Privacy Policy

Controller

The party responsible for processing personal data in connection with this website is:

This policy explains how we handle personal data in accordance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486, “PDPO”) and, for visitors located in the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (“GDPR”) and equivalent laws.

Visiting this website

When you visit this website, our hosting provider automatically processes technical data required to deliver the pages securely, such as IP address, date and time of access, requested page, browser type and operating system. This data is used only to provide the website, ensure its security and prevent misuse. It is not combined with other data and is not used to identify you.

Legal basis (GDPR): our legitimate interest in the secure and reliable operation of the website (Art. 6(1)(f) GDPR). Log data is deleted or anonymised by the hosting provider after a short period.

Hosting and content delivery

This website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, which acts as our processor and delivers the website via its global network. Cloudflare may process technical data in countries outside Hong Kong and the EEA, including the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework and uses the European Commission’s Standard Contractual Clauses as additional safeguards. Further information: cloudflare.com/privacypolicy.

Cookies and tracking

This website does not use cookies for tracking, advertising or analytics purposes and does not store information on your device. All fonts, images and videos are served from our own server; no content is loaded from third-party services such as Google Fonts, YouTube or social networks. Our hosting provider may set a strictly necessary security cookie to protect the website against automated attacks. As no consent-based technologies are used, no cookie banner is required.

Contacting us

If you contact us by e-mail or telephone, we process the data you provide (e.g. name, company, contact details and the content of your enquiry) in order to handle your enquiry and any subsequent business relationship, including legally required due-diligence checks.

Legal basis (GDPR): pre-contractual measures and performance of a contract (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c) GDPR) and our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). We retain this data for as long as necessary for these purposes and in accordance with statutory retention periods.

International data transfers

SOTACO Inc. is based in Hong Kong. If you contact us from the EEA, the UK or Switzerland, your data will be transferred to and processed in Hong Kong, for which no adequacy decision of the European Commission exists. We process such data only to the extent necessary to handle your enquiry or perform a contract with you (Art. 49(1)(b) GDPR) and protect it with appropriate technical and organisational measures.

Disclosure to third parties

We do not sell personal data. We only disclose personal data where this is necessary to perform a contract (e.g. to logistics, inspection or banking partners involved in a transaction), where we are legally required to do so, or to service providers acting on our behalf under appropriate agreements.

Your rights

Under the PDPO, you have the right to request access to and correction of your personal data. If the GDPR applies to you, you additionally have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR).

To exercise your rights, please contact info@sotaco.com. You also have the right to lodge a complaint with a supervisory authority, in Hong Kong the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk), or the data protection authority in your country of residence within the EEA.

Data security

This website is delivered exclusively via encrypted HTTPS connections. We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access.

Changes to this policy

We may update this privacy policy to reflect changes to our website or legal requirements. The version published on this website applies.

This text is provided in English. It does not replace individual legal advice.