Privacy Policy

MFT DIGITAL LIMITED ("MFT", "we", "us", or "our") is a digital agency providing paid media, advertising, website, analytics, conversion tracking, and related services.

Our registered business contact address is: Suite 1503, 15/F, Carnival Commercial Building, 18 Java Road, North Point, Hong Kong.

For the purposes of applicable privacy and data protection laws, MFT may act as a data user, controller, or similar responsible party in relation to personal information that we determine how and why to process.

In some client engagements, MFT may process personal information on behalf of a client. In those circumstances, the client may be the controller or equivalent responsible party and MFT may act as its processor or service provider, subject to the applicable agreement.

This Privacy Policy covers information processed through this website and in connection with our business relationships and services. It does not replace a client's own privacy obligations for information that the client controls.

The information we collect depends on how you interact with MFT. We seek to collect information that is relevant to the purpose for which it is needed and not excessive for that purpose.

Information submitted through forms

When you request an initial review, consultation, or otherwise contact us through the website, we may collect information such as your full name, work email, company website, information about what your company sells, and the outcome or goals you describe.

Information collected automatically

When you visit the website, servers and technologies used to operate, secure, measure, or improve the site may automatically receive technical data about your visit. Some of this information may constitute personal information under applicable law.

Information from third parties

We may receive information from service providers, professional partners, analytics or advertising platforms, public business sources, and clients where this is reasonably necessary for a legitimate business purpose and permitted by law.

We may use personal information to:

• respond to inquiries, consultation requests, and other communications;
• evaluate whether our services are appropriate for a prospective client;
• prepare proposals, scopes, agreements, and project documentation;
• provide and manage paid media, advertising, analytics, website, conversion tracking, and related services;
• communicate with clients about projects, performance, service delivery, support, billing, and account matters;
• measure, maintain, troubleshoot, secure, and improve our website and services;
• understand how visitors use our website and which content or acquisition channels are effective;
• prevent fraud, abuse, security incidents, and unauthorized access;
• maintain internal business, accounting, compliance, and operational records;
• establish, exercise, or defend legal claims and comply with applicable laws, lawful requests, or regulatory obligations;
• send marketing or business communications where permitted by law and subject to applicable consent and opt-out requirements.

We do not use personal information for materially incompatible new purposes without taking the steps required by applicable law.

Where laws such as the GDPR or UK GDPR require us to identify a legal basis for processing, we rely on one or more of the following, depending on the circumstances:

• Contract. Processing necessary to take steps at your request before entering into a contract or to perform an agreement with you.
• Legitimate interests. Processing reasonably necessary to operate and improve our business, communicate with business contacts, secure our systems, understand website performance, provide professional services, and protect our rights, where those interests are not overridden by your rights and interests.
• Consent. Processing based on consent where consent is required, including certain non-essential cookies or marketing activities.
• Legal obligation. Processing necessary for us to comply with applicable legal, regulatory, tax, accounting, or other obligations.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We may disclose personal information when reasonably necessary for the purposes described in this policy. Recipients may include:

• hosting, infrastructure, security, and website service providers;
• email, communication, scheduling, and productivity providers;
• analytics, measurement, advertising, or marketing technology providers where such technologies are used;
• contractors, consultants, and members of our delivery team who require access for legitimate business purposes;
• accounting, legal, tax, compliance, insurance, and other professional advisers;
• advertising, analytics, website, CRM, or other platforms used to deliver an agreed client service;
• regulators, courts, authorities, or other parties where disclosure is required or permitted by law;
• a purchaser, investor, successor, or adviser in connection with a merger, acquisition, restructuring, financing, sale of assets, or similar corporate event, subject to appropriate safeguards.

We expect service providers handling personal information on our behalf to use it only for authorized purposes and to apply appropriate confidentiality and security protections.

MFT is based in Hong Kong and works with clients, contractors, service providers, and technology platforms in multiple countries. Your personal information may therefore be processed in a jurisdiction other than the jurisdiction in which you are located.

Privacy and data protection laws differ between countries. Where applicable law requires safeguards for an international transfer, we seek to use an appropriate transfer mechanism or other legally recognized safeguard. Depending on the circumstances, this may include contractual protections, transfer agreements, recognized adequacy mechanisms, or other measures permitted by law.

We also take reasonable steps to limit transfers to what is needed for the relevant business or service purpose.

We retain personal information for no longer than is reasonably necessary for the purposes for which it was collected, subject to legal, contractual, accounting, security, dispute-resolution, and recordkeeping requirements.

