Personal Information Collection Statement (PICS) & Global Privacy Notice: This Privacy Policy is issued in compliance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486, “PDPO”) and its Six Data Protection Principles (DPP 1 – DPP 6), and incorporates international data protection standards including the European Union General Data Protection Regulation (EU GDPR 2016/679), the UK GDPR / Data Protection Act 2018, and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA) where applicable to international business interactions.
1. Identity of the Data User / Data Controller
For personal data collected through verta-global.com (the “Website”), business consultations, pre-contractual discussions, and corporate communications, the Data User (under Hong Kong PDPO) and Data Controller (under EU/UK GDPR) is:
- Entity Name: Verta Global
- Principal Jurisdiction & Headquarters: Hong Kong Special Administrative Region (HKSAR)
- Service Model: International / Remote Technology Service Delivery
- Privacy & Data Protection Contact: [email protected] (Subject line: Privacy / Data Protection Inquiry)
2. Scope of This Policy & Controller vs. Processor Distinction
This Privacy Policy applies to personal data processed in connection with:
- Visitors browsing our Website (
verta-global.com) and its subpages; - Corporate representatives, executives, procurement officers, and technical leads who submit inquiries, request consultations, or correspond with Verta Global;
- Authorised personnel of prospective, current, or former enterprise clients and vendors; and
- Independent engineers, IT specialists, and technical professionals engaging with Verta Global regarding project or staffing opportunities.
Client Infrastructure & Data Processor Role: Where Verta Global designs, migrates, hardens, administers, or supports cloud environments, cybersecurity architectures, or IT systems on behalf of an enterprise client under a signed Master Services Agreement (“MSA”) or Statement of Work (“SOW”), the client remains the Data Controller / Data User of any personal data hosted within the client’s own environments. In such engagements, Verta Global acts strictly in accordance with the client’s documented instructions, agreed service scope, and any executed Data Processing Addendum (“DPA”).
3. Categories of Personal Data We Collect
In accordance with DPP 1 (Purpose and Manner of Collection) and GDPR data-minimisation principles, we limit collection to information strictly relevant to B2B technology engagements:
3.1 Information Provided Voluntarily by You
- Business Identity & Contact Data: Full name, corporate email address, company or organisation name, job title/role, and jurisdiction or time zone where shared.
- Project & Consultation Details: Selected service of interest (e.g., Cloud Solutions, Cybersecurity, Managed Infrastructure, Development & Engineering, Dedicated IT Specialists, or Technical Support) and technical requirements, architectural goals, or timelines submitted via our Contact form or direct email.
- Commercial & Contracting Records: Signatory details, billing contacts, Statements of Work, non-disclosure agreements (NDAs), and correspondence logs.
- Specialist & Engineering Profiles: Professional CVs, technical certifications, skills matrices, and availability shared by prospective engineers or contractors.
Mandatory vs. Voluntary Provision: On our Contact form, fields marked with an asterisk (*) are necessary to evaluate and respond to your business inquiry. If you choose not to supply mandatory fields, we may be unable to process your consultation request.
3.2 Technical & Security Telemetry Collected Automatically
- Network & Edge Security Logs: IP address (including Cloudflare
CF-Connecting-IPheader), TLS protocol/cipher negotiation metadata, HTTP request headers, timestamp, requested URL path, user-agent string, and referring domain. - Consent & Storage State: Browser storage record (
verta_cookie_consent_v1) recording your cookie preference level and timestamp. See our Cookie Policy for full details.
We do not intentionally collect sensitive personal data / special categories of data (such as health data, biometric identifiers, religious beliefs, political opinions, or government identity numbers) through this Website. Please do not include sensitive personal data or live production credentials in initial Contact form submissions.
