Privacy Notice

1. Who is responsible for your personal data

The data user (in PDPO terms) and data controller (in GDPR terms) for personal data described in this notice is SEVENA LIMITED, with offices at Flat A, 8/F., Kingswell Commercial Tower, 171 Lockhart Road, Wan Chai, Hong Kong, and at 8 Modestou Panteli, 2480, Tseri, Nicosia, Cyprus.

For any privacy matter you can reach us at [email protected]. If a later service agreement identifies different terms for a client relationship, those terms govern that relationship; this notice covers the website and initial correspondence.

2. What personal data we collect

When you email us, we receive the data you choose to include: your name, email address, and the content of your message, together with any details you volunteer about the arrangements you would like us to handle.

The website itself does not collect personal data. Our hosting infrastructure may keep short-lived technical logs (such as IP addresses and request metadata) strictly for security and reliability of the service; we do not use these logs to identify visitors.

3. Why we process data, and on what legal basis

We process correspondence in order to reply to you, to assess whether and how we can take on a request, and to prepare a possible client relationship at your request. Under the GDPR this rests on steps taken prior to entering into a contract (Article 6(1)(b)) and on our legitimate interests in running a small private practice responsibly (Article 6(1)(f)); under the PDPO it follows the Data Protection Principles on purpose-bound, proportionate collection and use.

We may also retain limited records where the law requires it or where they are reasonably needed to protect our legal position.

4. Who may receive your personal data

We do not sell personal data, and we do not share it for marketing.

Access is limited to Sevena personnel who handle your request, to service partners engaged for a specific arrangement (for example an operator or venue, and only to the extent the arrangement requires), to the technology providers that host our email and infrastructure under confidentiality obligations, and to professional advisers or competent authorities where disclosure is legally required.

5. International transfers

Sevena works worldwide and coordinates between Hong Kong and Cyprus, so correspondence may be accessed from either office and, where an arrangement requires, shared with partners outside your own jurisdiction.

Where the GDPR applies, transfers outside the European Economic Area are made with appropriate safeguards, such as an adequacy decision or the European Commission's Standard Contractual Clauses. In all cases we keep the data involved to the minimum the task requires, consistent with PDPO principles on use and security.

6. How long we keep data

We keep correspondence only for as long as it is needed to respond to you, to manage any follow-up you have asked for, and to maintain proportionate business records.

Where a client relationship begins, retention is governed by the applicable engagement terms and legal obligations rather than by this website notice alone. Data that is no longer needed is deleted or anonymised.

7. Your rights

Under the PDPO you may request access to your personal data and ask for it to be corrected.

Where the GDPR applies to you, you may additionally request erasure, restriction of processing, object to processing based on legitimate interests, ask for portability of data you provided, and — where any processing rests on consent — withdraw that consent at any time without affecting prior processing.

To exercise any of these rights, write to [email protected]. We will respond within the timeframe the applicable law sets.

8. Security

We apply technical and organisational measures intended to protect personal data against unauthorised access, loss or misuse: access is limited to those who need it, correspondence is held on controlled, reputable infrastructure, and confidentiality is a standing obligation for everyone who works with the practice.

No internet-based service can promise absolute security, but discretion is the foundation of our work and we treat your data accordingly.

9. Cookies and tracking

This website is a static site. It does not set cookies, does not use analytics, and does not employ tracking or advertising technologies of any kind.

No consent banner is shown because there is nothing to consent to: browsing this site leaves no trace with us. The only personal data we receive is what you choose to send by email.

10. Questions and complaints

If you have a privacy concern, please contact us first at [email protected] so that we can put it right.

You may also lodge a complaint with a supervisory authority: in Hong Kong, the Office of the Privacy Commissioner for Personal Data (PCPD); in Cyprus, the Commissioner for Personal Data Protection; or, if you are elsewhere in the European Economic Area, the supervisory authority of your usual place of residence or work.