Privacy Policy

This Privacy Policy explains how Cognus Limited ("Cognus", "we", "us" or "our") collects, uses, shares and protects personal data when you visit www.cognus.asia (the "Website"), contact us, or deal with us in the course of our business.

For the purposes of the EU General Data Protection Regulation (EU) 2016/679 ("GDPR") and, where applicable, the UK GDPR, Cognus Limited is the controller of your personal data. For the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) of the Hong Kong Special Administrative Region ("PDPO"), Cognus Limited is the data user.

Cognus Limited Suite 9–11, 16/F Tai Yau Building, 181 Johnston Road, Wanchai, Hong Kong
Dubai office: IFZA Business Park, DDP, Dubai, United Arab Emirates Email: info@cognus.asia

[EU representative (Article 27 GDPR), if required: name and address to be inserted.]

This policy applies to personal data of website visitors, people who send us enquiries, clients and prospective clients and their representatives, counterparties, introducers and other business contacts. It does not apply to third-party websites linked from our Website.

Information you give us: your name, email address, telephone number, company, job title, the content of your messages, and any information you share with us in meetings or correspondence.

Information collected automatically: when you use the Website we collect technical information such as your IP address, browser and device type, pages visited, referring website and the date and time of your visit. Analytics information is collected only if you have consented to analytics cookies (see Section 12 and our Cookie Policy).

Information from other sources: professional information about you from publicly available sources (such as company websites, professional networking profiles and public registers), and from people who introduce you to us.

We do not intentionally collect special categories of personal data (such as data about health, religion or political opinions). Please do not send us such data through the Website.

We use your personal data only for the purposes below, or for purposes directly related to them. Where the GDPR applies, we rely on the legal bases shown.

Where we rely on legitimate interests, we have considered that those interests are not overridden by your rights and interests. You may ask us for more information about this balancing assessment.

Under the PDPO, we collect personal data by lawful and fair means, only for the purposes stated above, and we will not use your personal data for a new purpose without your prescribed consent.

We will only use your name and email address to send you insights, updates and invitations to events about our advisory services if you have given your consent - for example by ticking the optional box on our contact form. We do not sell or provide your personal data to others for their direct marketing. You may withdraw your consent at any time, free of charge, by using the unsubscribe link in any email or by writing to info@cognus.asia.

We may share your personal data with:

• our partners and staff, and any affiliated Cognus entities, in Hong Kong, the United Arab Emirates and Europe, who need it to handle your enquiry or engagement;
• service providers acting on our behalf, such as website hosting, email, cloud storage, customer-relationship management and (with your consent) analytics providers, under contracts that require them to protect your data and use it only on our instructions;
• professional advisers such as lawyers, auditors and insurers;
• counterparties, co-advisers or other parties to a transaction, only where you have asked us to or where this is necessary to carry out your instructions;
• courts, regulators, law-enforcement or other public authorities where required by law; and
• a purchaser or successor in the event of a reorganisation, merger or sale of our business, subject to equivalent confidentiality obligations.

We do not sell your personal data.

Because we operate from Hong Kong, the United Arab Emirates and Europe, your personal data may be transferred to, stored in and accessed from those jurisdictions and the countries where our service providers are located.

Where personal data subject to the GDPR or UK GDPR is transferred outside the European Economic Area or the United Kingdom, we ensure an adequate level of protection by relying on an adequacy decision or by putting in place appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant).

For personal data subject to the PDPO, we take all reasonable precautions and exercise due diligence to ensure that personal data transferred outside Hong Kong is protected to a standard comparable to the PDPO, including by using contractual clauses consistent with the recommended model contractual clauses of the Privacy Commissioner for Personal Data.

You may request a copy of the relevant safeguards by writing to info@cognus.asia.

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, regulatory, tax and accounting requirements:

• enquiries that do not lead to an engagement: up to [24 months] from our last contact;
• client, engagement and transaction records: for the duration of the engagement and for [7 years] after it ends;
• marketing preferences: until you withdraw your consent or unsubscribe;
• analytics data: up to [14 months];
• cookies: as set out in our Cookie Policy.

After these periods we securely delete or anonymise the data.

We take appropriate technical and organisational measures to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. These include access controls, encryption in transit, confidentiality obligations for our partners and staff, and due diligence on our service providers. No internet transmission is completely secure; please do not send confidential or price-sensitive information through the Website contact form.

If a personal data breach occurs, we will notify the competent supervisory authority where required by the GDPR (without undue delay and, where feasible, within 72 hours), notify the Office of the Privacy Commissioner for Personal Data and affected individuals as appropriate, and inform you directly where the breach is likely to result in a high risk to you.

Under the GDPR and UK GDPR, you have the right to: access your personal data; have inaccurate data corrected; have your data erased; restrict or object to our processing (including an absolute right to object to direct marketing); receive your data in a portable format; and withdraw your consent at any time, without affecting processing carried out before withdrawal. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Under the PDPO, you have the right to request access to, and correction of, your personal data held by us. We will respond to a data access or correction request within 40 days. We may charge a fee for complying with a data access request, which will not be excessive.

To exercise any of these rights, write to info@cognus.asia with the subject line "Data Protection Request", or by post to the Privacy Officer, Cognus Limited, at the Hong Kong address above. We may need to verify your identity before responding. For GDPR requests we will respond within one month, which may be extended by up to two further months for complex requests; we will tell you if this is the case.

If you have concerns about how we handle your personal data, please contact us first at info@cognus.asia so we can try to resolve them. You also have the right to lodge a complaint with:

• the data protection supervisory authority in the EU/EEA country where you live, work or where the alleged infringement took place (or, in the UK, the Information Commissioner's Office); or
• the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).

We use strictly necessary cookies to operate the Website. We use analytics cookies only with your consent. You can accept, reject or change your choices at any time through "Cookie settings" in the footer of every page. Details are in our Cookie Policy.

Our Website and services are intended for business professionals and are not directed at individuals under 18. We do not knowingly collect personal data from children.

Our Website may link to websites operated by others. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

We may update this Privacy Policy from time to time. The "Last updated" date at the top shows when it was last revised. Where changes are significant, we will take reasonable steps to let you know.

Privacy Officer, Cognus Limited Suite 9–11, 16/F Tai Yau Building, 181 Johnston Road, Wanchai, Hong Kong Email: info@cognus.asia