Acton Advisory Limited

1. Who We Are

Acton Advisory Limited is a fee accounting practice that keeps engagement ledgers, invoice runs and retainer reconciliations for professional and technical services firms. The company is registered in Hong Kong and operates from Rm 702 7/F Fu Fai Coml Ctr, 27 Hillier St, Sheung Wan, Hong Kong - 999077, Hong Kong (HK). For the purposes of this policy, Acton Advisory Limited is the data controller of the personal data described below, and the firm decides why and how that data is processed.

The website and its supporting materials were built and are maintained by the developer known as Acton Advisory, who acts on behalf of the company and who can be reached through the contact points listed at the end of this policy. Where this policy says we, us or our, it refers to Acton Advisory Limited and to the people who work at the fee desk on the company behalf.

We are a small practice, and the person responsible for data protection matters is the partner who supervises the Hillier Street desk. That person can be contacted by post at the address above, by email at billing@recodatech.lat or by telephone at +17432125027 during posted business hours.

2. Scope of This Policy

This policy covers personal data that we collect through the website, through correspondence, through the engagement process and through the administration of fee records. It applies to current clients, former clients, prospective clients, suppliers, subcontractors and any person who contacts the desk for any reason.

This policy does not cover personal data that we may handle on behalf of a client as part of a fee accounting engagement, where the client remains the controller of that data. In those cases we act as a processor, we follow the written instructions of the client, and any request about the data itself should be directed to that client in the first instance.

The policy also does not cover the practices of third party websites that may be reached through links on our pages. Those websites operate under their own privacy notices, and we encourage you to read them before providing personal data.

3. Personal Data We Collect

We collect only the personal data that is needed to run the fee desk and to answer the enquiries that reach it. The categories below describe what we may hold at any given time.

Contact and identity data

This includes names, job titles, employer names, business email addresses, business postal addresses, telephone numbers and any other details you choose to send when you write to us, call us or complete the contact form on the website.

Engagement and billing data

This includes the engagement terms, the counting definition recorded in a ledger bay, invoice numbers and dates, retainer balances, disbursement receipts, write-off notes and the correspondence that explains a billing decision. Where a client contact is named on an invoice, that person name and business details form part of the billing record.

Technical and usage data

This includes the internet protocol address from which a page is requested, the browser type and version, the operating system, the referring page and the times at which pages are viewed. This data is collected through server logs and is used to keep the website available and secure.

Correspondence data

This includes the content of emails, letters, call notes and messages exchanged with the desk, together with the date and time of each exchange and the identity of the people involved.

Financial and anti-fraud data

This includes bank details provided for payment, purchase order references, credit check results where a client has agreed to such checks, and records of unpaid or disputed amounts. We do not store full payment card numbers on our own systems.

4. Sources of Personal Data

Most of the personal data we hold comes directly from the person concerned. You give us data when you send an email, call the desk, complete the contact form, sign an engagement letter or provide a receipt for a disbursement.

We also receive data from client organisations, which may provide the names and business details of the contacts who will work with the desk. We receive data from banks and payment providers in the course of settling invoices, and from professional advisers who are involved in a matter. In limited cases we receive data from public registers, such as company registries, where it is needed to confirm a client identity before an engagement opens.

Technical data is generated automatically when a browser requests a page from our servers. We do not buy personal data from data brokers, and we do not enrich our records with marketing profiles obtained from third parties.

5. How We Use Personal Data

We use personal data for the following purposes, and for no others without first telling you.

• To respond to enquiries, scoping questions and requests for a desk review.
• To open an engagement ledger bay and to administer the engagement from the Hillier Street desk.
• To prepare, issue and reconcile invoices, retainer statements and closing packs.
• To verify disbursement receipts and to record pass-through costs correctly.
• To trace write-offs and to prepare the reasoning behind each one.
• To keep accounting, tax and statutory records as required by applicable law.
• To prevent fraud, to manage credit risk and to recover amounts that are overdue.
• To keep the website secure, to diagnose faults and to improve its usability.
• To comply with legal obligations, court orders and requests from a competent authority.

Where we wish to use personal data for a purpose that is not listed above, we will contact the person concerned before doing so and will explain the new purpose in plain language.

6. Lawful Basis for Processing

We rely on one or more of the following lawful bases when we process personal data.

Performance of a contract

We process contact, engagement and billing data because it is necessary to perform the agreement we have with a client, or to take steps at the request of a prospective client before that agreement is signed.

Legitimate interests

We process technical, correspondence and anti-fraud data because we have a legitimate interest in keeping the desk secure, preventing fraud and running an efficient practice. We balance that interest against the rights of the people concerned and we limit the processing to what is needed.

Legal obligation

We process accounting and tax records because the law requires us to keep them for a defined period and to make them available to the relevant authorities on request.

Consent

Where we rely on consent, for example for an optional marketing message, we will ask for that consent separately and we will keep a record of when it was given. Consent can be withdrawn at any time, and withdrawal does not affect processing that happened before the withdrawal.

7. Engagement and Fee Records

The fee desk keeps a written record of every engagement, and that record can include the names and business details of the people who approved a scope, signed an invoice or queried a charge. We treat those names as personal data and handle them with the same care as any other category in this policy.

A ledger bay is designed to explain itself. That design choice means a bay may hold correspondence, approval notes and reasons for a write-off, all of which can mention individuals. We keep those notes factual and limited to what is needed to defend a billing decision, and we avoid recording opinions about character or performance.

Where a client asks us to remove a person name from a bay while the engagement is still open, we will explain the effect on the records and, if removal would make the bay unable to explain itself, we will offer an alternative such as masking the name while keeping the role. Where the law requires us to retain a record, we will keep it and restrict access to it rather than delete it.

8. Cookies and Similar Technologies

Our website is deliberately light and does not set advertising cookies. We use only the small amount of browser storage that is needed for the site to function, such as remembering that a navigation panel is open during a visit. These items are not used to build a profile of you and they are removed when the browser session ends.

Server software may create short lived log entries that record the address and browser of each request. Those logs help us detect abuse and diagnose faults. They are retained for a limited period and are not shared with advertising networks.

If we ever introduce analytics that identify individuals, we will update this policy, provide a clear notice on the website and, where the law requires it, ask for consent before the tool is activated.

9. How We Share Personal Data

We do not sell personal data. We share it only where there is a clear reason and, wherever possible, only with the knowledge of the person concerned.

• With the client organisation itself, where a contact from that organisation needs to see the engagement or billing record.
• With banks and payment providers, to settle invoices and reconcile receipts.
• With the accountant or tax adviser who supports the statutory records, under a duty of confidentiality.
• With the hosting provider that serves the website, under a written data processing agreement.
• With a court, regulator or law enforcement body, where the law compels disclosure and we are satisfied that the request is valid.
• With a successor organisation, if the practice is ever transferred, in which case the successor will be bound by the terms of this policy for existing data.

When we share data with a processor, we require the processor to protect it, to use it only for the stated purpose and to return or delete it at the end of the engagement.

10. Service Providers and Processors

The fee desk relies on a small number of service providers to keep operating. Those providers may include a website host, an email provider, an accounting platform and a secure file storage service. Each provider is chosen for its security posture, and each is bound by a written agreement that sets out its obligations.

We review our processors at least once a year. The review checks whether the provider still meets our requirements, whether it has suffered a relevant security incident and whether the location of its data storage has changed. Where a provider no longer meets our standard, we migrate the data to a replacement and confirm the deletion in writing.

Processors do not have the right to use our data for their own marketing and do not have the right to sell it. Where a processor must engage a sub-processor, the processor must obtain our written approval and must impose the same obligations on the sub-processor.

11. International Transfers

Acton Advisory Limited operates from Hong Kong, and most of our records are held there. Some of our service providers store data in other jurisdictions, and a client or contact may be located outside Hong Kong. When personal data moves across a border, we take steps to ensure that it continues to receive protection that is at least comparable to the protection described in this policy.

Those steps may include a written contract with standard protections, an assessment of the legal environment of the destination and a restriction on onward transfer. Where the law of a destination jurisdiction requires us to disclose data to a local authority, we will challenge an excessive request where we can and we will inform the person concerned unless we are legally barred from doing so.

12. Data Retention

We keep personal data only for as long as we need it for the purpose it was collected, and for as long afterwards as the law requires.

Enquiry correspondence is usually kept for two years from the last exchange, so that we can pick up a conversation that resumes later. Engagement and billing records are kept for seven years from the end of the financial year to which they relate, in line with accounting and tax requirements. Retainer statements are kept with the engagement record to which they belong. Closing packs are kept for the same seven year period.

Technical logs are kept for a shorter period, typically ninety days, unless a security incident requires us to preserve a specific entry. Where data is no longer needed, we delete it securely or, where deletion is not practical, we anonymise it so that it can no longer be linked to a person.

