Privacy Policy

1. Introduction and the developer name

This Privacy Policy explains how Taint and Technology Services Limited collects, uses, stores and protects information when people visit this website, contact the firm, or receive managed endpoint services from the Tai Kok Tsui bay. The policy is written in plain English because it is meant to be read, not merely posted.

The website and the service documentation were prepared with the assistance of the developer known as Taint Tech. References in this policy to the developer name indicate the party that assisted with the technical design and maintenance of the public website, while the data controller for all personal information described here remains Taint and Technology Services Limited.

We ask that you read this policy together with the Terms of Service, which describe the contractual relationship between you and the firm. Where a term in the Terms of Service conflicts with this policy on a matter of personal information, this policy prevails for that matter.

2. Who we are and how to reach us

The data controller is Taint and Technology Services Limited, registered at Rm A 12/F Berford Tower, 68-72 Tai Kok Tsui Rd, Tai Kok Tsui, Hong Kong - 999077, Hong Kong (HK). The firm provides computer systems design and related professional, scientific and technical services, with a focus on managed endpoint hygiene for professional practices.

Privacy enquiries may be sent to service@tainttech.lat or raised by telephone on +14306005853 during business hours. Postal correspondence should use the full address above and be marked for the attention of the privacy team. Please include sufficient detail to identify the matter so that the reply can be useful.

Where this policy refers to the firm, the company or we, those words mean Taint and Technology Services Limited. Where it refers to you, those words mean the individual whose information is being described.

3. Scope of this policy

This policy applies to personal information processed through the public website, through email and telephone contact, through the contact form, and through the delivery of managed services to clients. It also applies to records created on the service benches in the bay, including enrolment logs, patch ring notes, ticket registers and drill summaries, to the extent that those records contain personal information.

The policy does not apply to information that a client holds in its own systems, even where those systems are supported by the firm. In such cases the client is the controller of the information and the firm acts on the documented instructions of the client. If you are an employee or customer of a client, please direct access requests to that client in the first instance.

The policy does not apply to third party websites that may be reached from links on this site. Those sites operate under their own privacy notices, and we encourage you to read them before providing any information.

4. Information we collect

We collect information in three broad groups: information you give us directly, information generated when you use the website, and information created while delivering the managed services.

Information you give us

• Your name, the name of the organisation you represent, and your role or title.
• Your email address and, where you choose to provide it, a telephone number.
• The subject and content of an enquiry, including any details about devices, deadlines or incidents that you describe.
• Information supplied during a scoping call, a walkthrough or a service review.
• Correspondence and attachments sent to service@tainttech.lat.

Information generated by the website

• Technical data such as browser type, operating system family, screen size and preferred language.
• Request data such as the date and time of a visit and the address of the page requested.
• General location data derived from network routing, at city level rather than precise position.

Information created during service delivery

• Device records containing serial numbers, asset labels, assigned users and enrolment dates.
• Patch ring notes recording which devices received a release and which were held, with reasons.
• Ticket records containing the reported issue, the actions taken and the person who raised it.
• Restore drill summaries recording dates, scope, elapsed time and outcomes.
• Access review notes recording the permissions granted, changed or removed for a named account.

We do not intentionally collect sensitive categories of personal information such as health data, biometric identifiers or political opinions. If such information is sent to us unsolicited, we will remove it where that is practical and will not use it for any purpose beyond handling the matter it was sent to address.

5. How information reaches us

Most raw information reaches us through correspondence. When you complete the contact form, your email application prepares a message addressed to service@tainttech.lat, and you send it from your own account. The website itself does not store the content of the form. This means the content of your enquiry arrives as ordinary email, and it is retained in the mailbox in the same way as any other message.

Information also reaches us through service operations. A technician records a device serial number during enrolment, a client administrator provides a list of staff who need access to a shared folder, and a partner reports an incident by telephone. Each of these activities creates a record that may contain personal information.

In a small number of cases information may reach us indirectly. A client may forward a message from an employee, a supplier may provide contact details for a technical administrator, or a public register may list a director of a company we are assessing. Where information arrives indirectly, we apply the same standards of care as for information collected directly.

6. Why we use information

We use personal information for the following purposes, each of which is connected to a legitimate business need:

• Answering enquiries and arranging scoping calls or walkthroughs.
• Preparing proposals, service plans and written engagement scopes.
• Delivering the six managed services described on the services page.
• Maintaining the asset register and the service records that clients rely on.
• Handling support requests and resolving incidents in a timely manner.
• Issuing invoices, receipts and routine business correspondence.
• Meeting legal, regulatory and accounting obligations that apply to the firm.
• Improving the clarity and usefulness of the public website.
• Protecting the firm, its clients and its service bench from misuse and fraud.

We do not use personal information for purposes that are incompatible with those listed above. If we wish to use information for a new purpose, we will assess whether the new use is compatible and will provide additional notice where required.

7. Legal bases for processing

Depending on the circumstances, we rely on one or more of the following legal bases. Where a client is the controller, the client determines the applicable basis and we act on documented instructions.

