This Privacy Policy explains the privacy practices of Jilly International (Hong Kong) Limited, the company that publishes this website and delivers holding company administration services. The website and the administration service are operated by the developer Jilly International, which manages the technical side of the online enquiry form, the website hosting and the internal record tools used by the administrator.
This document describes the kinds of information we collect, the reasons we collect it, the way we keep it, the people who may see it and the choices available to you. We have written it in plain sentences so that a director, an officer or a visitor can understand it without legal training.
1. Scope of this policy
This policy covers personal data processed through the website at www.kawingholdings.lol and through the administration service provided by Jilly International (Hong Kong) Limited from its office at Rm 1303 13/F YF Life Centre, 38 Gloucester Rd, Wan Chai, Hong Kong - 999077, Hong Kong (HK). It applies to visitors who read the website, to prospective clients who submit an enquiry, to directors and officers of client companies whose records we administer, and to any person whose details appear in a board minute, a register entry or a filing that we prepare.
This policy does not cover websites that we do not control, third party platforms that you use to reach us, or the internal practices of client organisations that hold their own data. Where a client company acts as the controller of a board record and the office acts only as an administrator, the client policy governs the underlying information and this policy governs the service we deliver on that client behalf.
The service is intended for business users in the professional, scientific and technical services sector, including holding companies, family offices and corporate groups. It is not a consumer retail service, and it is not designed for primary school or family use.
2. Who is responsible for your data
Jilly International (Hong Kong) Limited is the entity responsible for the personal data described in this policy, except where a client company is named as the controller of a specific record. The company is registered in Hong Kong and conducts its administration work from the board room address shown below.
The developer Jilly International maintains the website, the enquiry form handler and the record templates used by the administrator. Questions about this policy, requests to exercise a right, or complaints about handling can be sent to the contact points in the final section of this document.
Records office
Jilly International (Hong Kong) Limited
Rm 1303 13/F YF Life Centre, 38 Gloucester Rd, Wan Chai, Hong Kong - 999077, Hong Kong (HK)
Email: admin@kawingholdings.lol
Phone: +15673500109
3. Information we collect
We collect information in three ways: information you give to us, information generated when you use the website, and information contained in documents supplied for an administration task. We try to collect only what a task genuinely requires, and we ask for the least sensitive version of a document where two versions would serve the same purpose.
3.1 Information you provide directly
- Your name, job title and the organisation you represent.
- Your email address, telephone number and preferred language of correspondence.
- The subject and text of an enquiry submitted through the contact form or by email.
- The company name, registration number, director list and shareholding outline supplied when a file is opened.
- Correspondence exchanged with the office, including attachments such as draft minutes, resolutions, registers and filing confirmations.
3.2 Information generated by the website
- The pages you visit and the time you spend on each page.
- The type of device, operating system and browser version used to reach the site.
- The referring page or campaign that brought you to the site, where the browser supplies it.
- A shortened or masked network address retained for security monitoring and abuse prevention.
3.3 Information in administration documents
Board minutes, registers and filings frequently contain personal data: names of directors, signatures, residential addresses, dates of appointment and, where the law requires it, identification details. We process that information because an administration task cannot be performed without it, and we store it under the custody discipline described later in this policy.
We do not deliberately collect special category data such as health information, biometric data or political opinions. If a document supplied for a task includes such information, we treat it with the same care as the rest of the file and we do not use it for any purpose other than the task.
4. Lawful basis for processing
We rely on a small number of lawful grounds, and we match each ground to the activity it supports so that the reason for processing is easy to identify.
| Activity | Ground of processing |
|---|---|
| Responding to an enquiry sent through the website or by email | Steps taken at your request before entering a contract, and our legitimate interest in answering business correspondence |
| Managing an administration engagement | Performance of a contract with the client company |
| Preparing statutory filings and maintaining required registers | Compliance with a legal obligation |
| Keeping the seal custody log and the minute book | Performance of a contract and our legitimate interest in defending the company and its clients |
| Website security and abuse prevention | Our legitimate interest in keeping the service available and safe |
| Optional updates about filing season windows | Your consent, which can be withdrawn at any time |
Where we rely on legitimate interest, we have assessed that the interest is proportionate and that the activity does not override the privacy of the people concerned. You may object to that processing at any time using the contact details in this policy, and we will stop unless a compelling legal ground requires us to continue.
5. Purposes of use
We use personal data for the following purposes and for no others without first informing you.
- To read and answer an enquiry, and to arrange a call, an office visit or a signature session.
