Privacy Policy

1. Introduction

This Privacy Policy describes how GAZETEAM LABS LIMITED ("Gazeteam Labs," "we," "us," or "our") collects, uses, and protects your data. We are a Hong Kong incorporated entity with Business Registration Number 80863747-000-07-26-A, operating at RM A, 29/F UNITED CTR 95 QUEENSWAY ADMIRALTY HONG KONG.

• garysiu.one is the personal brand and public-facing persona of Gary Siu, through which GazeTeam Labs communicates, markets, and delivers its executive services.
• gazeteam.one is GazeTeam Labs' corporate-branded website, mirroring the same content and purpose.

None of garysiu.one or gazeteam.one is a separate legal entity; none holds data controller or data processor status independent of GazeTeam Labs, and all data handling described in this Policy in connection with any of these websites is carried out by, and is the sole responsibility of, GAZETEAM LABS LIMITED.

This policy applies to visitors of our websites (garysiu.one and gazeteam.one, and their associated subdomains) and clients engaging our Intelligent Workforce, AI Automation, and marketing services. In line with the Hong Kong Personal Data (Privacy) Ordinance (PDPO), we act as a Data Controller for our website visitors' and clients' contact information. However, when processing proprietary business data on behalf of our clients to build custom AI architectures, we act strictly as a Data Processor under the written instructions of our clients.

2. Information We Collect

• Information You Provide: When you request a Strategy Call, fill out a contact form, or engage our services, we collect your name, corporate email, phone number, and details regarding your business operations.
• Payment & Billing Information: When you pay for our services, billing details (such as billing address, payment amount, and transaction records) are collected and processed directly by our third-party payment gateways, including Airwallex, to complete transactions and prevent fraud. We do not store primary cardholder data on our servers.
• Automated Information: We collect log data and usage metrics (e.g., IP address, browser type, device details) via cookies and analytics to secure and optimize our website experience. See Clause 8 for details on cookie categories and how to manage your preferences.
• Enterprise Data (Client Engagements): For clients under formal contract, we securely process proprietary business data, documents, workflows, and internal communications necessary to build custom Retrieval-Augmented Generation (RAG) architectures and AI agent workflows.

3. AI Data Handling & Enterprise Isolation

We place paramount importance on the confidentiality of your enterprise data. Client data ingested into custom RAG architectures or internal AI agents is strictly isolated. We do not use your private, proprietary enterprise data to train generalized or public foundational AI models. Furthermore, any data transmitted to third-party AI API providers (acting as sub-processors) is governed by strict contractual confidentiality obligations, ensuring your data is not retained or used for model training by those providers.

4. Sharing and Disclosure

We do not sell, rent, or trade your personal data. We share information only under the following circumstances:

• With Service Providers: Trusted cloud infrastructure, API providers, and payment processors (such as Airwallex) operating under strict confidentiality and data protection agreements. A current list of our key service providers is available at Clause 7.
• For Legal Reasons: We may disclose information if mandated by Hong Kong law, regulatory authorities, or to enforce our legal rights and protect against fraudulent activities.

5. Data Security & Retention

We implement enterprise-grade technical and organizational security measures—including encryption in transit and at rest, access controls limiting data to personnel who need it, and confidentiality obligations for staff and contractors—to protect your data against unauthorized access, loss, or alteration.

We retain personal, billing, and enterprise data only for as long as is necessary to fulfill service agreements, satisfy legal and tax accounting obligations under Hong Kong law, or resolve ongoing legal disputes. In particular:

• Lead and contact information (from Strategy Call requests or contact forms) that does not result in an engagement is retained for 12 months from last contact, after which it is deleted or anonymized.
• Client business and enterprise data is retained for the duration of the engagement and deleted or returned within 30 days of contract termination, in accordance with the applicable SOW and our Terms of Service.
• Billing and transaction records are retained for 7 years to comply with Hong Kong tax and accounting record-keeping requirements under the Inland Revenue Ordinance.
• Website log and analytics data is retained for 14 months, consistent with standard analytics tooling defaults.

6. Direct Marketing

Where we intend to use your name and contact details (such as email or phone number) to send you direct marketing communications about GazeTeam Labs' own services—for example, newsletters, case studies, or service updates—we will, in accordance with Part 6A of the PDPO:

• Inform you, before first using your data for that purpose, of our intention to do so, the kinds of data to be used, and the classes of services to be marketed; and
• Obtain your explicit consent (which may be given by opting in on a form, or by responding affirmatively to our request) before such use begins.

Every direct marketing communication we send will include a clear, free-of-charge means to opt out. If you opt out, we will cease using your data for direct marketing purposes within the timeframe required by law. We do not provide your personal data to any third party for that third party's own direct marketing without your separate explicit consent.

7. Cross-Border Transfer of Personal Data

Some of the service providers and AI subprocessors referenced in this Policy are located, or process data on servers located, outside Hong Kong, currently including OpenAI, L.L.C.; Anthropic, PBC; and Meta Platforms, Inc. (United States). Where your personal data is transferred outside Hong Kong, we take reasonable steps to ensure it receives a standard of protection comparable to that required under the PDPO, including through contractual confidentiality and data protection obligations imposed on those providers.

8. Cookies and Tracking Technologies

Our website uses the following categories of cookies:

• Essential cookies: Required for core website functionality, which cannot be disabled.
• Analytics cookies: Used to understand website usage and improve the visitor experience.

You can manage or withdraw cookie consent at any time via your browser settings. Disabling non-essential cookies will not affect your ability to browse the site.

9. Your Privacy Rights & Contact

Under the Hong Kong Personal Data (Privacy) Ordinance (PDPO), you have the right to request access to and correction of your personal data held by us.

• Response time: We will respond to a valid data access or correction request within 40 days of receipt, as required under the PDPO.
• Fees: We may charge a reasonable administrative fee to cover the direct cost of complying with a data access request, which we will notify you of before processing your request.
• Complaints: If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).

To exercise your rights, or if you have questions regarding this Privacy Policy, please contact us:

• Entity Name: GAZETEAM LABS LIMITED
• Business Registration No.: 80863747-000-07-26-A
• Registered Address: RM A, 29/F UNITED CTR 95 QUEENSWAY ADMIRALTY HONG KONG
• Email: gary@garysiu.one

10. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be notified via our website or by email to active clients at least 14 days before taking effect. The "Last Updated" date at the top of this Policy indicates when it was last revised.