13. Security of Personal Data

We protect personal data with a combination of organisational and technical measures. Access to the ledger system is limited to the people who work on an engagement, and each person uses an individual account. Paper records at the Hillier Street office are kept in a locked cabinet when the desk is closed.

Electronic records are held on encrypted storage, and remote access requires a secure connection and a second factor. We keep backups so that a loss can be recovered, and we test the restore process at regular intervals. Staff receive a short briefing on data protection at the start of each year and whenever a significant change is made to the way records are held.

If a security incident affects personal data, we will act quickly to contain it, we will assess the risk to the people concerned and we will notify the relevant authority and the affected individuals where the law requires it. We keep a written record of each incident and the lessons drawn from it.

14. Your Rights

Subject to applicable law, you may have the following rights in relation to the personal data we hold about you.

• The right to be informed about how your data is used, which this policy provides.
• The right to request a copy of the personal data we hold about you.
• The right to ask us to correct data that is inaccurate or incomplete.
• The right to ask us to delete data where there is no continuing reason to keep it.
• The right to ask us to restrict processing while a concern is investigated.
• The right to object to processing that relies on legitimate interests.
• The right to receive your data in a portable format where that right applies.
• The right to withdraw consent where processing relies on consent.

To exercise any of these rights, write to billing@recodatech.lat or send a letter to Acton Advisory Limited at Rm 702 7/F Fu Fai Coml Ctr, 27 Hillier St, Sheung Wan, Hong Kong - 999077, Hong Kong (HK). We will confirm your request within a reasonable period and will explain any delay if one is unavoidable. We may ask for proof of identity before we act on a request, so that we do not disclose data to the wrong person.

Where a request concerns data that we hold as a processor for a client, we will forward the request to that client and will support the client in responding.

15. Marketing Communications

We do not send marketing messages to people who have not asked for them. Where a client or contact has expressed interest in a desk note or a seasonal closing reminder, we will send that message using the contact details they provided and will include a simple way to stop receiving it.

If you ask us to stop sending messages, we will record the request, stop the messages within a short period and keep only the minimum record needed to make sure the request is respected. We will not add you to a marketing list as a result of a billing enquiry or a routine correspondence.

16. Privacy for Children

The fee desk serves professional and technical services organisations, and the website is not directed at children. We do not knowingly collect personal data from anyone under the age of sixteen. If we learn that we have collected data from a child without the consent of a responsible adult, we will delete that data promptly.

If you believe that a child has provided personal data to us, please contact billing@recodatech.lat so that we can investigate and, where appropriate, remove the data.

17. Third Party Websites

Our pages may contain links to websites operated by other organisations, such as a bank portal or a professional body. We do not control those websites and we are not responsible for their privacy practices. A link from our site does not mean that we endorse the data handling of the destination.

When you follow a link, the destination site may set its own cookies and may ask for personal data. We encourage you to read the privacy notice of any site before you provide data to it.

18. Automated Decisions

We do not use personal data to make automated decisions that have a legal or similarly significant effect on an individual. The reconciliation of a ledger and the preparation of a closing pack are performed or supervised by people, and a person reviews every write-off before it enters a closing record.

Where we use software to total a ledger or to flag an anomaly, the software supports a human decision rather than replacing it. A flagged item is always reviewed by a member of the desk before any action is taken.

19. Changes to This Policy

We review this policy at least once a year and whenever a significant change is made to the way we handle personal data. When a change is made, we update the date at the top of the page and, where the change is material, we place a short notice on the homepage and inform active clients by email.

Older versions of this policy are kept so that we can show what applied at a given time. If you would like a copy of an earlier version, write to billing@recodatech.lat and the desk will send it.

20. Complaints and Contact

If you are unhappy with the way we have handled your personal data, please contact us first so that we have the chance to put things right. Write to the partner who supervises the Hillier Street desk at Acton Advisory Limited, Rm 702 7/F Fu Fai Coml Ctr, 27 Hillier St, Sheung Wan, Hong Kong - 999077, Hong Kong (HK), send an email to billing@recodatech.lat or call +17432125027 during posted business hours.

We will acknowledge a complaint promptly, investigate it fairly and reply in writing. If you remain dissatisfied after our reply, you may have the right to raise the matter with the privacy regulator in your jurisdiction. We will provide the relevant contact details on request.

For anything related to this policy, the developer named Acton Advisory can be reached through the same office address and email. We ask that written complaints include enough detail for us to identify the matter, but we do not ask for more personal data than is necessary to resolve it.