Privacy notice · DossierTwist

About this notice

This privacy notice explains how DossierTwist collects, uses, discloses, stores and protects personal data when you use this website, contact us, subscribe to our newsletter, engage our services, or appear in our research. It is our statement of policies and practices under Data Protection Principle 5 of the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the "Ordinance"), and it also serves as our personal information collection statement for the forms on this website.

"Personal data" means information that relates directly or indirectly to a living individual and from which it is practicable to identify that individual.

Who we are

In this notice, "DossierTwist", "we", "us" and "our" mean the operator of this website together with its affiliated entities, partners, successors and assigns. The entity that decides why and how your personal data is processed in a given case is the data user responsible for it. For questions about this notice or your personal data, contact our privacy team at {{emails.privacy}}.

How we follow the Data Protection Principles

The Ordinance sets out six Data Protection Principles. In practice:

Purpose and manner of collection. We collect personal data only for lawful purposes directly related to our activities, collect no more than we need, collect it fairly, and tell you, as in this notice, why we collect it and whether you must provide it.
Accuracy and retention. We take practicable steps to keep personal data accurate and do not keep it longer than necessary for the purpose for which it is used. We set retention periods for each kind of data, listed below.
Use. We use personal data only for the purposes for which it was collected or directly related purposes, unless you give your prescribed consent or an exemption under the Ordinance applies.
Security. We protect personal data against unauthorised or accidental access, processing, erasure, loss or use, including where it is handled by our data processors.
Openness. We make our policies and practices available, as in this notice.
Access and correction. You may ask whether we hold personal data about you, request a copy, and ask us to correct it.

Reading our website

We do not set cookies for readers, run analytics, embed social media trackers or show advertising, and our pages do not load resources from third-party servers.

Like every website, ours is served by a web server that records basic technical information about each request: the IP address, the date and time, the page requested, the response code and your browser's user-agent string. We configure our logs to omit query strings. We use these logs only to keep the website secure and working, for example to detect attacks and abuse, and we keep them for no more than 14 days, unless we need a specific record longer to investigate a security incident or to comply with law.

To protect our forms and administration area against automated abuse, we keep short-lived counters derived from network addresses. These are stored as keyed, one-way hashes and expire automatically.

Preferences stored in your browser

If you choose a colour scheme or the card view of the dossier list, your browser remembers it in its local storage (dt-theme, dt-view). These settings stay on your device, are never sent to us, and can be cleared in your browser settings at any time.

Briefs and enquiries

What we collect. When you send a brief through our form, or write to us by email or messaging, we collect what you choose to tell us: typically your name, organisation, email address and other contact details, your preferred channel, and the details of your request, which may include personal data about the people or companies you ask us to research.

Why. We use it to reply to you, to check for conflicts of interest, to assess whether the work is lawful and consistent with our acceptable use policy, to scope and quote for the work, and to keep a record of our communications. Providing your contact details is necessary for us to reply; the other fields are optional, and you can tell us more later.

How it is protected. Briefs submitted through the form are encrypted on our server as soon as they arrive, using a key that only our authorised analysts hold. The website itself cannot read them once stored.

How long. Unless your enquiry leads to an engagement, we delete it 30 days after we receive it. If it does, it becomes part of the engagement file described below.

If you subscribe to our newsletter, we collect your email address, the language of the page you subscribed from, and the date, time and wording of the consent you gave. We use them only to send you new dossiers and major updates, which may also mention our services. We will not use your personal data for direct marketing, or provide it to anyone for direct marketing, without your consent, as required by Part 6A of the Ordinance.

Your address is stored encrypted. Messages are sent through an email delivery service acting on our behalf. You can unsubscribe at any time using the link in every message or by writing to {{emails.privacy}}. We then stop sending immediately and delete your address from the list, keeping only a one-way record that you unsubscribed so that we do not add you again by mistake.

Clients and engagements

When you engage us, we process the personal data of your contacts (names, roles, business contact details and communications) to deliver the services, manage the relationship, invoice, and meet our legal, regulatory, accounting and professional obligations. Where the law requires, we verify the identity of our clients and screen them against sanctions lists before we accept an engagement.

We keep engagement files, including the reports we deliver and the records they rely on, for as long as the engagement letter requires and then for up to seven years, so that we can answer questions about our work and defend legal claims, unless a shorter or longer period is agreed with the client or required by law.

Companies we research, and the people connected to them

Our work concerns companies and groups of companies. It involves personal data about people only through their connection with them and in their professional or public roles: for example as directors, officers, shareholders, beneficial owners or founders, or as people named in court or regulatory records about a company. We collect it from public records and other lawful sources, including company and court registers, official gazettes, sanctions and regulatory lists, archived web pages and published media, and, where a matter requires it, from enquiries with people who know the subject.

