Amass Group Company Limited takes the handling of personal data seriously. This document describes in plain language what we collect, why we collect it, how long we keep it and what rights you have. The website and the services described here are operated by Amass Group Company Limited, registered office Rm 12, 11/F Century Ctr, 44-46 Hung To Rd, Kwun Tong, Hong Kong (HK). The developer of this site identifies as Amass Groups, and any privacy question about the build of this website may be addressed to the contact details published below. We have written this policy without quotation marks so that it can be read cleanly by screen readers and by anyone translating it into another language.
1. Scope of this policy
This policy covers the personal data that Amass Group Company Limited processes when you browse this website, submit a contact form, send us an email, call our office, or engage us to design and integrate computer systems. It also covers the personal data we handle while providing the holding services described on our services page, including floor notices, tenant sheets, meeting notes, building passes, maintenance reviews and lease sittings. The policy does not cover the practices of organisations that we do not control, such as a client building operator that keeps its own visitor register, or a third party application that you use to reach us. Where a client engages us to process data on the client side, the client is usually the controller and we act on written instruction. In that situation the client privacy notice governs the overall relationship and this policy describes our own handling as a processor.
We provide services to organisations rather than to consumers, but we still receive personal data about individuals. That includes the staff of our clients, the visitors who are issued building passes, the tenants whose names appear on a roster and the contractors who attend a maintenance review. We treat all of that data with the same care, regardless of whether the person is a senior manager or a courier signing in at the lobby.
2. Who is the data controller
The data controller for the personal data described in this policy is Amass Group Company Limited, a company operating in the computer integrated systems design and related professional, scientific and technical services sector. Our registered office is Rm 12, 11/F Century Ctr, 44-46 Hung To Rd, Kwun Tong, Hong Kong (HK). The contact email address for privacy matters is records@addfafa.com and the contact telephone number is +13207032243. Correspondence about privacy should be marked for the attention of the records desk so that it reaches the right person without delay. The desk can be reached by telephone on +13207032243 during Hong Kong business hours.
The developer of this website is identified as Amass Groups. The developer is responsible for the technical build of the pages you are reading and works under the direction of the company. Where this policy uses the words we, us or our, it refers to Amass Group Company Limited acting through its staff and its appointed developer.
Records desk, Amass Group Company Limited, Rm 12, 11/F Century Ctr, 44-46 Hung To Rd, Kwun Tong, Hong Kong (HK). Email records@addfafa.com, telephone +13207032243.
3. What personal data we collect
We try to collect only what we need. The categories of personal data we may collect include the following, depending on how you interact with us.
- Identity data, such as your name, the organisation you work for and your job title.
- Contact data, such as your email address, telephone number and postal address.
- Correspondence data, such as the content of messages you send through our contact form, by email or during a call.
- Project data, such as notes taken during meetings, requirements you provide and feedback you give on a deliverable.
- Tenancy and building data, such as the names and contact details that appear on a tenant sheet or a visitor register that we are asked to maintain.
- Technical data, such as the browser type, device type and approximate region that a web server records when a page is requested.
- Usage data, such as the pages you visit on this website and the links you follow.
- Billing data, such as the invoicing contact and purchase order reference of a client organisation.
We do not deliberately collect special category data such as health information, biometric information, religious beliefs or political opinions. If a project genuinely requires such data, we will discuss it with the client first, document the need and apply stricter controls before any processing begins. We do not collect data about criminal convictions unless a specific engagement and the applicable law clearly require it.
4. Where the data comes from
Most of the personal data we hold comes directly from the person concerned. You give it to us when you fill in the contact form, when you email the records desk or when you take part in a meeting. Some of it comes from the organisation that engages us, for example when a client sends a tenant roster or a list of staff who will attend a maintenance review. Some of it is generated automatically by our web server when a page is requested.
We may also receive data from a previous provider during a handover, when a client transfers an existing system to us. In that case we check that the client has the right to share the data and we record the transfer in our project file. If we discover that data has been shared with us without an appropriate basis, we raise the issue with the client and, where necessary, delete the data.
