privacy.

This page explains what information this site collects, why, and what you can do about it.

who is responsible.

The company responsible for this site, the newsletter and your personal data (the "controller" under EU and UK data protection law, where applicable, and the "data user" under Hong Kong law) is:

THDG Limited
Unit B, 3/F, Kai Wan House
146 Tung Choi Street, Mongkok, Kowloon
Hong Kong
data@thdg.io

In this policy, "we", "us" and "our" refer to THDG Limited. Write to the email address above for anything about your data.

what this site collects.

The newsletter form. The form asks for your name and your email. Only your email is sent to Beehiiv, the service that sends the newsletter. Your name is used in your browser to check that the form is complete and is not stored by us or included in the newsletter submission.

Newsletter engagement. Beehiiv records information about newsletter opens and link clicks using email tracking pixels and tracked links. This information is associated with your subscriber record and helps us understand readership and improve future emails.

A hidden anti-spam field. The form includes a hidden field intended to detect automated submissions. If it is filled in, the newsletter submission is rejected.

A short rate limit. To prevent repeated submissions, the server keeps your IP address in memory for up to ten minutes and counts submissions from it. This rate-limit record is not written to a database or application log. Separate hosting logs are described below.

Two settings saved in your browser. This site uses your browser's local storage for two things: theme, which remembers whether you picked the light or dark look, and newsletter-next-try, which prevents repeated form submissions within thirty seconds. These values stay on your device. You can clear them in your browser settings at any time.

Website analytics. We use Vercel Web Analytics to understand how people use this site. It records information such as pages viewed, referring websites, approximate location, visit times, and browser and device type. It does not use analytics cookies or track you across different websites. A temporary identifier used to count visitors is automatically discarded after 24 hours. We use the resulting statistics to understand traffic and improve the site.

Server logs. The site is hosted on Vercel. Vercel processes technical details of requests, such as IP addresses, requested pages, browser information and timestamps, to deliver, maintain and secure the service. These hosting logs are separate from website analytics.

Messages you send us. If you email us, we receive your email address, the contents of your message and any information you choose to include. We use this to respond and handle your request.

what this site does not do.

We do not sell personal information or share it for cross-context behavioural advertising. We do not use advertising cookies or cross-site advertising trackers. Fonts are served from this site, not from a third party. Website analytics and newsletter engagement tracking are described above.

why, and on what legal basis.

• The newsletter: your consent to receive it, including any recommendations and offers it contains. Where the GDPR applies, this is consent under Article 6(1)(a). You can withdraw it at any time by unsubscribing.
• Newsletter engagement tracking: to understand readership and improve our emails. We rely on consent where required by law, or otherwise on our legitimate interest in improving the newsletter.
• Website analytics: to understand traffic and improve the site. Where personal data is involved, we rely on our legitimate interest in measuring site usage where permitted, or on consent where required.
• The anti-spam field, rate limit and server logs: our legitimate interest in keeping the site working and preventing abuse, under GDPR Article 6(1)(f) where applicable.
• The two browser settings: to remember your chosen appearance and prevent repeated submissions. We rely on our legitimate interest in providing these features and obtain consent where storage and access rules require it.
• Messages and privacy requests: our legitimate interest in responding to enquiries, and our legal obligations when handling requests under data protection law.

Where consent is required for tracking or browser storage, we obtain it before that activity takes place. Accepting or reading this policy does not itself provide consent.

who else handles your data.

We use the following service providers:

• Beehiiv (beehiiv Inc., United States) manages newsletter subscriptions, sends emails and processes newsletter engagement information. Beehiiv's privacy policy: https://www.beehiiv.com/privacy
• Vercel (Vercel Inc., United States) hosts the site, processes hosting logs and provides website analytics. Vercel's privacy policy: https://vercel.com/legal/privacy-notice

These providers process data to deliver their services to us. They may also process certain information for their own security, service administration or legal obligations, as explained in their policies.

The site's text and images are managed in Sanity, a content tool. We do not use Sanity to store newsletter subscriber records. Our email service provider processes correspondence sent to our contact address.

These services may process data in the United States and other countries outside Hong Kong, the European Economic Area and the UK. Where applicable law requires transfer safeguards, we use the protections in our providers' data processing agreements, including European Commission standard contractual clauses and the UK Addendum where relevant. You can contact us for information about the safeguards covering your data.

how long we keep it.

• Your newsletter email and engagement records: while you remain subscribed and afterwards only for as long as needed to administer subscriptions, handle complaints and meet legal obligations. Unsubscribing stops newsletter emails but does not automatically delete your subscriber profile or engagement history. You can request deletion. A limited record may need to remain to respect your unsubscribe request or meet legal requirements.
• Your IP address for the rate limit: at most ten minutes, in memory only.
• Website analytics: the temporary visitor identifier is discarded after 24 hours. Analytics records and aggregate reports may remain longer so we can compare traffic over time, subject to Vercel's service terms and retention practices.
• Server logs at Vercel: retention depends on the type of log and the applicable service settings. Logs are retained for operational troubleshooting, security investigations and any applicable legal requirements.
• The two browser settings: on your device until cleared. The submission cooldown lasts thirty seconds, even if its stored value remains afterwards.
• Messages and privacy requests: for as long as needed to respond, resolve follow-up matters and retain any records required to demonstrate compliance or handle legal claims.

unsubscribe.

Every newsletter includes an unsubscribe link at the bottom. Using it stops future newsletter emails. You can also email data@thdg.io and we will remove you from the mailing list.

Unsubscribing and requesting deletion are different. If you want your subscriber data deleted, tell us when you contact us.

your rights.

THDG Limited is based in Hong Kong and is subject to the Personal Data (Privacy) Ordinance. Rights under the EU GDPR, UK GDPR and other privacy laws apply where those laws cover our processing of your data.

Depending on the applicable law and circumstances, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct inaccurate information;
• delete your data;
• restrict or object to how we use it, including objecting to direct marketing;
• provide your data in a portable format;
• withdraw consent for processing based on consent, without affecting the lawfulness of processing before withdrawal.

Email data@thdg.io. We aim to respond within one month and will comply with the deadline under the applicable law. If a permitted extension is necessary, we will explain why.

You can complain to the Privacy Commissioner for Personal Data, Hong Kong. Where EU or UK data protection law applies, you can also complain to the relevant data protection authority.

california residents.

If the California Consumer Privacy Act applies to our business and your information, you may have rights to know about and access the personal information we collect, correct it, request its deletion, and exercise applicable opt-out rights without discriminatory treatment.

The information we process is described above, including newsletter details, engagement information, technical request data and correspondence. We do not sell personal information or share it for cross-context behavioural advertising. To make a request, email data@thdg.io.

children.

This site is not aimed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has subscribed or otherwise provided personal data, email us and we will take steps to delete it.

links to other sites.

This site links to other places, including X, Instagram, Pikzels, inkome, intro.co and a document of recommendations. External sites handle your information under their own privacy policies.

Some recommendations include affiliate offers, which means we may earn a commission if you sign up or make a purchase through a link. The destination site or affiliate network may record the referral and use its own tracking technologies.

changes.

We update this policy when our practices change and revise the date at the top. Where a change requires additional notice or consent, we provide that notice or obtain consent before carrying out the relevant processing.

contact.

For privacy and data requests: data@thdg.io

For business enquiries: dvb@pikzels.com