4. Purposes of Processing & Lawful Bases
We process personal data solely for lawful, specified business purposes. Where EU/UK GDPR applies alongside the Hong Kong PDPO, our lawful bases under Article 6 GDPR are detailed below:
| Processing Purpose | Categories of Data | HK PDPO Alignment | GDPR / UK GDPR Lawful Basis |
|---|---|---|---|
| Responding to business inquiries, scoping technical consultations, and preparing architecture or staffing proposals | Identity, Business Contact, Project Details | DPP 1 & DPP 3 (Directly related collection purpose & consent) | Art. 6(1)(b) Pre-contractual steps at your request; Art. 6(1)(a) Consent; Art. 6(1)(f) Legitimate B2B interest |
| Executing, administering, and delivering client MSAs, SOWs, invoicing, and account governance | Identity, Business Contact, Commercial Records | DPP 1 & DPP 3 (Contractual fulfillment) | Art. 6(1)(b) Performance of a contract; Art. 6(1)(f) Legitimate interest in B2B contract administration |
| Protecting Website integrity, DDoS/WAF mitigation, rate-limiting, abuse prevention, and cybersecurity incident response | Network & Edge Security Telemetry, IP Address | DPP 4 (Data Security safeguards) | Art. 6(1)(f) Legitimate interest in network and information security (Recital 49 GDPR) |
| Complying with statutory tax, accounting, corporate, regulatory, or lawful court/authority obligations | Commercial Records, Relevant Logs | Part 8 Statutory Exemptions / Legal Compliance | Art. 6(1)(c) Compliance with a legal obligation |
| Optional website performance analysis (only where explicitly opted in) | Consent State, Aggregated Technical Metrics | DPP 1 & DPP 3 | Art. 6(1)(a) Explicit opt-in consent |
5. Direct Marketing & B2B Communications (HK PDPO Part 6A)
In strict compliance with Part 6A of the Hong Kong PDPO and international electronic marketing laws (including PECR and CAN-SPAM):
- Submitting a business inquiry via our Contact form authorises Verta Global to contact you specifically regarding the services, consultation, or project scope you requested.
- Verta Global will never use your personal data for unrelated direct marketing newsletters or promotional campaigns, nor transfer your personal data to any third party for direct marketing, without first obtaining your explicit, separate prescribed consent.
- You may opt out of any commercial follow-up at any time free of charge by replying “Unsubscribe” or emailing [email protected].
6. Disclosures, Sub-Processors & Third-Party Recipients
No Sale or Rental of Personal Data: Verta Global does not sell, rent, trade, or share personal information for cross-context behavioural advertising (as defined under CCPA/CPRA or any equivalent statute).
Access to personal data is restricted on a strict least-privilege, need-to-know basis to:
- Authorised Verta Global Personnel & Technical Leads: Bound by written confidentiality and security obligations to evaluate and deliver your project requirements;
- Infrastructure, Hosting & Edge Security Providers: Including Cloudflare, Inc. (edge TLS, DNS, WAF, and DDoS mitigation) and secure cloud/server hosting infrastructure operating under data security commitments;
- Professional Advisers: Legal counsel, auditors, insurers, and corporate accountants bound by professional confidentiality duties; and
- Competent Authorities: Courts, regulators, or law enforcement bodies strictly where disclosure is required by applicable statutory obligation or valid legal process.
7. International & Cross-Border Data Transfers
Verta Global is headquartered in Hong Kong SAR and delivers cloud, security, and engineering services internationally. Accordingly, business inquiry and engagement data may be accessed or processed in Hong Kong and other jurisdictions where our authorised engineering specialists or secure infrastructure operate.
Where personal data originating from the European Economic Area (EEA), the United Kingdom, or Switzerland is transferred to a jurisdiction not currently subject to a formal adequacy decision, Verta Global implements recognised legal transfer safeguards, including:
- European Commission Standard Contractual Clauses (SCCs) (Decision (EU) 2021/914) and/or the UK International Data Transfer Addendum (IDTA) where applicable in B2B agreements;
- End-to-end transport encryption (TLS 1.2 / TLS 1.3), strict role-based access control, and data minimisation; and
- Transfer necessity under Article 49(1)(b) GDPR where required to perform pre-contractual measures requested by an international corporate client.
