Privacy Policy

1. Summary

We comply with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) and its Data Protection Principles. We do not use advertising or remarketing cookies; we use only Google Analytics first-party analytics cookies (see section 3, opt-out available), collect your email address only if you subscribe to the newsletter, and never sell or rent personal data.

2. Personal Information Collection Statement (newsletter)

Data collected: email address (required) and language preference (optional).
Purpose: only to send the MPF Watch monthly data email and subscription-related notices. We will not use your data for direct marketing of other products without your consent, nor provide it to third parties for direct marketing.
Voluntary: if you do not provide an email address, we cannot send you the newsletter.
Transferees: only the email service provider that sends emails on our behalf (a data processor), whose servers may be outside Hong Kong; we contractually require it to protect the data and process it only on our instructions.
Consent and opt-out: double opt-in; every email has an unsubscribe link and you may unsubscribe at any time free of charge.
Retention: deleted within 30 days of unsubscribing unless the law requires otherwise.
Access and correction: you may request access to and correction of your personal data via the contact page. We may charge a reasonable fee as permitted by the Ordinance.

3. Analytics

We use Vercel Web Analytics and Speed Insights for aggregated traffic and page-performance statistics (e.g. page views, load times). They are cookieless, collect no personal identifiers such as names or email addresses, do not track you across sites and do not build profiles; visitors are counted with a hash that resets daily, and we view the data only in aggregate.

Google Analytics 4: we use Google Analytics 4 (provided by Google LLC) to measure aggregated usage (e.g. pages viewed, referral source, device type). GA4 sets first-party cookies (_ga, _ga_*) to distinguish visitors and sessions. Google signals and ad personalisation are turned off, and advertising consent (ad_storage, ad_user_data, ad_personalization) defaults to denied; we do no advertising or remarketing and do not combine analytics data with identifying details such as names or email addresses. IP addresses are handled according to Google’s practices (GA4 does not log or store IP addresses). Data may be processed and stored outside Hong Kong, including in the United States, by Google. Our GA4 data retention setting is 14 months.

How to opt out: opt out of analytics on this site (stores an opt-out setting in your browser so Google Analytics is not loaded here; repeat it if you clear browser data), or install the Google Analytics Opt-out Browser Add-on. You can also block or delete cookies in your browser settings.

4. Server logs

Our hosting provider may keep short-term logs of IP addresses and browser data for security and operations; we do not use them to identify individuals.

5. Security

We take reasonable steps to protect personal data against unauthorised access, processing or loss.

6. Changes and contact

This policy may be updated; last updated 2026-10-14. For enquiries or access/correction requests, use the contact page.