Privacy Policy

GoldenStone Specialty Limited (“GoldenStone”, “we”, “us” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, transfer, retain and protect personal data when you visit our website, use the website contact form or otherwise communicate with us through the website.

This Privacy Policy applies only to the GoldenStone website. It does not apply to information collected through recruitment, employment or other processes conducted outside the website, which may be covered by separate notices.

For personal data submitted directly through the website, GoldenStone determines why and how that data is used and acts as the relevant data user, controller or personal information processor to the extent provided by applicable law.

Information you provide

When you use the website contact page to prepare an email draft or submit an enquiry through Formspree, we may collect:

• your name;
• your company or organisation name;
• your work email address;
• the enquiry type and message content; and
• other information you choose to provide in the communication.

The draft feature processes the information you enter in your browser. Information is transmitted to the relevant email or form service provider and GoldenStone only when you choose to send the email or submit the form.

Please provide only the information reasonably necessary for your enquiry. Do not submit identity documents, payment details, medical information, confidential insurance records, detailed risk files or claims documents through the website or general email.

Technical information

When you visit the website, the website or its service providers may automatically process limited technical information, including:

• IP address;
• browser and device type;
• operating system;
• pages requested and referring page;
• date and time of access;
• basic server, security and error logs; and
• information needed to detect spam, misuse or malicious activity.

We may use website personal data to:

• operate, deliver, maintain and secure the website;
• receive, classify and respond to website enquiries;
• route an enquiry to the appropriate person within GoldenStone;
• communicate with you about your enquiry;
• detect and prevent spam, fraud, misuse and security incidents;
• troubleshoot technical problems and improve website performance;
• maintain necessary website and correspondence records;
• comply with applicable legal and regulatory obligations; and
• establish, exercise or defend legal rights relating to the website.

Information submitted through the website does not create insurance or reinsurance cover or constitute a formal contractual notice.

We collect and use website personal data only for lawful purposes directly related to GoldenStone's functions or activities, and collect it by means that are lawful and fair.

Personal data collected is limited to what is adequate but not excessive for the relevant purpose. We will not use it for a new purpose unrelated to the original collection purpose unless prescribed consent has been obtained or applicable law otherwise permits.

Providing information for a website enquiry is voluntary. If you do not provide information needed to respond, we may be unable to process or answer your enquiry.

We may allow authorised GoldenStone personnel and trusted service providers to process website personal data where reasonably necessary for website hosting, content delivery, security, font delivery, email delivery, technical maintenance or professional advice.

The website uses:

• Cloudflare, for website hosting, content delivery, performance and security;
• Google Fonts, for loading website typography and related technical delivery; and
• Microsoft 365, to receive and process email; and
• Formspree, to process and route website contact-form submissions.

These service providers may process limited technical data, email content or form information under their service arrangements and privacy terms.

We may also disclose personal data where required by applicable law, a court order or a competent authority, or where reasonably necessary to protect the rights, safety or security of GoldenStone, website users or others. We do not sell personal data collected through the website.

The website may be accessed from Hong Kong, Mainland China and other countries or regions. GoldenStone and its website service providers may process or store website personal data in Hong Kong or another jurisdiction in which they operate.

Where personal data is transferred across borders, we will take measures required by applicable law having regard to the website's actual data flow. These measures may include providing additional information, obtaining consent or separate consent where required, applying contractual protections, conducting an impact assessment or using another lawful transfer mechanism.

If you submit personal information from Mainland China, that information may be transferred to and processed in Hong Kong or another location outside Mainland China for the website purposes described in this Policy. Where separate consent is required by applicable law, it will be requested separately through the relevant website process.

We do not currently use advertising cookies, behavioural analytics cookies, heat-mapping tools, session-recording tools or retargeting pixels on the website.

The website or its service providers may use strictly necessary cookies, technical storage or similar technologies for security, network delivery, form handling and core website functionality. Blocking these technologies may affect the operation or security of parts of the website.

If we introduce non-essential analytics, advertising or tracking technologies, we will update this Privacy Policy and implement an appropriate cookie notice or consent mechanism before those technologies are enabled.

We do not currently use information submitted through the website contact form for direct marketing.

If this changes, we will provide any notice and obtain any consent required by applicable law before using the information for direct marketing. Any direct-marketing communication will include an appropriate method to opt out.

We retain contact-form submissions, related correspondence, technical logs and security records only for as long as reasonably necessary for the purposes described in this Privacy Policy, including responding to enquiries, maintaining website security, complying with applicable requirements and handling disputes.

When personal data is no longer reasonably required, we will delete or anonymise it, or securely restrict further use where deletion is not immediately possible because of backup, legal or technical requirements.

We use reasonable administrative, technical and organisational measures intended to protect website personal data against unauthorised access, accidental loss, misuse, alteration or disclosure. These measures may include access controls, secure account management, service-provider controls, encryption in transit, system monitoring and appropriate deletion procedures.

No internet transmission or electronic storage system can be guaranteed to be completely secure. If you believe personal data submitted through the website may have been compromised, please contact us promptly using the details below.

The website is intended for business and professional users and is not directed to children. Please do not submit personal data about a child through the website.

Depending on the law applicable to you, you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data in applicable circumstances;
• request restriction of or object to certain processing;
• withdraw consent where processing is based on consent;
• request information about recipients or cross-border processing; and
• make a complaint to a competent privacy or data-protection authority.

We may need to verify your identity and authority before acting on a request. Rights may be subject to lawful limitations or exceptions. To exercise a right concerning website personal data, use the company's contact details in section 15.

The website may contain links to third-party websites. GoldenStone does not control and is not responsible for the content, security or privacy practices of third-party websites. Please review the relevant third party's privacy notice before providing personal data.

We may update this Privacy Policy to reflect changes to the website, its service providers or applicable requirements. The latest version and its effective date will be published on this page. If a material change requires consent under applicable law, we will seek that consent through an appropriate method.

GoldenStone Specialty Limited

Email: enquiries@goldenstonespecialty.com

When you use the website contact page:

• the information is used to receive, route and respond to your enquiry, maintain website and email security, and keep necessary correspondence records;
• email drafts are prepared only in your browser; if you choose to submit a form through Formspree, the information is transmitted to Formspree and GoldenStone;
• providing information is voluntary, but we may be unable to respond if necessary information is not provided;
• authorised GoldenStone personnel and hosting, security, font and email service providers may process the information where reasonably necessary;
• the information may be processed outside your location as described in section 6; and
• you may request access to or correction of your personal data using the company's contact details in section 15.

Before sending an email or submitting a form, please confirm that you have read this Privacy Policy. Any additional consent required by applicable law will be requested separately.