDPO.

    11. Children's Privacy

    11.1. Our services are intended for business use and are not directed at individuals under the age of 18. We do not knowingly collect personal data from children.

    11.2. If you believe a child has provided us with personal data, please contact us immediately and we will take reasonable steps to delete it.

    12. Data Breach Notification

    12.1. In the event of a personal data breach likely to result in a real risk of significant harm, we will:

    12.1.1. Notify the Privacy Commissioner for Personal Data, Hong Kong as soon as reasonably practicable.

    12.1.2. Notify affected data subjects without undue delay, providing information about the nature of the breach and recommended protective steps.

    12.1.3. Take immediate remedial action to contain the breach and prevent recurrence.

    13. International Data Transfers

    13.1. Some of our processors (e.g. cloud infrastructure and AI model providers) may process data outside Hong Kong. Where this occurs, transfers are protected by appropriate contractual safeguards intended to ensure a level of protection comparable to the PDPO.

    14. Sister Brands

    14.1. Genium Infrastructure (genium-infra.com) operates as a separate data controller under its own privacy policy. Please refer to that website for information on how it processes personal data.

    15. Contact

    15.1. For privacy questions, data-subject requests or complaints:

    Email: privacy@genium-group.com
    Primary Contact: ilya@genium-group.com
    Address: Room 607, 6/F Kowloon Plaza, 485 Castle Peak Road, Cheung Sha Wan, Hong Kong

    15.2. If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).

    16. Policy Updates & Applicable Law

    16.1. This Policy may be updated to reflect changes in our services, legal requirements or best practices. Material changes will be communicated via the Website or by email.

    16.2. This Policy is governed by the laws of the Hong Kong Special Administrative Region, in particular the Personal Data (Privacy) Ordinance (Cap. 486).

    Last updated: October 13, 2026