General Public Notice

In force since 28 August 2026. This page carries the version applicable today.

Our Privacy Policy addresses the people who deal with us: visitors, enquirers, clients, matter handlers. This notice addresses someone else — the individual whose name appears in a file because a company is being formed around them. They did not write to us, they may never hear from us, and they have rights all the same.

1. Who is the data controller

Lo On Shing Consultants Limited (盧安誠顧問有限公司), registered in Hong Kong SAR under number 2229760 (Business Registration number 64679960), registered office at 806, Capitol Centre, 5–19 Jardine’s Bazaar, Causeway Bay, Hong Kong SAR.

For any question or request concerning this notice: info@loonshing-consultants.hk.

2. Whose data this notice concerns

Individuals whose personal data reaches us in the course of a matter without their being our client, in particular:

• directors, legal representatives, supervisors, managers and company secretaries of the company being formed or of its parent;
• shareholders and subscribers, whether individuals or the individuals behind a corporate shareholder;
• beneficial owners and persons exercising control, whose identification is required by anti-money-laundering, counter-terrorist-financing and anti-tax-fraud (AML-FT) rules and by the significant controllers registers;
• authorised signatories, bank account operators, contact persons and persons designated to receive service of legal documents;
• spouses, where the matrimonial regime bears on the holding of shares.

3. What data we process

Depending on the jurisdiction and on what the receiving authority requires:

• Identification — name in Latin and, where applicable, Chinese characters; date and place of birth; nationality; passport or identity card number and expiry; a copy of the identity document;
• Address — residential address, and proof of it; the correspondence address to be published in a register;
• Corporate role — office held, date of appointment, powers, shareholding and voting rights, beneficial ownership percentage;
• Contact details — professional e-mail address and telephone number, where a form requires them;
• Compliance information — the results of the sanctions, politically-exposed-person and adverse-media checks our client due diligence requires;
• Signatures — handwritten or electronic, on the deeds and forms.

We do not seek data of a special category. Where a document produced to us contains such data incidentally — a health mention on an identity paper, for instance — we do not extract it, we do not index it, and we keep it only as part of the document itself.

4. Where the data comes from

Almost always from our client: the investor who instructs us provides the details of the people who will hold office or hold shares. It may also come from a public register when we verify a filing, or from a public sanctions or adverse-media source during our compliance checks. We do not buy personal data and we do not compile files beyond what a matter requires.

5. Why we process it, and on what basis

To prepare and file the documents by which a company is formed, changed or wound up; to satisfy the identification obligations that AML-FT rules impose on us and on our correspondents; and to keep the record of a matter for as long as we may have to answer for it.

The basis is the performance of our engagement with our client and the legal obligations to which that engagement subjects us, together with our legitimate interest — and the client’s — in having a company lawfully constituted. Where a jurisdiction requires the express consent of the individual to a filing, that consent is collected on the form the authority provides, and we do not substitute ourselves for it.

6. Who receives it

By the nature of the work, personal data in a matter leaves us. It goes to:

• the registries and authorities of the jurisdiction concerned — in Hong Kong the Companies Registry and the Inland Revenue Department; in Mainland China the Administration for Market Regulation and the authorities to which it refers a file; in Vietnam the provincial Department of Planning and Investment and the authorities concerned with investment registration;
• the local professionals who act on the matter — our corresponding law firms and licensed service providers in Hong Kong, Guangzhou and Đồng Nai, and the company secretary and auditor appointed to the new company;
• banks, where an account is opened, under their own account-opening rules;
• notaries, translators and legalisation services, for the chain by which foreign documents are made usable;
• our service providers acting on our instructions — electronic signature, invoicing, messaging and hosting. The files are held on cloud infrastructure under our exclusive control; the provider stores them and has no right of access to their content.

Some of this data becomes public. A director’s name, correspondence address and capacity are published by the companies register of most of the jurisdictions we work in. That publication is the effect of the law, not of a choice of ours, and we cannot undo it. We say so in advance so that no one discovers it afterwards.

7. Cross-border transfers

A matter is by definition cross-border: a European investor forming a company in Guangzhou or in Đồng Nai necessarily causes their data, and that of their officers, to travel from Europe to Hong Kong and from Hong Kong to Mainland China or Vietnam. We transfer only what the receiving authority or professional requires, we tell our client where their file goes, and we bind our correspondents by confidentiality. The infrastructure on which the file is held sits partly outside Hong Kong; it is used to perform the matter and to keep the file safely, and for nothing else.

8. How long we keep it

For the duration of the matter, and afterwards for as long as we may be required to answer for it or to produce it to a regulator. Where we decline a matter, the file is archived and the personal data communicated is destroyed within six months, and sooner on request.

9. Your rights

If your data appears in one of our matters, you may ask us for access to it, for its correction, and — where nothing obliges us to keep it — for its erasure. Write to info@loonshing-consultants.hk. We will answer within the period the applicable law allows, and we will tell you plainly where a request cannot be granted and why.

Two limits are worth stating in advance, because they surprise people. Where an entry has been made in a public register, the authoritative record is the register’s: a correction must be obtained from the authority, and we will tell you which one and how. And where a document is retained under an AML-FT obligation, we cannot erase it before that obligation expires, however legitimate the request.

10. Changes

This notice may be amended. The version in force is the one published on this page, and it carries its date.