Privacy Policy

Effective date: [07/10/2026]

Cosmopilots Limited (“Cosmopilots”, “we”, “us”, or “our”) is committed to protecting your privacy and handling personal data transparently, responsibly, and in compliance with applicable data protection laws, including Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”). Where we offer services to individuals in the European Economic Area (EEA) or the United Kingdom (UK), we also take into account requirements under the GDPR and UK GDPR as appropriate.

This Privacy Policy explains what personal data we collect via this website, why and how we use it, how long we keep it, how we protect it, and your rights.

By using this website or contacting us through the contact form, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are

Data user / controller: Cosmopilots Limited, a company incorporated in Hong Kong.
Contact: For privacy‑related questions, requests, or complaints, please contact us via our Contact Us page.

Cosmopilots is the data user (under the PDPO) and, where applicable, data controller (under the GDPR/UK GDPR) for the personal data described in this policy.

2. Personal Data We Collect

We only collect personal data that you voluntarily provide to us through:

The contact form on this website; and
The booking platform used to schedule consultant sessions (embedded in or linked from this website).

The data we collect is limited to what is necessary to respond to your enquiry and arrange appointments, typically including:

Name
Phone number
Email address
Company Name
Message / enquiry content
Appointment details (e.g. preferred date/time, service type, any notes you provide in the booking process).

We do not collect payment information, identification documents, or any other sensitive data via this website. Supplying your personal data is voluntary, but if you do not provide the required information, we may be unable to respond to your enquiry or book your session.

Our website may also automatically collect certain technical information (e.g. IP address, browser type, pages visited) via cookies and similar technologies. See Section 8 for details.

3. Purposes of Processing

We collect and use your personal data only for lawful purposes directly related to our business activities, including:

Responding to your enquiry: to answer your questions, provide information about our services, and follow up on your request.
Communications: to communicate with you about your enquiry and, where you have requested it, to send updates about our services.
Marketing (where permitted): to send newsletters, invitations to events, or other marketing materials, where you have consented or where allowed under applicable law.
Website operation and security: to operate, maintain, and secure our website; to detect and prevent fraud, misuse, or security incidents.
Compliance: to comply with legal, regulatory, or professional obligations.
Booking and session management: to schedule, confirm, reschedule, or cancel consultant sessions and to send related reminders or updates.

Where the GDPR/UK GDPR applies, we rely on one or more of the following legal bases: performance of steps at your request (e.g. responding to your enquiry), legitimate interests (balanced against your rights), or your consent (e.g. for certain marketing).

4. Disclosure and Sharing of Personal Data

We do not sell personal data. We may disclose or transfer personal data to the following categories of recipients, as necessary for the purposes described above:

Internal personnel: authorised employees and contractors within Cosmopilots who need access to perform their duties.
Service providers and processors: IT and hosting providers (including our website provider, IONOS), email and communication tools, and professional advisers.
Regulators and authorities: where required by law, regulation, court order, or competent authority (including in Hong Kong or other jurisdictions).
Business transfers: in connection with a merger, acquisition, restructuring, or sale of assets, where personal data may be transferred as part of the transaction, subject to appropriate confidentiality and data protection obligations.
Service providers and processors: IT and hosting providers (including our website provider, IONOS), booking and scheduling platforms, email and communication tools, and professional advisers.

Where we engage service providers to process personal data on our behalf, we impose contractual obligations requiring them to protect your data and use it only for specified purposes.

5. International Transfers

We are based in Hong Kong, but some of our service providers (for example, our website and email providers) may be located outside Hong Kong, including in the EEA, UK, or other jurisdictions.

Where personal data is transferred outside Hong Kong:

We take reasonable steps to ensure that recipients are bound by duties of confidentiality and data protection obligations consistent with applicable law; and
Where the GDPR/UK GDPR applies, we implement appropriate safeguards (such as standard contractual clauses or other legally recognised mechanisms) for transfers to countries without an adequacy decision.