Client research. We do not research private individuals as such. We look at people only in connection with the companies they own, run or are affiliated with, and only for a lawful purpose stated in writing by the client, such as due diligence before a transaction or partnership, customer onboarding, compliance with anti-money-laundering, sanctions or anti-bribery obligations, the prevention or detection of crime, or legal proceedings. We collect only what is relevant to that purpose and deliver it only to the client. Where we act on a client's instructions, the client is also a data user for the data we deliver and must use it only for the stated purpose.

Public dossiers. We publish dossiers in the public interest. Where personal data is held for the purpose of a news activity, the Ordinance contains an exemption for that activity. We nevertheless limit what we publish to what the public-interest purpose requires, invite responses to adverse findings and publish them, and correct errors. If you believe a dossier is inaccurate about you, write to {{emails.corrections}}.

Use of AI systems

We use a proprietary AI-assisted research system, which may include models provided by third-party AI providers, to help retrieve, analyse and summarise records. Analysts review the output, and no decision about any individual is made by automated means alone. Our AI providers process data on our behalf under contractual confidentiality and security obligations and are not permitted to use client material or briefs to train or improve their models. Client material is never used to train third-party AI models.

We do not sell personal data. We share it only as follows:

Our affiliated entities and partners, where needed to deliver the services you request, under the same confidentiality obligations as us.
Data processors who act on our behalf under written contracts that require them to protect the data and use it only on our instructions, including our hosting provider, email delivery service, encrypted storage and backup providers, and AI model providers.
Clients, in the case of research findings delivered for a lawful stated purpose.
Professional advisers, such as lawyers, auditors and insurers, under duties of confidentiality.
Authorities, where we are required to do so by law, by court order or by a regulator with jurisdiction over us, or where disclosure is necessary to prevent or detect crime or to protect someone's safety.
A successor, if all or part of our business is reorganised, merged or transferred, in which case the successor will be bound by this notice.

Transfers outside Hong Kong

We and our data processors may store or process personal data outside Hong Kong, including in places whose data protection laws differ from those of Hong Kong. Where we transfer personal data, we take practicable steps, including contractual safeguards, to ensure that it receives protection comparable to that required by the Ordinance and, where applicable, by the laws of the place it comes from.

Security

We use technical and organisational measures appropriate to the sensitivity of the data, including encryption of briefs and subscriber lists at rest, encrypted connections, two-factor authentication and role-based access for our staff, a tamper-evident audit log of administrative actions, integrity checks of our systems, and confidentiality obligations for everyone who handles personal data. No system is completely secure, and if a data breach is likely to affect you, we will tell you and the relevant authorities where appropriate.

How long we keep data

Web server logs: up to 14 days.
Briefs and enquiries that do not lead to an engagement: 30 days.
Newsletter subscriptions: until you unsubscribe.
Engagement files: as agreed in the engagement letter, then up to seven years.
Published dossiers: for as long as they remain in the public interest, together with the corrections noted on them.

When data is no longer needed, we delete it or make it anonymous.

Your rights

Under the Ordinance you have the right to:

ask whether we hold personal data about you and, if so, to receive a copy (a data access request);
ask us to correct personal data that is inaccurate (a data correction request);
withdraw your consent to direct marketing at any time, free of charge; and
be told our policies and practices on personal data and the kinds of personal data we hold.

You can make a request by writing to {{emails.privacy}}. You may use the data access request form published by the Office of the Privacy Commissioner for Personal Data. We may need to verify your identity before we respond. We will respond within 40 days of receiving your request, as the Ordinance requires. We may charge a fee for complying with a data access request, which will not be excessive, and we will tell you the amount first. In some cases the Ordinance allows or requires us to refuse a request, for example to protect the rights of others or a news activity, and if so we will explain why.

Visitors from the European Economic Area and the United Kingdom. Where the General Data Protection Regulation or the UK GDPR applies to our processing, you also have the rights to erasure, restriction, objection and data portability, and the right to complain to your data protection authority. Our legal bases are your consent (newsletter), the performance of a contract or steps before one (briefs and engagements), our legitimate interests in operating a secure website, delivering research and publishing in the public interest, balanced against your rights, and compliance with legal obligations.

Visitors from the Chinese mainland. Where the Personal Information Protection Law applies, you may also ask us to explain our processing rules and to delete your personal information, withdraw any consent you have given at any time, and ask us for information about any transfer of your personal information outside the mainland.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data in Hong Kong, or to the data protection authority where you live.

Children

Our website and services are intended for adults and businesses. We do not knowingly collect personal data from anyone under 18 through our forms. If you believe a child has sent us personal data, write to {{emails.privacy}} and we will delete it.

Changes to this notice

We may update this notice from time to time. The version published on this page, with its date, is the current one. If we make a material change to how we use personal data we already hold, we will tell those affected where we can.

Language

This notice is written in English. We may provide translations for convenience. If there is any conflict or inconsistency between the English text and a translation, the English text prevails.

Contact

For any question about this notice, or to exercise your rights, write to {{emails.privacy}}. Please mark your message "Personal data request" so that it reaches the right person quickly.