Legal
Privacy policy
How HPT Group Limited collects, uses, keeps and protects personal information, including the services that process the forms on this site and how identity documents are collected.
Last updated: 27 October 2026.
1. Who we are
This website is operated by HPT Group Limited, a company incorporated in Hong Kong, with its registered office in Hong Kong. HPT Group Limited is the data controller for personal information collected through this site and in the course of our engagements. Services are provided by HPT Group Limited, Hong Kong, and, where stated, by licensed third-party providers.
2. Privacy contact
Our privacy contact is our Data Protection Lead. Write to privacy@hpt.group or to the registered office above, marked for the attention of the Data Protection Lead.
3. What we collect
3.1 When you visit the site
Our host keeps standard server logs: IP address, pages requested, browser and time. If you accept analytics cookies, we also measure which pages are visited. We do not use advertising or tracking cookies.
3.2 When you send us a form
The details you enter: usually your name, email, telephone number, country of tax residence, the matter you want to discuss and any further information you choose to give. The application form first asks four eligibility questions; those answers stay in your browser and are not sent to us.
3.3 When you become a client
Before an engagement starts we carry out customer due diligence: identity and address, beneficial ownership, source of funds and wealth, tax residence, and sanctions and politically exposed person screening. For companies we collect the same for directors, beneficial owners and signatories.
4. How we collect identity documents
We ask for passports, identity cards, bank statements and other due diligence documents only once an engagement letter is signed. Please do not send them through the forms on this site or before an engagement starts. You can then send them in one of two ways: through our secure upload, which we recommend, or by email to the director handling your matter. Our email is hosted on Microsoft 365 in the United Kingdom. Ordinary email is less secure than the upload, so if you prefer not to use it, ask us for the upload link. Documents are available only to the people working on your matter and, where needed, to the regulated provider who must verify them.
5. Why we use personal information
- To answer your enquiry and decide whether we can act (our legitimate interests, or steps before a contract).
- To deliver the engagement set out in your engagement letter (contract).
- To meet legal duties, including due diligence, sanctions checks, record keeping and responding to lawful requests (legal obligation).
- To send our newsletter, only if you subscribe, and for optional analytics cookies (consent, which you can withdraw at any time).
6. Who processes the forms and where
These service providers process personal information for us under contract:
| Provider | What it does for us | Where the data is held |
|---|---|---|
| Formspree, Inc. | Receives the enquiry, application, partner and newsletter forms on this site and passes them to us | United States |
| Vercel Inc. | Hosts this website and its server logs | United States, with pages served from the region nearest the visitor (London for the build) |
| Microsoft Corporation (Microsoft 365 and Bookings) | Email, document storage and meeting bookings | United Kingdom |
| Hetzner Online GmbH | Hosts HPT's client relationship system, which records enquiries and client matters after a form is received | Germany |
| Plausible Insights OÜ | Privacy-focused website analytics, only if you accept analytics cookies | European Union |
| Google LLC (Google Analytics 4) | Website analytics, only if you accept analytics cookies | United States |
We also share information, with your authority, with the banks, trustees, formation agents, counsel and other providers involved in your matter, and with regulators, courts or tax authorities where the law requires it. We do not sell personal information or share it with advertising networks.
7. International transfers
Some providers above hold data outside Hong Kong, the United Kingdom and the European Union. Where the law requires it, we rely on contractual safeguards such as standard contractual clauses. Ask us for a copy.
8. How long we keep it
- Enquiries and applications that do not proceed: 24 months from our last contact, then deleted. If we decline at the eligibility stage, nothing is sent to us.
- Newsletter: until you unsubscribe, plus 12 months as a record of the unsubscribe.
- Website analytics: up to 14 months.
- Client due diligence and engagement records: at least seven years after the engagement ends, or longer where the law of the relevant jurisdiction requires.
9. Security
Client information is encrypted in transit and at rest. Access is limited to the people working on the matter and protected by multi-factor authentication.
10. Your rights
Depending on where you live, you may ask to see the information we hold about you, correct it, delete it, restrict or object to its use, or receive a copy. Write to privacy@hpt.group. We reply within the time the law allows (40 days under Hong Kong law, one month under UK and EU law). You may also complain to the Office of the Privacy Commissioner for Personal Data in Hong Kong, or to your local data protection authority.
11. Changes
We will update this page when our practices change. The date at the top shows the latest version.
See also: Cookie policy, Terms of use, Complaints procedure.