Statutory ComplianceHC BUSINESS LIMITED (BRN: 66820292-000)V2.7 (2026 Certified)

Privacy Policy & PICS Statement

Statutory Personal Data Protection Notice under PDPO Cap. 486, GDPR, PIPL & the Companies Ordinance New Inspection Regime

Effective Date: 2026-10-24·Jurisdiction: Hong Kong SAR
简繁EN
Table of Contents

1. Overview & Data Controller Identity

HC BUSINESS LIMITED (BRN: 66820292, TCSP License: TC006431) operates 86hc.com in strict accordance with the six Data Protection Principles (DPPs) set out in Schedule 1 of the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO) of the Hong Kong Special Administrative Region, the European Union General Data Protection Regulation (GDPR 2016/679), and the Personal Information Protection Law (PIPL) of Mainland China.

This Privacy Policy explains how HC BUSINESS LIMITED collects, stores, processes, protects, and discloses personal information submitted by users or lawfully compiled from statutory public registers, and establishes our operational protocols for compliance oversight.

2. Personal Information Collection Statement (PICS)

🔒 Statutory PICS Mandatory Notice (Under PDPO DPP 1 & DPP 5):

When you submit due diligence inquiries, download corporate filings, contact compliance advisors, or register on 86hc.com, we collect your name/salutation, contact telephone/WhatsApp/WeChat ID, corporate email address, corporate inquiry targets (entity names and registration numbers), payment transaction identifiers, and network access logs (including IP addresses, browser User-Agent strings, and timestamp signatures).

Statutory Purposes of Collection:

  1. Verifying, processing, and digitally delivering the statutory registry archives and due diligence reports ordered by you;
  2. Customer service follow-up, corporate account management, and statutory invoicing / receipt issuance;
  3. Defending platform data infrastructure against malicious scraping, brute-force crawling, and maintaining cybersecurity audit logs;
  4. Fulfilling statutory recordkeeping and tax accounting requirements mandated under Section 51C of the Inland Revenue Department Ordinance (Cap. 112).

Classes of Transferees: Collected data may be disclosed only to: (i) competent regulatory and law enforcement authorities where mandated by court orders or statutory subpoenas; and (ii) cloud hosting and cybersecurity vendors bound by strict non-disclosure and security processing covenants.

Voluntary Provision & Data Access Rights: Providing contact parameters is voluntary; however, failure to provide valid contact details will prevent electronic order delivery. You have the statutory right under Sections 18 and 22 of the PDPO to request access to and correction of your personal data held by us by contacting our Compliance Desk at compliance@86hc.com. Such requests are processed within the statutory 40-day timeframe.

3. Companies Registry New Inspection Regime & Statutory Redaction Shield

Pursuant to the phased implementation of the New Inspection Regime under the Companies Ordinance (Cap. 622) between 2021 and 2023, 86hc.com enforces strict technical redaction of "Protected Information":

  • Mandatory Identification Number Masking: For all natural person directors, company secretaries, and shareholders appearing in public registry filings, Hong Kong Identity Card (HKID) and foreign passport numbers are strictly masked (e.g., A123***(X)). Full 8- or 9-digit identification numbers are strictly prohibited from public presentation on our platform;
  • Usual Residential Address Privacy: Personal residential addresses of natural person corporate officers are concealed. The platform strictly discloses statutory Registered Office Addresses or official Correspondence Addresses as permissible under statutory inspection frameworks;
  • Refusal of Unmasked Requests: The Platform strictly refuses any non-statutory requests from commercial users to unmask protected identification numbers or residential addresses, except upon presentation of a valid HKSAR Court Order or specified regulatory authorizations.

4. Anti-Doxxing Compliance Shield & Criminal Penalties under Section 64

Section 64 of the Personal Data (Privacy) Ordinance (Cap. 486) as amended introduces severe criminal penalties for doxxing offenses:

  • Section 64(3A) Offense: Disclosing personal data without the data subject's consent, with intent to cause specified harm (or being reckless as to whether harm would be caused), is punishable by a fine of up to HK$ 100,000 and imprisonment for 2 years;
  • Section 64(3C) Aggravated Offense: Where such unauthorized disclosure actually causes specified harm to the data subject or their family members, the offense is punishable by a fine of up to HK$ 1,000,000 and imprisonment for 5 years.

Zero Tolerance Protocol: Corporate records on 86hc.com are made available strictly for legitimate commercial due diligence. Any attempt to harvest or compile personal data from our platform for doxxing, harassment, unlawful debt collection, or malicious disclosure will result in immediate IP termination, digital forensic logging, and direct criminal referral to the Office of the Privacy Commissioner for Personal Data (PCPD) and the Hong Kong Police Force.