5. Why we use personal data
We use personal data for a limited set of purposes. We use it to answer enquiries and arrange meetings. We use it to prepare proposals and deliver the services a client has asked for. We use it to maintain the records that a building or a tenancy depends on, including floor notices, tenant sheets, meeting notes and pass registers. We use it to schedule and document maintenance review rounds and lease sittings. We use it to issue invoices, keep accounts and meet our legal obligations. We use it to improve our website and to understand, in aggregate, which pages are useful.
We do not use personal data for purposes that are incompatible with those listed above without telling you first. If we want to use data for a new purpose, we will consider whether the new purpose is compatible with the original one and, where required, we will ask for consent or provide a fresh notice before we begin. We do not sell personal data and we do not rent lists of contacts to anybody.
6. Our lawful basis
Where data protection law requires a lawful basis, we rely on one or more of the following. We rely on contract where processing is necessary to prepare for or perform a service that a client has engaged us to provide. We rely on legitimate interests where the processing supports our business in a way that is proportionate and does not override the rights of the individual, for example keeping a security log or responding to an enquiry that a person chose to send. We rely on legal obligation where we must keep records for accounting, tax or regulatory reasons. We rely on consent where we have asked for it explicitly, for example before sending a newsletter that a person opted into.
If you have given consent, you may withdraw it at any time. Withdrawal does not affect processing that took place before the withdrawal, and it does not affect processing that relies on another lawful basis. Where we process data as a processor for a client, the client chooses the lawful basis and we follow the written instruction in the service agreement.
8. Measurement and analytics
We may use a modest measurement tool to count visits and to see which pages are opened most often. Where we do so, we configure the tool to avoid collecting precise location data and to avoid linking a visit to a named individual. The information we review is aggregated, for example the number of visits to a page over a month or the proportion of visitors using a mobile device.
We use the results only to maintain and improve the site. We do not use them to make decisions about individual people. If a client asks us to install a measurement tool on a system that we operate for the client, we treat the tool as part of that engagement and we document it in the project file and in the client privacy notice.
9. How we share data
We share personal data only where there is a clear need and an appropriate safeguard. We may share data with a client organisation when the data relates to a service we provide to that client, for example when a floor notice must be sent to the building operator. We may share data with professional advisers such as accountants and lawyers when it is necessary to run the business or to respond to a legal question. We may share data with a regulator, a court or a law enforcement body where the law requires it or where we have a good faith belief that disclosure is necessary to prevent harm or fraud.
We do not share personal data with advertisers. We do not provide contact lists to marketing partners. If we are ever involved in a merger, an acquisition or a transfer of business assets, we will tell affected individuals how their data will be handled before any transfer takes effect, and the receiving organisation will be bound by this policy or by a policy that is at least as protective.
10. Service providers and processors
Like most organisations, we rely on a small number of service providers to run our operations. These may include a hosting provider that stores our website files, an email provider that delivers and stores correspondence, an accounting provider and, where a client project requires it, a specialist integration vendor. Each provider is chosen with care and is bound by a written agreement that requires confidentiality, security and a limit on the use of data to the purposes we have approved.
We remain responsible for the personal data that a processor handles on our behalf. If a processor tells us about a security incident that affects data we control, we take the necessary steps, notify the client or the regulator where required, and record the incident and the response in our internal log.
11. International transfers
We are based in Hong Kong and most of our processing takes place there. Some of our service providers operate in other jurisdictions, which means that data may pass through, or be stored in, a country other than the one in which you are located. Where that happens, we use appropriate safeguards such as standard contractual clauses or an equivalent mechanism, and we review the provider security arrangements before the transfer begins.
If you would like to know more about the safeguards that apply to a particular transfer, you may contact the records desk using the details in this policy and we will explain the mechanism in plain language. We will not transfer data to a jurisdiction where we cannot put an appropriate safeguard in place.
12. How long we keep data
We keep personal data only for as long as we need it for the purpose for which it was collected, plus any period required by law. Enquiry correspondence is usually kept for up to two years after the last contact so that we can follow up appropriately. Project files are kept for the duration of the engagement and for a further period that reflects the useful life of the system, after which they are reviewed and either archived in a restricted form or deleted.
Records that support accounting and tax obligations are kept for the period required by the applicable rules. Pass registers and visitor logs are kept for a shorter period unless a client instructs otherwise in writing. When a retention period ends, we delete the data or anonymise it so that it can no longer be linked to an individual. We review our retention schedule at least once a year and we record the review in our internal policy file.
