Privacy Policy
Privacy Policy
Last updated: 05 June 2025
1. Who We Are
Massive Dynamic Limited (“MD, “we,” “us,” or “our”)
Unit 1603, 16/F, The L. Plaza, 367 – 375 Queen’s Road Central, Sheung Wan, Hong Kong
E-mail: support@mdhk.ltd
We operate the website https://mdhk.ltd (the “Site”) and provide immigration-related consultancy, document-preparation, and recruitment-support services (the “Services”). MD is the data controller for all personal data processed via the Site or in connection with our Services.
2. Scope
This Privacy Policy explains what data we collect, why we collect it, how we use it, and the rights you have under:
- EU & UK General Data Protection Regulation (GDPR / UK-GDPR)
- Hong Kong Personal Data (Privacy) Ordinance (PDPO)
- Any other laws that apply in the countries where we target clients (e.g., Poland).
3. What Personal Data We Collect
| Category | Typical items | When collected |
|---|---|---|
| Identity data | Full name, date of birth, nationality, passport number | Contact forms, KYC onboarding |
| Contact data | E-mail, phone, address, Telegram / WhatsApp ID | Quote request, contract signing |
| Employment data | CV details, job title, employer, salary | Visa/permit applications |
| Immigration data | Visa history, travel history, family status | Application file preparation |
| Financial data | Invoice details, bank or payment-service proof | Advance & second payments |
| Technical data | IP address, browser type, device ID, cookies | Site visits |
| Marketing prefs | Opt-in/opt-out status | Newsletter sign-up |
We do not intentionally collect special-category (“sensitive”) data unless strictly required for immigration filings (e.g., medical certificates). Such data is handled under Art. 9 GDPR with your explicit consent.
4. Why & on What Legal Basis We Use Your Data
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide quotes, draft contracts, issue invoices | Contract (Art. 6 (1)(b)) |
| Prepare and submit immigration files | Contract; legitimate interest (Art. 6 (1)(f)) |
| Verify identity & comply with AML / KYC laws | Legal obligation (Art. 6 (1)(c)) |
| Send status updates & service notifications | Contract |
| Marketing newsletters (optional) | Consent (Art. 6 (1)(a)); you may revoke anytime |
| Website analytics & cookie-based improvements | Legitimate interest + Consent (where required) |
5. How We Share Data
We share only the minimum necessary data with:
- Immigration authorities, consulates, and labour offices in destination countries.
- Partner law firms / licensed recruiters who execute portions of your application.
- Payment processors & banks (HSBC, Airwallex, Aspire) to settle invoices.
- Cloud vendors (AWS EU, Google Workspace, Atlassian) under GDPR-compliant DPAs.
- Auditors and regulators if legally required.
We never sell personal data. All third parties must implement appropriate security measures and may process data only on our documented instructions.
6. International Transfers
Data may be transferred from the EEA/UK to Hong Kong or other jurisdictions.
We rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission, and
- Supplementary technical & organisational safeguards (encryption at rest and in transit, role-based access, least-privilege).
7. Data Security
- ISO-27001-aligned policies & employee training
- TLS 1.3 for data in transit; AES-256 encryption at rest
- MFA for internal systems; VPN-restricted admin portals
- Quarterly penetration tests & 24/7 log monitoring
8. Data Retention
| Data type | Retention period |
|---|---|
| Client files & invoices | 7 years after case closure (statutory accounting & immigration-law limits) |
| Marketing data | Until you unsubscribe or after 2 years of inactivity |
| Technical logs | 12 months, then anonymised |
After expiry we securely erase or anonymise the data.
9. Your Rights
Within the limits of applicable law you may:
- Access – obtain a copy of your data.
- Rectify – correct inaccurate data.
- Erase – request deletion (“right to be forgotten”).
- Restrict or object to processing.
- Data portability – receive data in a structured format.
- Withdraw consent – for marketing at any time.
- Complain – EU/UK users: your local Supervisory Authority; HK users: Office of the Privacy Commissioner for Personal Data.
Contact us at support@mdhk.ltd; we respond within 30 days.
10. Cookies & Tracking
We use:
- Necessary cookies – site security, session management (cannot be switched off).
- Analytics cookies (Plausible EU server) – aggregated, no cross-site tracking.
- Marketing cookies – none by default; set only if you explicitly opt-in.
A cookie banner allows granular consent management.
11. Third-Party Links
The Site may include links to external sites (e.g., governmental portals). We are not responsible for their privacy practices. Review their policies before submitting personal data.
12. Children
Our Services target adults (18+). We do not knowingly collect data from minors. If you learn that a child provided personal data, please contact us for immediate deletion.
13. Changes to This Policy
We may update this Policy periodically. Material changes will be announced on the Site and—where legally required—via e-mail. The “Last updated” date will be revised accordingly.
14. Contact
For any privacy questions, data-access requests, or complaints:
Data Protection Officer
Massive Dynamic Limited
E-mail: support@mdhk.ltd
Postal address: Unit 1603, 16/F, The L. Plaza, 367-375 Queen’s Road Central, Hong Kong
End of Privacy Policy