- To open a file, confirm the parties, and record the scope of an administration engagement.
- To draft agendas, minutes and resolutions that name the correct people in the correct roles.
- To maintain the seal custody log and the register of members, including the history of each change.
- To prepare, check and lodge annual filings, and to keep the corresponding receipts.
- To receive statutory mail at the registered office and forward it to the responsible director.
- To run compliance calendar reviews and issue written status notes to directors.
- To meet accounting, tax, audit and anti money laundering obligations that apply to the company.
- To detect and prevent fraud, misuse of the website and unauthorised access to records.
- To comply with a court order, a regulator request or another binding legal requirement.
We do not sell personal data, we do not run advertising networks on this website, and we do not use personal data to build consumer profiles for resale.
6. Board records and company documents
Board records deserve their own explanation because they are rarely simple. A single minute can name a director, describe a decision, record a conflict of interest and attach a financial schedule. When we receive that material we treat the whole document as a confidential record of the client company, not as a marketing asset and not as open text that can be reused elsewhere.
Access inside the office is limited to the administrator assigned to the file and to directors of Jilly International (Hong Kong) Limited who need to review the work for quality or legal reasons. Each access to a restricted folder is logged with the date, the person and the reason when the folder is held in a shared records system.
We keep the sequence of a minute book intact. A correction is written as a new entry that refers to the original rather than as a silent change to the older page. That practice protects the people named in the record as much as it protects the company, because it shows exactly when a decision was made and when it was later corrected.
Records supplied for an administration task are never repurposed for advertising, training of public models, publication or resale. They are handled for the engagement, retained for the period described in this policy and then destroyed under a documented schedule.
9. Service providers and processors
Like most small professional offices we rely on a short list of suppliers. Each supplier receives only the data needed for its function and is bound by confidentiality and security terms.
The categories are: a website hosting provider that serves the static pages, an email provider that carries correspondence to and from the office, a records storage provider that holds scanned documents for engaged files, and an accounting tool used for invoicing. We review these suppliers when an agreement is renewed and we ask for evidence of access control, encryption and incident handling.
We do not permit a supplier to use client data for its own marketing, product development or model training. Where a supplier cannot accept that restriction, we choose another supplier.
10. International transfers
The office is in Hong Kong and most processing happens there. Some suppliers operate infrastructure in other regions, and some client groups have advisers in other countries. Where personal data leaves Hong Kong we take reasonable steps to keep protection equivalent to the standards described in this policy.
Those steps can include written contractual terms that require confidentiality, access control and breach notification, a review of the legal environment in the destination region, and a preference for suppliers that allow the office to choose a storage region. Where a client instructs us to send material to a particular adviser abroad, the client confirms that it has a lawful basis for that transfer.
You may ask for more information about the safeguards used for a specific transfer by writing to the contact address in this policy.
11. Retention of records
Retention follows the character of the record rather than a single blanket period. Business enquiries that do not become engagements are kept for a limited period and then deleted. Engaged files are kept for the period that company law, tax law and professional practice expect, and for the additional period needed to defend a legal claim.
| Record type | Indicative retention |
|---|---|
| Website enquiry that does not become an engagement | Up to 24 months from the last contact |
| Correspondence on an engaged file | 7 years from the end of the engagement |
| Board minutes and resolution books | Permanent, or the life of the company plus 7 years |
| Seal custody log | 7 years after the last entry |
| Register of members and share certificate history | Permanent, or the life of the company plus 7 years |
| Filing receipts and acknowledgments | 7 years from the filing date |
| Invoicing and tax records | 7 years from the end of the accounting period |
When a retention period ends, records are destroyed in a way that prevents reconstruction: digital files are deleted from live systems and from backups on the next rotation, and paper is shredded under a documented destruction log. Where a legal hold applies, destruction is suspended for the affected records until the hold is released.
12. Security measures
Security is treated as a daily practice rather than a statement. The office uses access control on workstations, full disk encryption on portable devices, separate accounts for each administrator and a written custody procedure for paper records.
Scanned documents are stored in a restricted folder with permission limited to the assigned administrator. Movement of a paper file is entered in a simple register so that a missing document can be traced to a person and a date. Backups are taken regularly and a restore test is carried out at planned intervals.
Visitors to the board room are met at reception, accompanied while in the record area and asked to sign the visit log. Documents released to a visitor are listed on a handover slip signed by both parties.
No system is perfect. If we become aware of a security incident that affects personal data, we investigate promptly, contain the issue, notify affected people where the law requires it and record the lessons in the internal procedure.