Retention periods vary depending on the type of data and context. For example:

• inquiry and prospective-client information may be retained while a business opportunity remains relevant and for a reasonable period afterward;
• client project and contractual records may be retained throughout the engagement and afterward for legal, accounting, operational, and dispute-management purposes;
• website security and technical logs may be retained for shorter operational periods unless they are required for investigation or security purposes;
• consent, preference, or opt-out records may be retained as needed to document and respect your choices;
• information may be retained for longer where required by law, necessary to establish or defend legal claims, or reasonably required to investigate fraud, security, or abuse.

When information is no longer reasonably required, we may delete, anonymize, aggregate, or otherwise dispose of it in accordance with applicable requirements.

We use reasonable administrative, organizational, and technical measures designed to protect personal information against unauthorized or accidental access, loss, misuse, alteration, disclosure, destruction, or other unauthorized processing.

Measures may include access controls, authentication, transport encryption where appropriate, software and infrastructure maintenance, restricted access based on business need, contractual confidentiality measures, backups, monitoring, and security practices appropriate to the relevant system and risk.

No method of internet transmission or electronic storage can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security of information.

We may use business contact information to communicate about MFT's services where permitted by applicable law. Where prior consent is required for a particular marketing activity, we will seek that consent before using personal information for that purpose.

You can ask us to stop sending marketing communications at any time by using an unsubscribe mechanism provided in the message, where available, or by emailing hello@mft-digital.com.

Opting out of marketing does not prevent us from sending non-promotional communications that are necessary for an active project, contract, transaction, support request, legal matter, or other existing business relationship.

Privacy rights differ by jurisdiction. Depending on where you live and which laws apply, you may have the right to request one or more of the following:

• confirmation of whether we process personal information about you;
• access to personal information we hold about you;
• correction of inaccurate or incomplete personal information;
• deletion of personal information, subject to legal exceptions;
• restriction of certain processing;
• objection to processing based on certain legitimate interests;
• withdrawal of consent where processing relies on consent;
• receipt of certain information in a portable format where data portability applies;
• opting out of certain sale, sharing, targeted advertising, or profiling activities where applicable law provides that right;
• lodging a complaint with an applicable privacy or data protection authority.

Hong Kong

Where the Personal Data (Privacy) Ordinance of Hong Kong applies, individuals may have rights relating to access to and correction of their personal data, subject to the Ordinance and applicable exceptions.

EEA and United Kingdom

Where the GDPR or UK GDPR applies, you may have rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and complaint to the applicable supervisory authority, subject to the conditions and exceptions in those laws.

How to submit a request

To exercise a privacy right, email hello@mft-digital.com and describe the request. Please provide enough information for us to identify the relevant records.

We may need to verify your identity or authority before fulfilling a request. We use information collected for verification only for legitimate verification, fraud-prevention, security, and request-handling purposes.

We will respond within the period required by applicable law. Some rights are subject to exceptions, including circumstances where information must be retained to comply with law, complete a transaction, protect security, establish or defend legal claims, or protect the rights of others.

Certain U.S. state privacy laws, including the California Consumer Privacy Act as amended ("CCPA"), provide residents with specific privacy rights when the law applies to the relevant business and processing activity.

The following describes categories of personal information MFT may process in connection with its website and business activities. Not every category is collected from every individual.

Sale and sharing

MFT does not sell personal information for monetary consideration. If a technology used by our website is treated under an applicable state law as "sharing", targeted advertising, or another activity carrying an opt-out right, we will handle applicable opt-out requests and required privacy preference signals in accordance with that law.

Sensitive personal information

Our public website is not designed to collect sensitive personal information such as government identification numbers, precise geolocation, health information, biometric identifiers, account passwords, or complete payment-card credentials. Please do not submit unnecessary sensitive information through general website forms or email.

Non-discrimination

Where applicable law provides such a right, we will not unlawfully discriminate against you because you exercised a privacy right.

MFT's website and professional services are intended for businesses and adult business users. They are not directed to children.

We do not knowingly use the website to collect personal information from children in circumstances where parental consent or another legal authorization would be required. If you believe a child has provided personal information to us inappropriately, please contact us so that we can review the matter and take appropriate action.

Our website may contain links to third-party websites, services, or platforms. Those third parties operate under their own privacy policies and terms, and this Privacy Policy does not control their independent processing.

MFT may also work with third-party advertising, analytics, website, or technology platforms when delivering services to clients. Information processed directly by those platforms may be governed by the platform's own terms, account settings, and privacy documentation.

We may update this Privacy Policy as our website, services, technology, service providers, or legal obligations change.

When we update the policy, we will revise the "Last updated" date shown at the top of this page. If a change is material and applicable law requires additional notice or consent, we will take the additional steps required by that law.

We encourage you to review this page periodically if you interact with MFT on an ongoing basis.

For questions about this Privacy Policy, our handling of personal information, or a privacy-right request, contact MFT using the details below.