13. Security of personal data
We use technical and organisational measures that are appropriate to the sensitivity of the data and the risk of harm. Access to systems is limited to people who need it for their role. Accounts are protected by strong passwords and, where a provider supports it, by a second factor. Devices are kept up to date and are encrypted where possible. Paper records such as tenant sheets are kept in a locked cabinet at our office and are not left on the lobby desk overnight.
No system is perfectly secure. If a personal data breach occurs, we will investigate promptly, contain the incident, assess the risk to individuals and notify the relevant regulator and, where required, the affected individuals. We keep a record of breaches and of the measures taken so that lessons can be applied to future work.
14. Marketing communications
We do not add people to a marketing list simply because they sent us an enquiry. If we offer a newsletter or an occasional update about our services, we will ask for consent first and we will provide a clear way to unsubscribe in every message. You can tell us at any time that you no longer wish to receive marketing messages, and we will remove you from the list promptly.
Service messages are different from marketing. If you are a client or a contact on an active project, we may send you messages that are necessary to deliver or support the service, such as a meeting confirmation or a maintenance review reminder. These messages are not marketing and are not governed by an unsubscribe request, although you may always ask us to change how we contact you.
15. Your rights and choices
Depending on where you live, you may have the right to ask for a copy of the personal data we hold about you. You may ask us to correct data that is inaccurate or incomplete. You may ask us to delete data where there is no good reason for us to keep it. You may object to certain processing, for example processing based on legitimate interests. You may ask us to restrict how we use your data while a question is being resolved. You may ask for your data in a portable format where the law provides that right.
To exercise a right, contact the records desk using the email address or telephone number in this policy and describe what you would like us to do. We will respond within the period required by the applicable law. We may ask for information to confirm that you are the person concerned, so that we do not disclose data to the wrong individual. There is normally no fee for a request, though we may charge a reasonable fee where the law allows and the request is clearly excessive.
If you are not satisfied with our response, you may complain to the data protection authority in your jurisdiction. We would appreciate the chance to resolve the matter with you first, so please do contact the records desk before taking a formal step if you are able to.
16. Privacy for children
Our services are provided to organisations and are not directed at children. We do not knowingly collect personal data from a child. If a client project involves a building or a service that children may use, the client is responsible for obtaining any consent that the law requires from a parent or guardian, and we will help the client apply appropriate safeguards. If you believe that a child has sent personal data to us without the necessary consent, please contact the records desk and we will delete the data promptly.
17. Automated decision making
We do not make decisions about individuals by purely automated means where those decisions would have a legal or similarly significant effect. Our integration work may include rules that help a client route a request to the correct desk or flag a maintenance item for review, but a person remains responsible for the outcome. If a client asks us to build a process that uses automated decision making, we will discuss the legal and ethical implications with the client before any design work begins.
18. Third party links
This website may contain links to third party sites, for example a mapping service or a professional directory. We do not control those sites and we are not responsible for their privacy practices. When you follow a link, we encourage you to read the privacy notice of the site you are visiting. A link from our site does not mean that we endorse the content or the data practices of the destination.
19. Changes to this policy
We review this policy from time to time so that it reflects the way we work and the requirements that apply to us. When we make a material change, we will update the date at the top of this page and, where appropriate, tell clients and contacts directly. We encourage you to read the policy again when you return to the site. Continued use of the site after a change means that you have had the opportunity to review the updated policy.
This policy is written in English. If we provide a translation for convenience, the English version remains the authoritative text. If there is a conflict between versions, the English version prevails to the extent permitted by law.
20. How to contact us
Questions, requests and complaints about privacy are welcome and should be sent to the records desk at Amass Group Company Limited. The postal address is Rm 12, 11/F Century Ctr, 44-46 Hung To Rd, Kwun Tong, Hong Kong (HK). The email address is records@addfafa.com and the telephone number is +13207032243. Please include enough detail for us to identify the matter and to respond usefully, and let us know how you would prefer to be contacted.
This policy is provided by Amass Group Company Limited and reflects the practices of the company and of the developer identified on this site as Amass Groups. We are grateful for the trust that clients and visitors place in us and we will continue to keep this policy and our practices under review.