Home › Privacy Policy
How SetupHK collects, uses, stores and protects your information.
This Privacy Policy takes effect on 1 November 2026. It explains how Deluxe Business Solution Limited (SetupHK, “we” or “us”) collects, uses, retains, transfers and protects your personal data on this website (setuphk.com) and when we provide our services, in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the “Ordinance”) and its six Data Protection Principles.
This website has no online forms and no user registration. We collect personal data in the following ways:
When you contact us: the name, phone number, email address and WhatsApp account name you provide when you enquire by WhatsApp, phone or email, and the content of the conversation.
When you engage us for a service: depending on the service, this may include the names, identity documents, proof of address and contact details of directors, shareholders, company secretaries and significant controllers, company information, and the financial records needed for bookkeeping, audit and tax filing.
When you browse this website: usage data collected automatically through cookies and similar technologies, such as your IP address, browser and device type, referring URL, pages viewed, scroll depth, time on page, and whether you tapped a WhatsApp or phone link (see sections 4 and 5).
Providing personal data is voluntary. However, if we do not receive the information needed to provide a service or to meet our legal obligations, we may be unable to answer your enquiry or provide that service.
To answer your enquiries and arrange consultations and follow-ups.
To provide the services you engage us for (such as company formation, company secretarial services, bookkeeping, audit arrangement and tax filing), and to handle billing and related administration.
To meet our legal and regulatory obligations, including customer due diligence and record keeping as a Trust or Company Service Provider (licence no. TC009022) under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), and responding to lawful requests from government departments or law enforcement agencies.
To understand how this website is used, improve its content and measure the effectiveness of our online advertising.
We use personal data only for the purposes for which it was collected or for directly related purposes. Before using it for a new purpose, we will obtain your express and voluntary consent.
We do not sell your personal data. For the purposes above, we may transfer personal data to:
government departments and bodies to which information must be submitted to provide a service, such as the Companies Registry, the Inland Revenue Department and the Intellectual Property Department;
professional firms that help complete the work you engage us for, such as the practising CPA firm we work with for audits, and banks you ask us to refer you to;
law enforcement agencies, regulators or courts entitled by law to obtain the data;
third parties that provide website hosting, content delivery and analytics services to us (see section 4).
The servers we use to store data are located in the United States (provided by Google), so your personal data will be stored outside Hong Kong. When data is transferred outside Hong Kong, we require our service providers to take reasonable safeguards to protect the personal data against unauthorised or accidental access, processing, erasure, loss or use.
When you browse this website, the following services may receive your IP address, device information or usage data. Their providers may process data outside Hong Kong, subject to their own privacy policies.
Google Tag Manager (Google): loads the analytics and advertising tags listed below.
Google Analytics 4 (Google): counts visits, pages viewed, scroll depth and time on page, and records taps on WhatsApp or phone links.
Google Ads (Google): measures enquiries resulting from our ads (such as taps on WhatsApp or phone links) and builds remarketing lists so that our ads can be shown on other websites to people who have visited this website.
LinkedIn Insight Tag (LinkedIn): counts visits from LinkedIn and measures the effectiveness of LinkedIn ads.
Microsoft Clarity (Microsoft): records how you interact with pages, such as mouse movements, clicks and scrolling, so that we can review heatmaps and session replays to see how easy the website is to use.
Ahrefs Web Analytics (Ahrefs): counts visits. Ahrefs states that this service does not use cookies.
Cloudflare: content delivery and security for the website (such as blocking malicious traffic). It sets a cookie for security purposes.
Rocket.net: website hosting, on servers located in the United States (Google).
Google Fonts (Google): loads the website fonts, which means your browser sends your IP address to Google’s servers.
YouTube (Google): video thumbnails on some pages load from YouTube’s servers. The player loads in YouTube’s privacy-enhanced mode (youtube-nocookie.com) only after you press play.
WhatsApp (Meta): if you tap a WhatsApp link and send us a message, the message is delivered through WhatsApp and is subject to WhatsApp’s privacy policy.
Cookies are small text files that a website stores in your browser. This website and the third-party services listed in section 4 use cookies and similar technologies for security, website usage statistics and measuring advertising effectiveness. How long data collected by a third-party service is kept depends on that service’s settings and privacy policy.
You can disable or limit cookies and tracking in the following ways:
Block or delete cookies in your browser settings, or turn on your browser’s tracking protection. This also applies to Microsoft Clarity.
Install the Google Analytics opt-out browser add-on
Where the law permits, we will use your personal data for direct marketing of our services. As required by Part 6A of the Ordinance, before doing so we will notify you of the following and obtain your consent (indicating consent is free of charge). We will not use your personal data for direct marketing without your consent:
the kinds of personal data to be used: your name, phone number, email address and WhatsApp account name;
the classes of services to be marketed: services provided by SetupHK, such as company formation, company secretarial services, bookkeeping, audit arrangement and tax filing.
We will not provide your personal data to any third party for direct marketing without your written consent.
Even after giving consent, you may opt out at any time, free of charge, by asking us to stop using your personal data for direct marketing. Please let us know by any of the following means:
Email: cs@setuphk.com
Phone: +852 3845 2888
WhatsApp: +852 9248 5734
Post: Unit B, 17/F, Silvercorp International Tower, 707-713 Nathan Road, Mong Kok, Kowloon, Hong Kong
We keep personal data for 5 years. Where the law requires certain records to be kept for longer, we keep them for the period the law requires; for example, the Inland Revenue Ordinance (Cap. 112) requires business records to be kept for 7 years. When the retention period ends, we take all practicable steps to erase the data.
We take all practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. This website is served entirely over encrypted HTTPS connections. When we engage a third party to process personal data, we use contractual or other means to prevent the data transferred from being kept longer than necessary or from unauthorised access, processing, erasure, loss or use.
Under the Ordinance, you have the right to:
ask whether we hold your personal data and obtain a copy of it (a data access request);
ask us to correct personal data that is inaccurate (a data correction request);
ask about our policies and practices on personal data and the kinds of personal data we hold and their main purposes.
To make a data access request, please use the Data Access Request Form specified by the Office of the Privacy Commissioner for Personal Data (available at www.pcpd.org.hk) and send it to the address or email in section 10. We will respond within 40 days of receiving your request. We may charge a fee for complying with a data access request, which will not be excessive, as permitted by the Ordinance. To protect your privacy, we may ask you to verify your identity.
If you have any questions about this Privacy Policy or your personal data, or wish to make a data access or correction request, please contact:
Data user: Deluxe Business Solution Limited (SetupHK)
Address: Unit B, 17/F, Silvercorp International Tower, 707-713 Nathan Road, Mong Kok, Kowloon, Hong Kong
Email: cs@setuphk.com
Phone: +852 3845 2888
We may revise this Privacy Policy from time to time. The revised version will be published on this page with an updated effective date. If there is any inconsistency between the Chinese and English versions of this policy, the Chinese version prevails.
Effective date: 1 November 2026
Last updated: 1 November 2026