13. Your privacy rights
Subject to the law that applies to you, you may exercise the following rights in relation to the personal data we hold about you.
- Access. Ask whether we hold your data and receive a copy of it, with a short explanation of how it is used.
- Correction. Ask us to correct data that is inaccurate or incomplete.
- Deletion. Ask us to delete data where we no longer need it and no legal duty requires us to keep it.
- Restriction. Ask us to pause processing while a question about accuracy or lawfulness is resolved.
- Objection. Object to processing based on legitimate interest, and to direct marketing at any time.
- Portability. Receive data that you provided in a structured and commonly used format where the law provides that right.
- Withdrawal of consent. Withdraw a consent previously given, without affecting processing already carried out.
Send a request to admin@kawingholdings.lol with enough detail for us to identify the record. We respond within one month and may ask for a document that confirms your identity where the record is sensitive. There is no fee for an ordinary request. If a request is manifestly unfounded or excessive, we may charge a reasonable administrative fee or decline the request and explain the reason.
Where a client company is the controller of a board record, we forward the request to that client and assist it in answering. We tell you when a request has been passed on.
14. Marketing and communications
We send service updates only to people who ask for them, and every update carries a simple way to stop receiving it. Enquiries, filing reminders and administration correspondence are not marketing and are sent because a task or a legal duty requires them.
We do not buy contact lists, we do not rent email addresses and we do not add a client director to an outside mailing list without that person asking to be added. If you would like to receive the short filing season note described on this website, ask the administrator to add you, and you can ask to be removed at any time.
15. Privacy for Children
This website and the administration service are intended for businesses and their officers. They are not directed at children, and we do not knowingly collect personal data from a child.
A board record may occasionally name a minor in a family holding context, for example where a trust structure is described. In that case the information arrives as part of a client document, is handled under the confidentiality rules in this policy and is never used for a purpose of our own.
If you believe that a child has sent personal data to the office through the website, write to admin@kawingholdings.lol and we will remove the data from the enquiry system without delay.
16. Third party websites
The website contains a small number of links to other websites, including links in this policy. Those websites are governed by their own privacy notices, which may differ from this policy. We do not control the content or the data practices of another organisation and we cannot accept responsibility for them.
When you follow a link to a third party site, read the privacy notice on that site before submitting personal data. If a link from this website appears to point to an unexpected destination, tell us so that we can correct it.
17. Automated decisions and profiling
We do not make decisions with legal or similarly significant effects about you through automated means. The administration work is carried out by a person who reads the file and writes the record.
The website uses simple scripts to show content as you scroll and to prepare a message for your email application. Those scripts do not assess you, do not score you and do not create a profile of your behaviour for a third party.
If we introduce a tool that changes this position, we will describe the tool, its purpose and its logic in this section before it is used for any decision about a person.
18. Breach notification
If a breach of security leads to accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal data, the office activates its incident procedure immediately. The first step is containment: access is revoked, affected devices are isolated and the scope of the exposure is established.
Where the breach is likely to result in a risk to the rights of the people concerned, we notify those people without undue delay and describe what happened, what we have done and what they can do to reduce the risk. Where a regulator must be informed under applicable law, we make the notification within the required period.
Every incident is recorded in an internal register with the timeline, the cause, the corrective action and the owner of the follow up. The register is reviewed at the next compliance calendar review so that a repeated cause is treated as a process failure rather than an accident.
19. Changes to this policy
We review this policy at least once a year and whenever the service, the suppliers or the law change in a material way. The effective date at the top of the page is updated when a new version is published, and the version number is increased.
Where a change affects the way personal data is used for an existing engagement, we tell the directors of the client company in writing before the change takes effect. Older versions are retained in the records system so that a person can see what the policy said when their data was collected.
Continued use of the website after a new version is published indicates that you have read the updated policy. Where the law requires a fresh consent for a new use, we ask for that consent separately rather than relying on continued use.
20. How to contact us
Write to the records office with any question, request or complaint about privacy. Please include the name of the company or the engagement so that the administrator can find the right file.
Jilly International (Hong Kong) Limited
Rm 1303 13/F YF Life Centre, 38 Gloucester Rd, Wan Chai, Hong Kong - 999077, Hong Kong (HK)
Email: admin@kawingholdings.lol
Phone: +15673500109
If you are not satisfied with our answer, you may raise the matter with the privacy regulator in the jurisdiction where you live or work. We will cooperate with a regulator inquiry and provide the records it lawfully requests.
This policy is published in English. Where a translation is provided for convenience, the English text governs the meaning of the policy.