8. Technical & Organisational Security Measures (DPP 4 & Art. 32 GDPR)
As a security-first technology organisation, Verta Global maintains administrative, technical, and physical safeguards designed to protect personal data against unauthorised or accidental access, processing, erasure, loss, or use:
- Transport Encryption: Mandatory HTTPS across
verta-global.comusing TLS 1.2 and TLS 1.3 with HTTP Strict Transport Security (HSTS). - Application & Edge Hardening: Content Security Policy (
CSP), anti-framing headers, request payload size caps, rate limiting, and honeypot abuse filtering. - Access Governance: Restricted administrative access (`0600` file-level permissions on inquiry storage), principle of least privilege, and hardened Linux service sandboxing (`ProtectSystem=strict`, `PrivateTmp=true`).
- Incident Preparedness: Documented procedures to investigate suspected personal data breaches and notify affected parties and relevant regulators (such as the Hong Kong Office of the Privacy Commissioner for Personal Data (PCPD) or competent supervisory authorities) where legally required.
9. Data Retention Schedule (DPP 2)
In accordance with DPP 2 (Accuracy and Duration of Retention), personal data is not kept longer than necessary for the fulfillment of the purpose for which it is used:
| Record Category | Standard Retention Period | Disposal / Basis |
|---|---|---|
| Unsuccessful or inactive B2B Contact Inquiries & Consultation Notes | Up to 24 months from last substantive interaction (unless earlier deletion is requested) | Secure cryptographic deletion or anonymisation |
| Executed Client Contracts, SOWs, Invoices & Financial Records | 7 years following the end of the relevant financial year | Statutory retention under the Hong Kong Inland Revenue Ordinance (Cap. 112) & Companies Ordinance (Cap. 622) |
| Edge & Server Security / Rate-Limiting Telemetry | 30 to 90 days (unless retained longer to investigate a specific security incident) | Automated log rotation and overwrite |
Cookie Consent Preference Token (verta_cookie_consent_v1) |
12 months (or until cleared in your browser) | Client-side browser storage expiry |
10. Your Statutory Privacy & Data Protection Rights
Depending on your jurisdiction, you have enforceable statutory rights regarding your personal data:
- Hong Kong SAR (PDPO DPP 6): You have the right to submit a Data Access Request (DAR) to ascertain whether Verta Global holds your personal data and obtain a copy, and a Data Correction Request to correct inaccurate personal data. In accordance with Section 20 of the PDPO, Verta Global responds within 40 calendar days. You may also lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) (
pcpd.org.hk). - EEA & United Kingdom (EU/UK GDPR Articles 15–22): Rights to Access, Rectification, Erasure (“right to be forgotten”), Restriction of Processing, Data Portability, Objection to processing based on legitimate interests, and Withdrawal of Consent at any time without affecting prior lawful processing, plus the right to lodge a complaint with your national Data Protection Supervisory Authority (or the UK ICO).
- California & US State Privacy Laws (CCPA/CPRA): Rights to know/access categories and specific pieces of personal information collected, request deletion, correct inaccurate information, confirm that we do not sell or share personal information, and exercise privacy rights free from discrimination.
How to Exercise Your Rights: Submit your request to [email protected] with sufficient business contact details for us to verify your identity and prevent unauthorised disclosure of records to third parties.
11. Automated Decision-Making & Cookies
Verta Global does not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals (Article 22 GDPR). Automated edge rules (such as Cloudflare WAF and per-IP rate limiting on /api/contact) are used solely to block malicious bot traffic. For details on browser storage and cookies, please review our Cookie Policy.
12. Minors & B2B Enterprise Scope
Our Website and technology solutions are designed exclusively for businesses, enterprises, and professional organisations. We do not knowingly solicit or collect personal data from individuals under 18 years of age. If we become aware that personal data of a minor has been submitted inadvertently, we will delete it promptly.
13. Changes to This Privacy Policy & Contact Information
We review and update this Privacy Policy periodically to reflect technical, operational, or legal developments. Material updates will be indicated by revising the “Last Reviewed & Updated” date at the top of this page.
For any questions, Data Access/Correction Requests, or enterprise DPA inquiries, please contact:
- Email: [email protected]
- Headquarters: Verta Global, Hong Kong SAR
- Online Inquiry: verta-global.com/contact