Where we rely on legitimate interests, we carry out a balancing assessment that considers the nature of the information, the reasonable expectations of the individual and the safeguards we apply. You may ask for a summary of the assessment that relates to your information.

8. Device and endpoint records

The managed services create records about devices, and those records frequently include the name of the person to whom a device is assigned. We treat the assigned user name as personal information and apply the same standard of care to it as to any other identifying detail in our possession.

Wipe and re-image operations are performed on devices in the bay. Where a device is returned and prepared for another user, the device is wiped in accordance with the agreed procedure and the wipe is recorded in the register. We do not inspect the personal content of a device beyond what is necessary to confirm that the wipe has completed and that the baseline has been applied.

Where a client instructs us to preserve a device in its current state for an investigation, we will hold the device and record the instruction. Preservation instructions are logged with the date, the requesting person and the expected duration, so that devices are not held longer than necessary.

9. Cookies and local storage

This website is built as a set of static pages and does not use advertising cookies or behavioural tracking scripts. The pages load a stylesheet and a small script that manages the mobile navigation, the reveal animation and the mailto fallback for the contact form. These files are served from the same domain and do not set advertising identifiers.

The browser may store technical data as part of normal operation, such as a cached copy of a stylesheet. That caching is controlled by your browser settings, and you can clear it at any time. We do not set a cookie to remember you between visits, and we do not build a profile of your browsing across other sites.

If the firm introduces a measurement tool in future that sets a cookie, this policy will be updated before that tool is enabled, and any optional cookie will require consent where the law requires it.

10. Sharing and disclosure

We do not sell personal information, and we do not rent contact lists. We share information only where there is a clear need and an appropriate safeguard.

• With the client organisation, when the information relates to a service delivered to that client.
• With suppliers who provide a specific function, such as email hosting or accounting software, under written terms.
• With professional advisers, where necessary to obtain legal or financial advice.
• With authorities, where disclosure is required by law or by a valid legal order.
• With a successor entity, in the event of a reorganisation, provided the successor is bound by equivalent protections.

Where a disclosure is not required by law, we consider whether the recipient has a legitimate interest, whether the disclosure is proportionate, and whether the individual would reasonably expect it. We record significant disclosures in the service file.

11. Service providers and processors

Like most professional firms, we rely on third party providers for infrastructure that we do not operate ourselves. These may include providers of email, file storage, accounting software, domain hosting and payment processing. Each provider is selected with care and is bound by terms that require confidentiality, appropriate security and limits on use.

Processors are permitted to use personal information only to deliver the service described in the contract with us. They are not permitted to use it for their own marketing or to sell it onward. Where a provider subcontracts part of its service, the subcontractor is subject to equivalent obligations.

A current list of the categories of processor used by the firm may be requested from service@tainttech.lat. We may update the list from time to time as providers change, but the standard of protection required of them does not change.

12. International transfers

The firm is based in Hong Kong and provides services to clients in several regions. Information may therefore be stored or accessed outside the region in which it was collected, including through email and file storage providers whose infrastructure spans multiple countries.

Where information is transferred across borders, we take steps to ensure that the transfer is lawful and that the information remains protected. These steps may include contractual clauses, provider certifications and internal access controls that limit who may view a record.

If you would like to know whether your information is likely to be transferred outside Hong Kong, please write to service@tainttech.lat and describe the matter. We will explain the position as clearly as we can without disclosing information that belongs to another person.

13. Retention periods

We keep personal information only for as long as a legitimate purpose requires. The following periods are the standards currently applied, although a specific matter may justify a longer or shorter period recorded in the service file.

When a retention period ends, records are deleted or anonymised in a manner that makes recovery impractical. Where deletion is not immediately possible because a record is part of an archive backup, access to the record is restricted and the record is removed as the backup cycle turns.

14. Security of the bay and its records

The physical bay is the heart of the service, and its security begins with access. The floor at Rm A 12/F Berford Tower is reached through a controlled entrance, and visitors are escorted. Devices waiting on the rack are tagged and stored in an area that is not open to the public. A device that has not been enrolled is never left in an unsecured state.

Digital records are protected by access controls that follow the principle of least privilege. Staff can see the records needed for their role and no more. Administrative access to client systems requires an approved request, and the use of that access is logged. Passwords are stored in a managed system rather than in documents, and multi factor authentication is required for remote access to the firm systems.

Laptops used for service delivery are encrypted, patched on the same ring schedule applied to clients, and wiped before disposal. Removable media is restricted. Backups of the firm records are tested on a schedule, and a failed test is treated as an incident with a named owner and a fix date.

No system is perfectly secure, and we do not claim otherwise. What we can claim is that the controls above are documented, that they are checked, and that weaknesses found in a review are recorded and closed rather than quietly forgotten.

15. Your rights and choices

Subject to applicable law, you may have the following rights in relation to personal information about you:

• The right to be informed about how your information is used.
• The right to request a copy of the information we hold about you.
• The right to ask us to correct information that is inaccurate or incomplete.
• The right to ask us to delete information that is no longer needed for its purpose.
• The right to ask us to restrict how information is used while a question is resolved.
• The right to object to processing based on legitimate interests.
• The right to withdraw consent for optional communications at any time.
• The right to receive certain information in a portable format.

