1 Who we are and what this policy covers
1.1 Digital Carnival Limited ("Digital Carnival", "we", "us" or "our") operates https://digital-carnival.com/ and provides advertising, digital marketing and market research services to corporate clients. Our Business Registration Number is 81128043.
1.2 This Privacy Policy explains how we collect, hold, use and disclose personal data relating to website visitors, people who contact us, and representatives of clients, prospective clients and suppliers. We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) ("PDPO"), including its six Data Protection Principles. We are the data user for the activities described here. Personal data means information relating to a living individual from which it is practicable to identify that individual.
2 Personal information collection statement for enquiries
2.1 We collect your name, email address and any company details, service selection, project brief or message you provide to respond to your enquiry, discuss your requirements and prepare a proposal. Name and email are required to submit the contact form. Other fields are optional. Without the required information, we cannot process the form or reply by email.
2.2 For these purposes, relevant data may be accessed by authorised personnel and providers supporting our website, form delivery, email and security, including Web3Forms and hCaptcha as described below. Providers may process data outside Hong Kong. You may request access to or correction of your personal data by writing to our Privacy Officer at [email protected], marked "Privacy", or to our postal address in section 13. Submitting an enquiry does not subscribe you to promotional messages.
3 Personal data we collect
3.1 Depending on how you interact with us, we may collect the following information:
- 3.1.1 Enquiry data, including your name, email address, company, selected service, project goals, message and subsequent correspondence.
- 3.1.2 Business relationship data, including your role, business contact details, instructions, approvals and information in proposals, agreements, invoices and project correspondence, where these relate to an identifiable individual.
- 3.1.3 Technical and security data processed when the website or its security features are used, which may include IP address, browser and device information, access times, referring pages, error information and interactions with the anti-spam challenge.
3.2 We collect information directly from you and, where relevant to a business relationship, from the organisation you represent or its authorised contacts. Technical information may be generated automatically by our website and its providers. Please provide only information relevant to your enquiry. Do not send identity documents, payment card details, health information or personal data about other people unless we specifically request it through an appropriate channel.
4 How we use personal data
4.1 We use personal data only for the purposes for which it was collected and directly related purposes. These include:
- 4.1.1 Responding to enquiries, understanding business requirements and preparing or discussing proposals.
- 4.1.2 Establishing and administering business relationships, communicating with authorised contacts, delivering agreed services and managing related billing and records.
- 4.1.3 Operating and maintaining the website and enquiry facilities, diagnosing technical problems, and preventing spam, fraud and misuse.
- 4.1.4 Handling privacy requests or complaints, complying with applicable legal obligations and dealing with legal claims, to the extent permitted by law.
4.2 We will obtain your express and voluntary consent before using personal data for a new purpose that is not directly related to the original purpose, unless the PDPO permits otherwise. Visiting this website or reading this policy is not consent to unrelated uses of your data.
5 Disclosure and service providers
5.1 We limit access and disclosure to what is necessary for the relevant purpose. The classes of recipients may include:
- 5.1.1 Our authorised personnel and contractors who need the data to handle enquiries, administer business relationships or deliver agreed work.
- 5.1.2 Providers of website hosting, IT support, form delivery, email, data storage and security services.
- 5.1.3 Professional advisers, such as legal advisers, accountants and auditors, where necessary for the relevant engagement or legal obligation.
- 5.1.4 Courts, regulators, law enforcement bodies or other persons where disclosure is required or otherwise permitted by applicable law.
5.2 The website includes Web3Forms form functionality and hCaptcha anti-spam protection. Web3Forms supports the processing and delivery of enquiries and may handle submitted details and related technical data. hCaptcha processes technical and interaction information to distinguish human users from automated activity. Further information is available at https://web3forms.com/privacy and https://www.hcaptcha.com/privacy.
5.3 Where a provider processes personal data on our behalf, we use contractual or other means to protect it against unauthorised or accidental access, processing, erasure, loss or use, and to prevent retention longer than necessary. Referring to a provider's privacy notice does not replace our responsibilities under the PDPO. We do not sell personal data collected under this policy or provide it to third parties for their own direct marketing.
6 Processing outside Hong Kong
6.1 Our service providers and their infrastructure may process personal data outside Hong Kong. Web3Forms states that it operates from India and uses infrastructure in multiple regions. hCaptcha is operated by Intuition Machines, Inc., based in the United States, and may use facilities and providers in other countries.
