Privacy Policy
What this site collects, who processes it, and how to exercise your rights over it.
Last updated 3 September 2026. This policy covers the website i-comply.io. It does not cover compliance work carried out under a separate client agreement, which is governed by that agreement. If we change how we handle personal data we will update this page and the date on it.
1. Who we are
i-Comply is an independent product compliance company based in Hong Kong SAR. For personal data collected through this website, i-Comply is the data controller — we decide why and how it is used.
For any privacy matter, including the rights in section 7, or to complain about how we have handled your data:
info@i-comply.io · +852 6769 7250
2. What we collect
From the contact form: your first name, last name, email address, company, the services you are interested in, and your message. Everything except company is required to send the form. Please do not send us sensitive personal data through it.
From your visit: our web server records an access log, as any web server does — IP address, page requested, time, referring site and browser. We read those logs to see aggregate figures like visitor numbers and popular pages.
We load no third-party analytics, advertising or tracking scripts. Nothing measures you from inside your browser, we do not profile visitors, and we do not track you across other sites. The one thing stored on your device is your light/dark theme preference, which never leaves it.
Loading this site does mean your browser fetches fonts, a mapping library and an anti-spam check directly from the providers in section 4, so those providers see your IP address. That is a consequence of loading any external file, not something we collect.
3. Why we use it, and our legal basis
| Purpose | Data used | Legal basis (UK/EU GDPR) |
|---|---|---|
| Answering your enquiry and preparing a quote or proposal | Name, email, company, message, services of interest | Steps taken at your request before entering a contract — Article 6(1)(b) |
| Following up on the conversation, and keeping a record of it | The same | Legitimate interest in managing business enquiries — Article 6(1)(f) |
| Preventing automated abuse of the contact form | IP address and browser signals, via hCaptcha | Legitimate interest in keeping the form secure — Article 6(1)(f) |
| Understanding how this site is used, in aggregate | Server access logs | Legitimate interest in improving our own website — Article 6(1)(f) |
We do not use your details for marketing, we will not add you to a mailing list, and we do not sell or rent personal data to anyone.
4. Who else processes it
A small number of providers necessarily handle data on our behalf. This is the complete list.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Web3Forms Web3Creative |
Delivers contact form submissions to our inbox | Everything you enter into the form | Servers in the United States; company registered in India |
| hCaptcha Intuition Machines, Inc. |
Confirms the form is sent by a person, not a bot | IP address, browser and device signals | United States |
| Fontshare Indian Type Foundry |
Serves the typefaces used on this site | IP address, browser information | India / global CDN |
| unpkg | Serves the mapping library behind the globe graphic | IP address, browser information | Global CDN |
| Hostens | Hosts this website and records the access logs | Standard server logs, including IP address | Lithuania (European Union) |
Web3Forms does not store submissions — it forwards them to our inbox and keeps only server logs, which it deletes periodically. Once a submission reaches us it is governed by section 6. We may also disclose personal data where legally required, or to establish or defend legal claims.
5. International transfers
We are established in Hong Kong, and some providers above operate in the United States and India. If you are in the EEA or the UK, your data is therefore transferred outside that area, to countries without a European Commission adequacy decision covering these transfers.
Where that happens we rely on appropriate safeguards, including Standard Contractual Clauses where our providers offer them. Ask us using the details in section 1 and we will tell you what applies to a specific transfer.
6. How long we keep it
- Enquiries that do not become work: up to 24 months from our last exchange, so we have context if you come back to us, then deleted.
- Enquiries that become a client relationship: for the duration of that relationship, then as long as tax, accounting and limitation periods require.
- Server access logs: up to 12 months, so we can compare against the same period a year earlier, then deleted.
You can ask us to delete your enquiry sooner.
7. Your rights
Under the GDPR you have the right to get a copy of the personal data we hold about you, have it corrected or deleted, restrict or object to our use of it where we rely on legitimate interests, receive it in a portable format, and lodge a complaint with your national supervisory authority.
Under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486), which also applies to us, you have the right to request access to and correction of your data; we may charge a reasonable fee for a data access request, as the Ordinance permits. Complaints can go to the Office of the Privacy Commissioner for Personal Data. This policy also serves as our Personal Information Collection Statement: completing our contact form is voluntary, but without it we cannot answer your enquiry.
To exercise any of these, email info@i-comply.io. We will respond within one month, at no charge, and will not ask you to justify the request.