Section 33 of the PDPO (restrictions on transfers outside Hong Kong) is not yet in force; nevertheless, we follow Privacy Commissioner for Personal Data (PCPD) guidance and good practice in managing cross‑border transfers.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws or regulations.

In practice, this means:

Enquiry and contact data: retained for as long as needed to handle your enquiry and for a reasonable period thereafter (e.g. for follow‑up, record‑keeping, or legal/risk management purposes).
Marketing data: retained until you unsubscribe or request deletion, or until we determine the data is no longer relevant for the intended purpose.
Website logs and technical data: retained for a limited period for security, troubleshooting, and analytics, then deleted or anonymised.

When personal data is no longer needed, we take reasonable steps to securely delete or anonymise it.

7. Data Security

We implement reasonable technical and organisational measures to protect personal data against unauthorised or accidental access, processing, erasure, loss, or disclosure. Because our website and related services are hosted and provided by third parties (including IONOS as our website provider), we rely on their security controls for the underlying infrastructure, networks, and platforms.

Our measures include:

Using reputable service providers (such as IONOS) that implement industry‑standard physical and technical security controls;
Requiring service providers to process personal data only on our instructions and to maintain appropriate confidentiality and security obligations;
Using encrypted connections (HTTPS) for the website and contact form;
Limiting internal access to personal data to authorised personnel who need it to perform their duties;
Regularly reviewing our security practices and vendor arrangements.

While we strive to protect your data, no method of transmission or storage is completely secure. If we become aware of a significant data breach affecting your personal data, we will take steps to contain and assess the incident and, where required or recommended by law or regulators, notify affected individuals and authorities.

8. Cookies and Similar Technologies

Our website uses cookies and similar technologies to:

Make the website work properly (essential cookies);
Understand how visitors use the website and improve its performance;
Support security and fraud prevention; and
Where you have consented, support marketing or analytics activities.

A cookie banner managed by our website provider (IONOS) asks for your consent before non‑essential cookies are set. You can accept, reject, or manage your preferences via the banner. You can also control cookies through your browser settings; disabling certain cookies may affect some functionality of the website.

We use IONOS Site Analytics, provided by IONOS, to understand how visitors use our website and to improve its performance and content. Depending on its configuration, this service may use cookies or similar technologies and may process information such as pages visited, interactions with the website, browser and device information, approximate location and technical information.

Where required by applicable law, IONOS Site Analytics is activated only after you provide consent through our cookie banner. You may withdraw or change your consent at any time through the cookie settings available on the website.

For more information about how IONOS processes personal data, please see the IONOS Privacy Policy.

We do not currently use third-party advertising or behavioural advertising tools.

9. Your Rights

Under the PDPO, you have the right to:

Request access to the personal data we hold about you;
Request correction of any inaccurate or incomplete personal data;
Request information about our policies and practices in relation to personal data, and the kinds of data held by us.

Where the GDPR/UK GDPR applies, you may also have additional rights, such as:

The right to request erasure (“right to be forgotten”) in certain circumstances;
The right to restrict or object to processing;
The right to data portability;
The right to withdraw consent (where processing is based on consent), without affecting the lawfulness of processing before withdrawal.

To exercise your rights, please contact us via the contact details on our Contact Us page. We may need to verify your identity before processing your request.

If you are in Hong Kong and have concerns about how we handle your personal data, you may also contact the Office of the Privacy Commissioner for Personal Data (PCPD).

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation, or our business practices.

The updated version will show a new “Effective date” at the top.
We will post the updated policy on this website and, where required by law or where significantly changing how we use your data, notify you directly (e.g. by email or via a notice on our website).

Your continued use of our website or services after the effective date constitutes acceptance of the updated policy.

11. Contact Us

For any questions, requests, or complaints regarding this Privacy Policy or our handling of personal data, please use the contact form on our Contact Us page.

If you are in Hong Kong, you may also contact:
Office of the Privacy Commissioner for Personal Data
Website: https://www.pcpd.org.hk