Privacy Policy

Onkon Group Limited, based in Hong Kong, is the proposed data controller for the personal information covered by this policy. I’m Filippo Rovelli, its founder, and I am based in Guangdong, China.

Registered address: [PLACEHOLDER - confirm: P03 full registered address and any required company registration details]

Privacy contact: [PLACEHOLDER - confirm: P01 public enquiry and privacy contact email]

[PLACEHOLDER - confirm: P05 controller details, applicable legal regimes and whether an EU representative or other statutory contact is required]

Enquiries. If you send a message, I receive the details you provide, such as your name, email address, company, website, area of interest and the contents of your message. Optional fields can be left blank. Please avoid sending passwords, payment details or sensitive personal information.

Technical and security information. Hosting and security systems may process technical information such as an IP address, browser information, the requested page, timestamps and error or abuse signals. The exact information and retention depend on the services configured for this website.

Optional analytics. If you allow analytics, Google Analytics 4 may process information about visits and interactions, such as viewed pages, device/browser characteristics, referral information and cookie identifiers. Analytics must remain disabled until you actively choose to allow it.

Cookie preferences. The website stores a record of your analytics choice so it can apply that choice on later visits. See the Cookie Policy for storage details.

I use enquiry details to understand what you need, respond to you and discuss a possible engagement. Technical information supports website delivery, security, error diagnosis and abuse prevention. Optional analytics helps me understand which pages are useful and how the website is used.

Submitting an enquiry is not a subscription to marketing messages. This baseline does not cover a newsletter, advertising retargeting or the sale of personal data. Those activities must not be introduced without reviewing the disclosures and any consent requirements first.

The appropriate legal basis depends on the purpose and context:

• Steps before a contract: responding to a request you make about entering into an engagement may be necessary to take steps at your request before a contract.
• Legitimate interests: ordinary business correspondence, including enquiries from someone acting for a company, and proportionate site security may rely on legitimate interests after considering the impact on individuals.
• Consent: optional analytics relies on your prior choice. You can withdraw that choice through Cookie settings without affecting the lawfulness of processing based on consent before withdrawal.
• Legal obligations: some records may need to be retained or disclosed where an applicable law requires it.

[PLACEHOLDER - confirm: P05 lawful bases, legitimate-interest assessment and any additional requirements under EU, Hong Kong or other applicable law]

The planned website uses Vercel for hosting and delivery, Resend to send contact-form emails, and Google Analytics 4 for analytics only with permission. An email service is also needed to receive and respond to enquiries. These services may process information necessary for their role, under their applicable terms and contractual arrangements.

Information may also need to be shared with professional advisers or authorities where necessary for a specific legal obligation or legitimate business purpose. Only relevant information should be shared for that purpose.

[PLACEHOLDER - confirm: P06 actual provider legal entities, receiving email provider, subprocessors, contractual roles and data-processing agreements]

Onkon Group Limited is based in Hong Kong and I work from Guangdong, China. Handling an enquiry may therefore involve access to information outside the European Economic Area. Website, email and analytics providers may also process information in other countries.

Where applicable data protection law requires safeguards for an international transfer, the relevant transfer route and safeguards must be identified and put in place. This can include appropriate contractual measures and an assessment of the receiving environment; it must not be assumed from a provider’s brand name.

[PLACEHOLDER - confirm: P06 actual processing locations, access from mainland China, transfer routes, applicable safeguards and how individuals can obtain details]

Information should be retained only as long as needed for its purpose, including any applicable legal or record-keeping requirements. The periods below must be set against the actual business and provider settings before publication:

• Enquiries that do not become engagements: [PLACEHOLDER - confirm: P06 enquiry retention period and deletion process].
• Engagement correspondence and legally required records: [PLACEHOLDER - confirm: P06 contractual and statutory record-retention periods].
• Hosting, error and anti-abuse records: [PLACEHOLDER - confirm: P06 technical log and rate-limit record retention].
• Analytics data and identifiers: [PLACEHOLDER - confirm: P07 GA4 retention and cookie expiry settings].
• Cookie preference record: a proposed six-month period, subject to confirmation in the Cookie Policy and the implemented consent controls.

You can choose not to provide optional form details and can reject analytics without losing access to the website or contact form. If you prefer not to use the form, contact me using the confirmed email address above.

Depending on the law that applies and the circumstances, you may have rights to request access to or correction of personal information, request deletion or restriction, object to certain processing, or receive certain information in a portable form. These rights are not absolute. Identity verification may be needed before information can be disclosed or changed.

To make a request, use the privacy contact above. You can change analytics consent using Cookie settings in the footer. Turning analytics off does not itself delete information already lawfully processed; contact me if you want to ask about it.

You may also have the right to complain to the relevant data protection authority. For individuals in Italy, this may be the Garante per la protezione dei dati personali; individuals elsewhere in the EU may contact their local supervisory authority. Hong Kong privacy rights and complaints may involve the Office of the Privacy Commissioner for Personal Data, where applicable.

[PLACEHOLDER - confirm: P05 applicable rights, request-handling procedure, response deadlines and authority/representative contact details]

Reasonable technical and organisational measures should protect information against unauthorised access, loss or misuse. No website or email channel can guarantee absolute security. Do not send passwords, payment credentials or unnecessary sensitive information through the contact form.

[PLACEHOLDER - confirm: P06 implemented access controls, security measures and incident-handling procedure before making operational security claims]

External websites have their own privacy practices. Following a link does not mean this policy covers the destination website.

This policy may change when the website, its services or legal requirements change. The effective date should identify the current reviewed version, and material changes should be communicated where required.

• Cookie Policy