5. Cookies, Security Tokens & Transactional Electronic Messages (Cap. 593)

86hc.com employs strictly necessary session cookies and cryptographic tokens to deliver platform services:

  • Essential Session Cookies: Retaining your selected language preferences (EN/TC/SC), dark/light UI theme states, and temporary order extraction tokens across query pages;
  • Anti-Abuse Verification Tokens: Cryptographic challenge tokens generated by our 4A gateway to detect automated scrapers, headless browsers, and credential-stuffing bots;
  • No Third-Party Advertising Trackers: We do NOT sell user browsing behaviors to third-party ad networks or data brokers. You may disable cookies in your browser settings; however, disabling essential session tokens will impair the retrieval of ordered dossiers;
  • Transactional Electronic Messages Exemption & Opt-Out Right (Cap. 593 & Cap. 486 s.35C): One-time passwords (OTP), Magic Links, order confirmation receipts, and PDF filing fulfillment emails dispatched via service@86hc.com constitute transactional service communications exempt under Schedule 1 of the Unsolicited Electronic Messages Ordinance (Cap. 593). Where you voluntarily submit an inquiry for corporate secretarial or banking advisory follow-up, any subsequent communication strictly complies with Cap. 593 and Part 6A of the PDPO (Cap. 486), and you may exercise your unconditional right to opt out (Unsubscribe) at any time free of charge via the unsubscribe link or by emailing compliance@86hc.com.

6. Cryptographic Security & Statutory 7-Year Accounting Retention

Customer inquiry logs and order transmission tokens are encrypted using financial-grade AES-256 encryption at rest and transmitted over TLS 1.3 protocol with Perfect Forward Secrecy (PFS). Payment processing is executed directly by PCI-DSS Level 1 certified gateways (Stripe / Alipay / Apple Pay); HC BUSINESS LIMITED never stores complete credit card numbers or security CVV codes.

Under Section 51C of the Hong Kong Inland Revenue Ordinance, business transaction and invoicing records are retained for a statutory minimum of 7 years, after which they are systematically purged or irreversibly anonymized.

7. Third-Party Infrastructure & Cross-Border Data Transfers (GDPR SCCs & PIPL)

HC BUSINESS LIMITED does not sell, rent, or trade your personal data. For technical service delivery and DDoS mitigation, data is processed through verified cloud infrastructure providers (including Tencent Cloud Hong Kong Tier-3+ facilities).

For transfers involving data subjects residing in the European Economic Area (EEA), cross-border processing is governed by the European Commission's Standard Contractual Clauses (SCCs). For transfers involving Mainland China users, processing adheres to statutory transfer frameworks under the Personal Information Protection Law (PIPL).

8. Data Subject Rights & 48-Hour Dispute Redress SLA

Subject to exemptions under the PDPO and GDPR (including data maintained in statutory public registers established by enactment), data subjects enjoy:

  • Right of Access & Correction: Requesting access to personal records held by the platform and correcting inaccurate entries;
  • Right to Statutory Masking: Verified corporate representatives and data subjects may apply for technical delisting or masking under verified statutory grounds (dissolved status, settled litigation, or identity theft) via our Data Objection Portal;
  • 48-Hour Compliance SLA: Our compliance team evaluates authentic documentation within 24 to 48 hours, and executes database rectification and cache purges within 5 business days;
  • Right to Complain: Right to lodge formal complaints with the Privacy Commissioner for Personal Data (PCPD) at complaints@pcpd.org.hk.

9. Protection of Minors

86hc.com is a commercial corporate intelligence portal designed exclusively for enterprise compliance, legal professionals, and commercial entities. We do not knowingly collect personal data from minors under the age of 18. If we discover that personal data of a minor has been provided without verified parental consent, we will promptly delete such information from our active databases.

10. Data Protection Officer (DPO) Contact Details

For questions or formal rights requests concerning this policy or statutory rights under PDPO, GDPR, or PIPL, please contact our Compliance & Data Protection Officer at:

HC BUSINESS LIMITED
Attn: Data Protection Officer (Legal & Compliance Division)
Registered Office: Unit 801, 8/F, Chevalier House, 45-51 Chatham Road South, Tsim Sha Tsui, Kowloon, Hong Kong
Compliance Hotline: +852 2136 1626
Official Compliance Email: compliance@86hc.com
Online Verification & Redress Desk: 86hc.com/en/data-correction

HC BUSINESS LIMITED · Legal & Compliance Division
Corporate Compliance Verification Seal · Registered in Hong Kong SAR
© 2026 86hc.com · HC BUSINESS LIMITED All Rights Reserved.