6.2 Where personal data is processed outside Hong Kong on our behalf, we take practicable steps, through contractual or other means, to ensure protection consistent with our obligations under the PDPO. Overseas processing remains limited to the purposes explained in this policy. Laws in other jurisdictions may differ from those in Hong Kong.
7 Cookies and similar technologies
7.1 Cookies are small files stored on your device. Website infrastructure and third-party security tools may use cookies or similar technologies to operate features, maintain security and detect abuse. These technologies may process technical identifiers and information about your interactions with the website or security challenge.
7.2 You can manage or delete cookies through your browser settings. Blocking cookies, scripts or related security technologies may affect website features or prevent completion of the anti-spam check and contact form. You can contact us directly by email instead. If we introduce additional analytics, advertising or tracking tools, we will provide information about their purposes and any relevant choices, and obtain consent where required before using them.
8 Direct marketing
8.1 We use enquiry details to respond to the request you make. If we wish to use your personal data for direct marketing of our advertising, digital marketing or market research services, we will first provide the notice required by the PDPO, identify the kinds of data and classes of services involved, provide a response channel and obtain your consent. Silence or failure to respond will not be treated as consent.
8.2 You may ask us to stop using your personal data for direct marketing at any time, free of charge, by contacting [email protected] or using an unsubscribe method included in the message. We will comply with your request. We may keep a minimal suppression record to respect your choice.
9 Accuracy retention and security
9.1 We take all practicable steps to keep personal data accurate for its intended use. Please tell us if your contact details or other relevant information changes.
9.2 We retain personal data only for as long as necessary for its collection purpose or a directly related purpose. In deciding the period, we consider whether an enquiry remains active, whether a business relationship continues, applicable recordkeeping obligations, and any unresolved complaint or legal claim. We take practicable steps to erase or irreversibly anonymise data when it is no longer needed, unless retention is required by law or another applicable PDPO exception. We also address unnecessary retention by providers processing data on our behalf.
9.3 We take all practicable steps to safeguard personal data against unauthorised or accidental access, processing, erasure, loss or use. Access is limited to those who need it for their work, and safeguards are proportionate to the nature of the data and the potential harm from misuse. No internet transmission or storage system can be guaranteed completely secure. Please contact us promptly if you suspect a security issue involving your data.
10 Access correction and privacy complaints
10.1 Under the PDPO, you may ask whether we hold your personal data, request a copy, request correction of inaccurate data and ascertain our policies and practices and the kinds of personal data we hold. Send requests in writing to the contact in section 13. We may require information reasonably necessary to verify your identity or authority and locate the relevant data.
10.2 Subject to the PDPO, we will comply with data access and correction requests within 40 calendar days of receipt. If we are unable to comply within that period, we will notify you in writing of the reasons within the period and comply as soon as practicable thereafter. Any refusal will be handled, and reasons given, as required by the PDPO.
10.3 We may charge a fee for complying with a data access request, limited to directly related and necessary costs and not excessive. We will inform you of any applicable fee. We do not charge for data correction or a direct marketing opt-out.
10.4 You may raise a privacy concern with us using the same contact. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong. Information about its complaint procedure is available at https://www.pcpd.org.hk/.
11 Client projects and research participants
11.1 This policy describes our website and business contact activities. Personal data used in a client campaign or research project may require a separate collection statement or project privacy notice describing the actual data, purposes, recipients and applicable choices. Where we process data solely on a client's instructions, the client's applicable notice and our agreed processing terms govern that activity. This policy does not authorise the collection or use of customer lists, advertising audiences or research responses for unspecified purposes.
12 External websites and policy updates
12.1 External websites and services have their own privacy practices. Please review the relevant notices when you interact with them. This does not affect our responsibility for providers processing personal data on our behalf.
12.2 We may update this policy to reflect changes in the website, our practices or applicable law. The latest version and its update date will appear on the website. An update does not itself authorise a new use of previously collected data. We will provide additional notice and obtain consent where required.
13 Contact us
13.1 For privacy enquiries, data access or correction requests, and complaints, please contact:
13.2 Privacy Officer
Digital Carnival Limited
Email: [email protected]
Postal address: Unit 704C, 7/F, Block 3, Nan Fung Industrial City, 18 Tin Hau Road, Tuen Mun, N.T., Hong Kong