These rights are not absolute. A request may be refused or limited where the law requires us to keep the information, where the information belongs to another person, or where disclosure would prejudice an investigation. Where a request is limited, we will explain the reason unless the law prevents us from doing so.

16. Making an access or deletion request

To exercise a right, write to service@tainttech.lat with the subject line Privacy request. Describe the information concerned and the right you wish to exercise. We may ask for proof of identity where necessary to protect the information from an unauthorised request. The identity check is proportionate and is not used to collect additional marketing data.

We aim to acknowledge a request within five working days and to provide a substantive response within one month. Where a request is complex, we may extend the period and will tell you before the first month expires. If we need more information to locate the records, we will ask for it promptly rather than waiting until the deadline.

There is normally no charge for handling a request. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline the request, and we will explain the decision.

17. Privacy for Children

The services of the firm are intended for business use, and the website is not directed at children. We do not knowingly collect information from a child under the age of sixteen in connection with the website or the managed services.

If a parent or guardian believes that a child has provided information to the firm, they should write to service@tainttech.lat and describe the circumstances. We will investigate promptly and delete the information where we are satisfied that it was provided without an appropriate basis.

Where a client organisation employs a person under eighteen, the client remains responsible for that person in the employment context, and the firm handles the relevant records on the documented instructions of the client.

18. Marketing communications

We do not send marketing messages to people who have not asked to receive them. If you request a short service note or a seasonal update, we will use the contact details you provide for that purpose, and every message will include a clear way to stop receiving further messages.

Stopping marketing does not affect service messages. If you are a client, we will still send the operational notes, invoices and incident updates that are part of the service. These messages are not marketing and cannot be opted out of while the engagement continues.

We do not share contact details with other organisations for their own marketing, and we do not supplement our records with purchased lists.

19. Third party websites and links

This website may link to external resources, such as documentation for software that supports the service or the websites of professional bodies. Those sites are not operated by the firm and are not covered by this policy.

We check links when they are added, but we do not control the content of an external site and cannot guarantee that it remains accurate or safe. When you follow a link, the privacy notice of the destination site applies, and you should read it before providing information.

If you find a link on this site that leads to content which seems inappropriate, please tell us at service@tainttech.lat so that the link can be reviewed.

20. Automated decisions and profiling

The firm does not make decisions with legal or similarly significant effects about individuals by automated means. Patch ring assignment is based on the role of a device and the tolerance for interruption agreed with the client, not on a behavioural profile of the person who uses it.

Ticket severity is assigned by a technician. Where a simple rule is used to suggest a severity, the suggestion is reviewed by a person before it affects the order of work. A person can always override an automated suggestion, and the reason for an override is recorded.

If this position changes in future, this policy will be updated and any affected individual will be informed before the change takes effect.

21. Incident notification

The firm maintains a short procedure for suspected personal information incidents. When a concern is raised, the privacy team records the details, preserves the available evidence and assesses the likely risk to the individuals concerned.

Where the assessment shows a risk that requires notification, we will inform the relevant authority and the affected individuals without undue delay, describing the nature of the incident, the likely consequences and the steps being taken to address it.

A suspected incident involving a client system is reported to the client contact as soon as the facts are sufficiently clear to be useful. We do not wait for a complete picture before making the first call, because early warning gives the client the best chance to protect its own people.

22. Changes to this policy

This policy is reviewed at least once a year and whenever a significant change occurs in the services, the law or the tools used to deliver the website. The date at the top of the page shows when the current version took effect.

Where a change materially affects how personal information is used, we will provide additional notice to clients by email and will give a reasonable period before the change takes effect where that is practical.

Earlier versions of this policy may be requested from service@tainttech.lat. We keep a short archive so that a client can confirm which version applied on a given date.

23. Complaints and supervisory authorities

If you believe that the firm has handled your information in a way that does not meet this policy, please tell us first. Many concerns can be resolved quickly when the details are clear, and we would rather fix a problem than defend it.

Write to service@tainttech.lat with the subject line Privacy complaint. Describe what happened, when it happened and what outcome you are seeking. We will acknowledge the complaint within five working days and provide a substantive response within one month.

If you remain dissatisfied, you may raise the matter with the supervisory authority responsible for data protection in your jurisdiction. In Hong Kong, that authority is the Office of the Privacy Commissioner for Personal Data. We will cooperate with any inquiry conducted by a competent authority.

24. Contacting the privacy team

For any question about this policy, write to Taint and Technology Services Limited at Rm A 12/F Berford Tower, 68-72 Tai Kok Tsui Rd, Tai Kok Tsui, Hong Kong - 999077, Hong Kong (HK). Email may be sent to service@tainttech.lat and telephone enquiries may be made on +14306005853. The privacy team reads every message and aims to reply within one working day.

This policy, the website and the service documentation were produced with the support of the developer known as Taint Tech, whose assistance covers the public pages and the maintainable structure of the site. The firm remains responsible for the content and for the handling of personal information described throughout this document.