Privacy Policy

1. Introduction

Lithograph ("we", "us", "our") is committed to protecting the personal data of individuals who interact with our services and website. This Privacy Policy explains how we collect, use, store, and protect personal data in accordance with Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO").

This policy applies to data collected via our website, contact forms, service engagements, and any other channel through which you provide information to Lithograph.

For questions about this policy or your personal data, contact us at: [email protected]

2. Data We Collect

We may collect the following categories of personal data:

• Identity data: Name, job title, organisation name
• Contact data: Email address, phone number, business address
• Enquiry data: Information you provide in contact forms or correspondence
• Technical data: IP address, browser type, pages visited, session duration (via analytics cookies where consented)
• Project data: Information shared as part of a service engagement, including any documents provided for review

For healthcare analytics projects, any patient data involved is governed by a separate data processing agreement and handled under healthcare-specific protocols.

3. How We Collect Data

Data is collected through the following means: directly via contact forms on our website; through email and telephone correspondence; as part of scoping and project documentation for service engagements; and through analytics cookies (where you have provided consent).

We do not collect data from third-party data brokers or social media platforms.

4. How We Use Your Data

Personal data is used for the following purposes:

• Responding to enquiries and managing service relationships
• Delivering agreed services under contract
• Sending relevant communications where you have opted in
• Improving our website based on aggregate usage analytics
• Meeting legal and regulatory obligations

The legal basis for processing is your consent (for marketing communications and analytics cookies), contract performance (for service delivery), and legitimate interests (for responding to enquiries).

Retention: Enquiry data is retained for 2 years. Project data is retained for 5 years unless a shorter period is agreed. Analytics data is retained for 13 months.

5. Data Sharing

We do not sell personal data. Data may be shared with the following categories of third parties:

• Service providers supporting our infrastructure (hosting, email, analytics) under data processor agreements
• Professional advisors (legal, accounting) under confidentiality obligations
• Regulatory authorities where required by law

Project data shared with Lithograph is not shared with third parties without your prior agreement.

6. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or loss. These include access controls, encryption in transit, regular security review, and defined data handling procedures for sensitive project data.

In the event of a data breach affecting your rights, we will notify you and the Office of the Privacy Commissioner for Personal Data (PCPD) as required under applicable law.

7. Cookies

Our website uses cookies for essential functionality and, with your consent, for analytics purposes. Essential cookies cannot be disabled as they are required for the site to function. Analytics cookies help us understand how visitors use the site. You can manage your cookie preferences on our Cookie Policy page.

8. Your Rights Under PDPO

Under Hong Kong's Personal Data (Privacy) Ordinance, you have the right to:

• Request access to personal data we hold about you (Data Access Request)
• Request correction of inaccurate personal data (Data Correction Request)
• Withdraw consent for direct marketing communications
• Object to certain types of processing
• Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD), Hong Kong

To exercise your rights, contact us at [email protected]. We will respond within 40 days as required by the PDPO.

9. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently.

10. Children's Privacy

Our services are directed at professional and business users aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

11. Policy Changes

We may update this policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated via our website. Continued use of our site or services after changes take effect constitutes acceptance of the revised policy.

12. Contact

For any privacy-related enquiries or to exercise your data rights: