Data handling practices and PDPO adherence.
This policy describes how Canton Recovery collects, uses, secures, and retains personal data in strict accordance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486).
Last updated: October 2026. This policy is published under Data Protection Principle 5, which requires that practices and policies regarding personal data be generally available. We may update this policy from time to time; the effective date above reflects the most recent revision.
1. Information We Collect
Canton Recovery collects personal data solely for the purpose of debt recovery and commercial mediation. This includes creditor information (name, company, contact details), debtor information (name, contact details, financial information relevant to the debt), and case documentation (contracts, correspondence, and supporting records). We collect only what the recovery purpose requires, consistent with Data Protection Principle 1.
2. How We Use Your Information
Personal data is used to assess claim viability, conduct recovery operations, communicate with relevant parties, issue legal notices, and fulfill our engagement obligations. We do not use personal data for any purpose beyond the recovery engagement without prescribed consent, consistent with Data Protection Principle 3.
3. Data Security & Storage
All personal data is stored using secure, access-controlled systems. We maintain practical safeguards against unauthorized access, processing, erasure, or use of personal data, consistent with Data Protection Principle 4. Documents are stored in encrypted form with role-based access limited to assigned case personnel.
4. Data Retention
Personal data is retained only for the duration necessary to fulfill the recovery purpose or to meet applicable legal and regulatory requirements. Upon conclusion of the engagement and any required retention period, personal data is securely destroyed or anonymized, consistent with Data Protection Principle 2.
5. Your Rights Under the PDPO
Under Data Protection Principle 6, data subjects have the right to request access to personal data held about them, request correction of inaccurate data, and ascertain our data practices and policies. Access and correction requests may be submitted to our designated Privacy Officer using the contact details below.
6. Disclosure to Third Parties
We do not disclose personal data to unauthorized third parties. Disclosure is limited to parties necessary for the recovery engagement (assigned counsel, coordinated local counsel, courts as required) and is governed by confidentiality and professional obligations. We never sell or commercially trade personal data.
7. Cross-Border Transfer of Data
As a cross-border recovery practice, personal data may be transferred to jurisdictions relevant to the recovery engagement. Such transfers are conducted with appropriate safeguards and only where necessary for the recovery purpose. We take steps to ensure that transferred data receives a level of protection comparable to that required under Hong Kong law.
8. Privacy Officer & Enquiries
Our designated Privacy Officer handles all data access, correction, and general privacy enquiries. You may contact the Privacy Officer at privacy@cantonrecovery.hk. We acknowledge and respond to access requests within a reasonable period, consistent with PDPO requirements.
Exercise Your Data Rights
To submit a data access or correction request, or to enquire about how we handle your personal data, contact our Privacy Officer.
Emailprivacy@cantonrecovery.hk
PostPrivacy Officer, Canton Recovery, Central, Hong Kong